Received: by 2002:a05:7412:8d09:b0:fa:4c10:6cad with SMTP id bj9csp40396rdb; Mon, 15 Jan 2024 11:15:58 -0800 (PST) X-Google-Smtp-Source: AGHT+IFAIgBUfowW8C6WUCC1snG2+VZ9xmbzpW2xgsupUd7Oof290Od03VqmCBuX6KzzKttHRYC1 X-Received: by 2002:a17:90b:70b:b0:28d:b988:6a2e with SMTP id s11-20020a17090b070b00b0028db9886a2emr3721434pjz.83.1705346158612; Mon, 15 Jan 2024 11:15:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1705346158; cv=none; d=google.com; s=arc-20160816; b=0nhPH4+cErzLSGsewDe9dtReAPmWSln8C77BzM/bcRKGAYGpYZ2KK0S+bSCC9vdzKE IjSV7pFQIAu9J33Cze3vwUV7BAYLdHWJJwHehvWN0H/IK7jb55iGcJNd/E3VZ0l69o68 n9PKxRG+Ky9aT9HN24J94NaIWBd8JgC3HG+u7wsMiJPD0D98gMjaTJBIctcR3OAv7vRO bVF3wfxrCInycFO9kK8/9ncXnsbUyHdclzLcgMs+MSfVqUSdTlqRiR0UOJv8+2WJbOq9 Zo6zUc9KuSwGy9glreg+4jtPyVcV8n41TroQrGxDeg+DULfjD0y+ITE2AV9cTTLeR7Ns xM5Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:in-reply-to:content-disposition:mime-version :list-unsubscribe:list-subscribe:list-id:precedence:references :message-id:subject:cc:to:from:date:dkim-signature; bh=+vVnPmy/TAg8RPrrTtiwJI/BlzjY8BbZQ3ahxzEpH8M=; fh=VNrX0RQ9i1kOmw04E0lu11msJ28LpqW0e0wnafRptXo=; b=TTr2WaRaCooAJPgIxGLpPnJRNe8NKwM/x2sK39/zBGjlpgoF3Sg9yPtzkj7QrZF/h4 oI5eLmbmHvztvZWlq3q2M1IzkGN9d2tUvBDHHZAs4ZXMKXo5Tpn24f2wVAFkKOQJLeAB XZU6FyxJgYtQpDoJy5mCnqoGbYCc1zDgyHX4g6jAUAgE15ImUrUMCyJvS+lHvRsRa2FY d7WMTAxxljM64NpLOCkN4z2u4QckNzb85nTFnLT9Br+wzZPiwQ+TKWuiqUD9mB1yRQBZ SKIV2VIVloMuO7sXcxP2ba00OEPZYkBshBsWnqZvtmtGeNR6VvzBGnUnL2YZ1VmSrljZ dEEA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.org.uk header.s=zeniv-20220401 header.b="iW/4ukvU"; spf=pass (google.com: domain of linux-nfs+bounces-1112-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-nfs+bounces-1112-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zeniv.linux.org.uk Return-Path: Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id qa3-20020a17090b4fc300b002888396d22esi251116pjb.6.2024.01.15.11.15.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Jan 2024 11:15:58 -0800 (PST) Received-SPF: pass (google.com: domain of linux-nfs+bounces-1112-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.org.uk header.s=zeniv-20220401 header.b="iW/4ukvU"; spf=pass (google.com: domain of linux-nfs+bounces-1112-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-nfs+bounces-1112-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zeniv.linux.org.uk Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 3BDD92829E5 for ; Mon, 15 Jan 2024 19:15:58 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2183C18B15; Mon, 15 Jan 2024 19:15:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linux.org.uk header.i=@linux.org.uk header.b="iW/4ukvU" X-Original-To: linux-nfs@vger.kernel.org Received: from zeniv.linux.org.uk (zeniv.linux.org.uk [62.89.141.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 58CC51802B; Mon, 15 Jan 2024 19:15:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=zeniv.linux.org.uk Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=ftp.linux.org.uk DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=linux.org.uk; s=zeniv-20220401; h=Sender:In-Reply-To:Content-Type: MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=+vVnPmy/TAg8RPrrTtiwJI/BlzjY8BbZQ3ahxzEpH8M=; b=iW/4ukvUNBqGT8LfQP2tycMtqI BPW2dlI9CdPZy72wJf/8UZ+1/R24ZAwpAi/VgT8F1wC7kKQmkEdOX3/TU2BYtD8oEr3YBhMFe4ZsS 7ZzBNCSODKnPOXk44h037pmUtdgkrRnLrDUm6zrXVaOUK5xjvc9JLfiBYXzusi7P5H1hXYoIWo6Ao 9/CxiPBJmjxZ4lZ57EaY25Z5fYYStj1mN0EYL4bkkiTrFXH1Ok3ci9KI4jeT5wNnhuT2ws10yOPnz jIFbtYvzQJk5T0aebG4O1f1pyY30J6uJH/m5PbG1WE5sd6EJbSQ0INiqZwyVZfXTLvA7kEUi7CR0e agzrQ35g==; Received: from viro by zeniv.linux.org.uk with local (Exim 4.96 #2 (Red Hat Linux)) id 1rPSQO-003JhU-0B; Mon, 15 Jan 2024 19:15:08 +0000 Date: Mon, 15 Jan 2024 19:15:08 +0000 From: Al Viro To: Roberto Sassu Cc: brauner@kernel.org, chuck.lever@oracle.com, jlayton@kernel.org, neilb@suse.de, kolga@netapp.com, Dai.Ngo@oracle.com, tom@talpey.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, zohar@linux.ibm.com, dmitry.kasatkin@gmail.com, eric.snowberg@oracle.com, dhowells@redhat.com, jarkko@kernel.org, stephen.smalley.work@gmail.com, eparis@parisplace.org, casey@schaufler-ca.com, shuah@kernel.org, mic@digikod.net, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, selinux@vger.kernel.org, linux-kselftest@vger.kernel.org, Roberto Sassu Subject: Re: [PATCH v9 13/25] security: Introduce file_release hook Message-ID: <20240115191508.GG1674809@ZenIV> References: <20240115181809.885385-1-roberto.sassu@huaweicloud.com> <20240115181809.885385-14-roberto.sassu@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-nfs@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240115181809.885385-14-roberto.sassu@huaweicloud.com> Sender: Al Viro On Mon, Jan 15, 2024 at 07:17:57PM +0100, Roberto Sassu wrote: > From: Roberto Sassu > > In preparation for moving IMA and EVM to the LSM infrastructure, introduce > the file_release hook. > > IMA calculates at file close the new digest of the file content and writes > it to security.ima, so that appraisal at next file access succeeds. > > An LSM could implement an exclusive access scheme for files, only allowing > access to files that have no references. Elaborate that last part, please.