This series implements support for accessing and updating the
security.ima xattr on files that reside on an NFS mount. Since NFS
does not have CAP_SYS_ADMIN, only root is allowed to set this xattr
(on clients or on the server).
EVM is not supported in this prototype. NFS does not support several
of the xattrs that are protected by EVM: SMACK64, Posix ACLs, and
Linux file capabilities are not supported, which makes EVM more
difficult to support on NFS mounts.
Please see the individual patch descriptions: standards action is
still required to define the official FATTR4 flag that all NFSv4.2
implementations recognize as meaning "the security.ima xattr". This
prototype is not guaranteed to interoperate with future prototypes
or standards-compliant implementations of this feature. It is for
experimental purposes only.
I'm interested in comments on the implementation, test results, or a
discussion of whether this proposal creates undesirable security
exposures.
A topic branch with this work is here:
git://git.linux-nfs.org/projects/cel/cel-2.6.git
in the nfs-ima-prototype topic branch.
---
Chuck Lever (4):
NFS: Define common IMA-related protocol elements
NFS: Rename security xattr handler
NFS: Prototype support for IMA on NFS (client)
NFSD: Prototype support for IMA on NFS (server)
fs/nfs/nfs4_fs.h | 1
fs/nfs/nfs4proc.c | 138 ++++++++++++++++++++++++++++++++---
fs/nfs/nfs4xdr.c | 175 +++++++++++++++++++++++++++++++++++++++++++++
fs/nfsd/nfs4proc.c | 15 ++++
fs/nfsd/nfs4xdr.c | 54 ++++++++++++--
fs/nfsd/nfsd.h | 10 +++
fs/nfsd/vfs.c | 32 ++++++++
fs/nfsd/vfs.h | 3 +
fs/nfsd/xdr4.h | 3 +
fs/xattr.c | 3 +
include/linux/nfs4.h | 5 +
include/linux/nfs_fs_sb.h | 1
include/linux/nfs_xdr.h | 21 +++++
13 files changed, 440 insertions(+), 21 deletions(-)
--
Chuck Lever
