On Thu, 22 Feb 2018, Mimi Zohar wrote: > For local filesystems, the kernel prevents files being executed from > being modified. With IMA-measurement enabled, the kernel also emits > audit "time of measure, time of use" messages for files opened for > read, and subsequently opened for write. > > Files on fuse are initially measured, appraised, and audited. Although > the file data can change dynamically any time, making re-measuring, > re-appraising, or re-auditing pointless, this patch set attempts to > differentiate between unprivileged non-init root and privileged > mounted fuse filesystems. > > This patch set addresses three different scenarios: > - Unprivileged non-init root mounted fuse filesystems are untrusted. > Signature verification should always fail and re-measuring, > re-appraising, re-auditing files makes no sense. > > Always enabled. > > - For privileged mounted filesystems in a "secure" environment, with a > correctly enforced security policy, which is willing to assume the > inherent risk of specific fuse filesystems, it is reasonable to > re-measure, re-appraise, and re-audit files. > > Enabled by default to prevent breaking existing systems. > > - Privileged mounted filesystems unwilling to assume the risks and > prefers to fail safe. > > Enabled based on policy. I like this approach. -- James Morris <jmorris@xxxxxxxxx>
