From: hooanon05@yahoo.co.jp
Subject: Re: [PATCH] integrity: add ima_counts_put (updated) 
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-kernel@vger.kernel.org, James Morris <jmorris@namei.org>,
       David Safford <safford@watson.ibm.com>, Mimi Zohar <zohar@us.ibm.com>
In-Reply-To: <1246313060.3280.81.camel@dyn9002018117.watson.ibm.com>
References: <1246029874-6860-1-git-send-email-zohar@linux.vnet.ibm.com> <1246039527.4809.18.camel@dyn9002018117.watson.ibm.com> <12000.1246284749@jrobl> <1246286783.4054.56.camel@dyn9002018117.watson.ibm.com> <7959.1246307789@jrobl> <1246313060.3280.81.camel@dyn9002018117.watson.ibm.com>
Date: Fri, 03 Jul 2009 13:02:41 +0900
Message-ID: <7465.1246593761@jrobl>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 947
Lines: 22


Mimi Zohar:
> NFSv3 is an interesting example. Permission checking is done once,
> followed by multiple open/read/close calls. Incrementing the counters in
> nfsd_permission() once and decrementing the counters in close, multiple
> times, resulted in imbalance messages.  True, the solution in this case
> was to increment in open and decrement in close, but that was only part
> of the solution.  The other part of the solution, the important part,
> was to add a call to ima_path_check() to measure the file.

Let me make sure.
Does "that was only part of the solution" mean IMA does not work for
NFSD fully? To make IMA work fully, is incrementing before open
absolutely necessary?


J. R. Okajima
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/