On Thu, 2018-10-11 at 13:30 -0700, Matthew Garrett wrote: > On Thu, Oct 11, 2018 at 8:23 AM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote: > > > > On Thu, 2018-10-04 at 13:30 -0700, Matthew Garrett wrote: > > > Some filesystems may be able to provide hashes in an out of band manner, > > > and allowing them to do so is a performance win. This is especially true > > > of FUSE-based filesystems where otherwise we recalculate the hash on > > > every measurement. Make use of this by default, but provide a parameter > > > to force recalculation rather than trusting the filesystem. > > > > > > Signed-off-by: Matthew Garrett <mjg59@xxxxxxxxxx> > > > > Support for not calculating the file hash would need to be finer > > grained than this, probably on a per mount basis. The default should > > be for IMA to always calculate the file hash, unless explicitly told > > not to. > > Ok, should this just be part of the IMA policy? How would you be able to differentiate between different FUSE filesystems for example? > > > IMA should never skip the file hash calculation if the filesystem is > > an untrusted mount (eg. SB_I_UNTRUSTED_MOUNTER). > > Ok. >
