Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     Mimi Zohar <zohar@linux.ibm.com>
CC:     "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        Raul Rangel <rrangel@chromium.org>,
        Amir Goldstein <amir73il@gmail.com>
Subject: Re: [PATCH v3] ima: detect changes to the backing overlay file
Thread-Topic: [PATCH v3] ima: detect changes to the backing overlay file
Thread-Index: AQHaB1EKBAitqnRS3kK+mlIGVgRDjrBasbYA
Date:   Wed, 25 Oct 2023 16:27:52 +0000
Message-ID: <485C9C57-ABF1-4618-81D1-345597A1B9FA@oracle.com>
References: <20231025143906.133218-1-zohar@linux.ibm.com>
In-Reply-To: <20231025143906.133218-1-zohar@linux.ibm.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?utf-8?B?L0F2dW9oR2NROG1yREFrZkZRZTgxTEdDRExQVHFQd0JCVWx2SGR6L0Rzb1Ny?=
 =?utf-8?B?WDZYM2x3bXJnR1dydWc4MXcvV0dlSzhuaVFxUnNqYmY3Ly8wd1Rka2U0UnRv?=
 =?utf-8?B?a1h3WE1TejVhbUQ5Z1puY2FJQUIzNlp1VlVEeGg1eEZLdEsyQjlETHdDUUpL?=
 =?utf-8?B?dkFucWl0MVRLUGY5OTgxMHpHTHlGYUkrd2thRmRqRmdkbHVtbGV0Umw1d1R5?=
 =?utf-8?B?aXZyRFVpZnJocW5sa3c2K24wUVhadkZ5c3hxYWxGTXFBcEVRM3FDRXZpYTlJ?=
 =?utf-8?B?MGEyMGlPVThzRkRmRTRPc2M0NTRacGkzU3VQaU1Sb1A5eEdubno2RlBqbUdP?=
 =?utf-8?B?UXZucTA4OTJiTC9BWVVpa0QwNkNHQTQ0ajQxaCtQQUpLVld5VktzeU1JVm5a?=
 =?utf-8?B?bUUwTGsrbVNVTTJEN1FXWFVMVWt6eEVnOEtyZHU3REdrMjNod040QnhLejFr?=
 =?utf-8?B?UXZteG9Xc1N4aHlWOGpNeG1vNjJTbmIzRThwc0hlbTcvQnNzRmdKblRVL0wy?=
 =?utf-8?B?cmRaRE1XbzhaMS9QRktNNlB0Wlp4NkVsTlY3d25Zclp6dkhQRFBDRUJraUtr?=
 =?utf-8?B?U3ZreHZpK1Q4cnhmbXBZZHhqdmo4ZGszMzdRUnA5OTRITXh2S3orcElhR3lp?=
 =?utf-8?B?bCthQ1JIR1l3dURmZFV3dWcvOE1XWEpQL08xdGRnekl5Z05WZWE4Z3pNWXJY?=
 =?utf-8?B?SFR6Qy9oTXVQUTFoNDVCVmtHTEpwLzVjK1hCK1drY1MxNnJPZ0VXazFvc1RS?=
 =?utf-8?B?VGdNZHNxaDZ4UTNheHZBT2hodklyelUwaG5FN085cGhQNTZzUnNYTnVXWXdS?=
 =?utf-8?B?UmZWWTkyRms2MENyOGlyYXRaWCs2UlE4WCsxL2VVMVZqdjZDaUt1bEJoZWgy?=
 =?utf-8?B?cEhOK2pjRnlrMCs3RzMzVWliVlJRWmMzMzlBWk1RcW14S01nb0IreTBHMDUz?=
 =?utf-8?B?dDJqWHNQdW14a0NJQVYzdVpaaVNFNFpoWWY4K3U1ejFpNUVnTXc5L2diOTcy?=
 =?utf-8?B?czFMSDArRHhiSHRTdTJIc0k3VE1NNEl4ZnFheUc1bEJaYXlXaC9vSzZwc0xH?=
 =?utf-8?B?bmt1V1ZnazlRd3RIWC91VGs1MHRCTFNhd1p5ZUVwelJQeFBxRCtYamlFN1g3?=
 =?utf-8?B?NkhMakxaWGZZdVJUS3Z6eGhpbzlPK3FrZnhKandrU0lMdStUTXpxa2hrdzJG?=
 =?utf-8?B?L0pQby85Q0ZxR2pWaXZDREE4cGtHeVRDUnEvYUVRaW4vQmwvcU1Vbk4wVndB?=
 =?utf-8?B?clVsdDJKVzdPMlhydk1TdjhSNUZvY1djNUg3QVV5bXRXREs4eW42TmRVbjBD?=
 =?utf-8?B?aERFWnNKUlF1MXNYZUZPQzIxL25jQ0syYitoUkgzdm9lMmkrWmVGQkpqMU5X?=
 =?utf-8?B?eTFVcVRxN3E1aXo5RkRHbjRFZ0cxWG9MSU1MTGx4SEpScDlhdGxLYUUyUUdo?=
 =?utf-8?B?QnUwZ0lIbXpSU25HYy9abkpkdytiSC9ZQ1NyRTZVejQzbUU1UjVWbXF3Z0lh?=
 =?utf-8?B?QW5sSzZPNGJ5ZGxTOFlFYURkc0RWS3hsVE91Z2s3UkREYVZiS1VteU1EYm5w?=
 =?utf-8?B?ZklkVFM0dkZqRDg3NDEraWw1QysvaWFNY0MrTGFEaDZaRm9yeFQreTE2TU9G?=
 =?utf-8?B?Y1psYWQxaDNNaWtza29pRmNaOHpkK3hVMnFLU0Y2N3dtV01vL0VLN0k0UlFY?=
 =?utf-8?B?OGdsbXp1aUcwNG9JVXZoK01PcjdWSGdqaXduSU8wSDRDZGxtWEFUeG0vbkcy?=
 =?utf-8?B?RFBUeklkTzE0SVhqVSt6eVN3RzFoQkdvbVk2eHVJbnpLb1QxVFF5KzBSRG8w?=
 =?utf-8?B?aUJPVFpnU2g1R2dLeFF5SFJZUjJYY2JncWFBVmsxWUdmTmZyb2lDRUsxcTBq?=
 =?utf-8?B?Q3d4QnpuRHV0OEY1UGpqVk1OUlNuRUgvR0JrdGh5Ymt4b3BDeXVNbHA1QXBC?=
 =?utf-8?B?ZHVVRkpWdFFJeTBQWXFSUGE2bEpkM2pmZE9qWTgycHlkSDkvUGQxUm5uY2p0?=
 =?utf-8?B?bERMUktzSWJWRlhQQ3FYSTFCbzZ0M2hPWWkweHNKcDBxWStKbDVuc1FUdVJ5?=
 =?utf-8?B?VjM2a3YyT0Q4eHNhRldZZWt5Z20vUVdUMEJhNUg4NHZaZFAvRno0b0hKbFZM?=
 =?utf-8?B?L2ZRbWpGanYwWHV1dFVGcjdDZis3dmR2aW8vVTdjZWx0MFlLSTBvb3VkTWN5?=
 =?utf-8?B?cUE9PQ==?=
Content-Type: text/plain; charset="utf-8"
Content-ID: <8BFD1923A3177B47A4F01DC68D8E286C@namprd10.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: iF2crUDpCMyNUB77YIjU95BOtYlu0Ecf/67WULlzf6k9Lcqv4HFRxFl72CNGlHJvPUVFRMD5826TnkKl+mrjUYRqr8ei8hw6m2svWKvfPeiiF+vmegbpuOmM4dGUCu7d4hMaeqIataBtXuBiPyHYRRHAtpljNrMg998bE5k6ce+PNLYz6YG59WTRJ9pErOfVlT+raAH/Hlx2lP3Q4s69I2vEQv2BR5ZVr2JkGZQgy8q3NM3dMT2LzJEb9H0/dypZAH/nKr3CeJR8LMs4VTBGDxfVa1OQasKmWbi/MqjWtEaGJKOK06FOXJH3sqx9ZQN2fWEGucMwi/Ky3YwDo9FKlfkTejtzMsGwl2jSN0hyl3ZQjYPoZHzKsM8EMwLiZL+WDkbcPunHKLtlqDnwdlOib80C+UpnrD4q6VYr0xRuJYid0gntTEeIJ1bcysyeLeGCE7ds4sEFTmEUXQ1gfYDoPhttFfRlfaL84N99idqMdBeG8jAoekhDhNN6svhF+yn5iEzRVwvCldxHLM71C7/3s9UQ3jClRGkxLz9yWjxYHM56midWfY7iOPTeS3ETmBXQIwuOq+mn4H+9GwCuSgtsTvVzvYnn/Wxhi81hv56Sr+uI/XekpF/tjepNTASSQ5x6AXgUHQKmmX7+SOtU9Hg2ugMIGidjZflrmqTf7CIu/2bilFtSdTO7mOuPdrhfw54bgwbjAXPKHmyBAvELB8WalgCkJBnHLBD24TExJPaZyBNq1sUliKDXJziQKrj6U6wgvSoM5kMQWBDkDJYE5Lobmyo4oVvxNUiTzKgYXxwVdOoUN5weONrYl4+5Z5nKejOi151sXXtHNNMLB9JOjZ5M4mjhb14R2mPpfR2wqSRob48=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 13a79a83-768b-4185-9b2c-08dbd57755dd
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Oct 2023 16:27:52.1121
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: hs8dEbHgFvHDwsKQyyWPELD6n27SyBdcEppdYjrAo6Pfa0TJhmxACL8kEbWf9DOcC8+FDYApG7YGZB8CaV2SIZsuO/I5u1mzUPbT65rjAO0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR10MB6014
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-25_05,2023-10-25_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 adultscore=0 suspectscore=0
 phishscore=0 malwarescore=0 mlxscore=0 mlxlogscore=999 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2310170001
 definitions=main-2310250142
X-Proofpoint-GUID: vlcZQRaibhqUw4YExOc0_sa6Qi8xzarb
X-Proofpoint-ORIG-GUID: vlcZQRaibhqUw4YExOc0_sa6Qi8xzarb
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Wed, 25 Oct 2023 09:28:04 -0700 (PDT)

DQoNCj4gT24gT2N0IDI1LCAyMDIzLCBhdCA4OjM5IEFNLCBNaW1pIFpvaGFyIDx6b2hhckBsaW51
eC5pYm0uY29tPiB3cm90ZToNCj4gDQo+IENvbW1pdCAxOGI0NGJjNWE2NzIgKCJvdmw6IEFsd2F5
cyByZWV2YWx1YXRlIHRoZSBmaWxlIHNpZ25hdHVyZSBmb3INCj4gSU1BIikgZm9yY2VkIHNpZ25h
dHVyZSByZS1ldmF1bGF0aW9uIG9uIGV2ZXJ5IGZpbGUgYWNjZXNzLg0KPiANCj4gSW5zdGVhZCBv
ZiBhbHdheXMgcmUtZXZhbHVhdGluZyB0aGUgZmlsZSdzIGludGVncml0eSwgZGV0ZWN0IGEgY2hh
bmdlDQo+IHRvIHRoZSBiYWNraW5nIGZpbGUsIGJ5IGNvbXBhcmluZyB0aGUgY2FjaGVkIGZpbGUg
bWV0YWRhdGEgd2l0aCB0aGUNCj4gYmFja2luZyBmaWxlJ3MgbWV0YWRhdGEuICBWZXJpZnlpbmcg
anVzdCB0aGUgaV92ZXJzaW9uIGhhcyBub3QgY2hhbmdlZA0KPiBpcyBpbnN1ZmZpY2llbnQuICBJ
biBhZGRpdGlvbiBzYXZlIGFuZCBjb21wYXJlIHRoZSBpX2lubyBhbmQgc19kZXYNCj4gYXMgd2Vs
bC4NCj4gDQo+IFNpZ25lZC1vZmYtYnk6IE1pbWkgWm9oYXIgPHpvaGFyQGxpbnV4LmlibS5jb20+
DQoNCkkgcmFuIHRoZSBmaWxlIGludGVncml0eSB0ZXN0cyB0aGF0IG9yaWdpbmFsbHkgdW5jb3Zl
cmVkIHRoZSBuZWVkIGZvciANCiJDb21taXQgMThiNDRiYzVhNjcyICgib3ZsOiBBbHdheXMgcmVl
dmFsdWF0ZSB0aGUgZmlsZSBzaWduYXR1cmUgZm9yIA0KSU1B4oCdKS4gV2hlbiB0aGUgYmFja2lu
ZyBmaWxlIGlzIGNoYW5nZWQsIGZpbGUgaW50ZWdyaXR5IHJlbWFpbnMuICBGb3IgdGhhdCANCnBh
cnQsIGZlZWwgZnJlZSB0byBhZGQ6DQoNClRlc3RlZC1ieTogRXJpYyBTbm93YmVyZyA8ZXJpYy5z
bm93YmVyZ0BvcmFjbGUuY29tPg0KDQo=