Re: [PATCH 2/3] IMA: Make use of filesystem-provided hashes

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Oct 11, 2018 at 8:23 AM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote:
>
> On Thu, 2018-10-04 at 13:30 -0700, Matthew Garrett wrote:
> > Some filesystems may be able to provide hashes in an out of band manner,
> > and allowing them to do so is a performance win. This is especially true
> > of FUSE-based filesystems where otherwise we recalculate the hash on
> > every measurement. Make use of this by default, but provide a parameter
> > to force recalculation rather than trusting the filesystem.
> >
> > Signed-off-by: Matthew Garrett <mjg59@xxxxxxxxxx>
>
> Support for not calculating the file hash would need to be finer
> grained than this, probably on a per mount basis.  The default should
> be for IMA to always calculate the file hash, unless explicitly told
> not to.

Ok, should this just be part of the IMA policy?

> IMA should never skip the file hash calculation if the filesystem is
> an untrusted mount (eg. SB_I_UNTRUSTED_MOUNTER).

Ok.



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]

  Powered by Linux