On Fri, 2018-02-02 at 17:10 +0100, Miklos Szeredi wrote: > On Fri, Feb 2, 2018 at 4:33 PM, Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote: > > On Fri, 2018-02-02 at 10:20 -0500, Mimi Zohar wrote: > >> Hi Miklos, > >> > >> On Tue, 2018-01-30 at 19:06 +0100, Dongsu Park wrote: > >> > From: Alban Crequy <alban@xxxxxxxxxx> > >> > > >> > This new fs_type flag FS_IMA_NO_CACHE means files should be re-measured, > >> > re-appraised and re-audited each time. Cached integrity results should > >> > not be used. > >> > > >> > It is useful in FUSE because the userspace FUSE process can change the > >> > underlying files at any time without notifying the kernel. > > I don't really have an understanding what IMA is doing, I think the > same thing applies to any network filesystem (i.e. ones with > d_revalidate). > > Isn't that the case? IMA is calculating the file hash, for inclusion in the measurement list, verifying the file signature stored in the xattr, or both. For the remote filesystem case, re-calculating the file hash would be limited to inclusion in the measurement list. For FUSE, the kernel has access to the xattr, so re-calculating the file hash could also be used to re-verify the file signature. Mimi
