Re: [PATCH V2 3/4] IMA: Optionally make use of filesystem-provided hashes

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 5/3/2019 8:51 AM, Roberto Sassu wrote:
On 5/3/2019 1:02 AM, Mimi Zohar wrote:
On Thu, 2019-05-02 at 15:37 -0700, Matthew Garrett wrote:
On Thu, May 2, 2019 at 1:25 PM Mimi Zohar <zohar@xxxxxxxxxxxxx> wrote:
Suppose instead of re-using the "d-ng" for the vfs hash, you defined a
new field named d-vfs.  Instead of the "ima-ng" or "d-ng|n-ng", the
template name could be "d-vfs|n-ng".

Is it legitimate to redefine d-ng such that if the hash comes from the
filesystem it adds an additional prefix? This will only occur if the
admin has explicitly enabled the trusted_vfs option, so we wouldn't
break any existing configurations. Otherwise, I'll look for the
cleanest approach for making this dynamic.

I would assume modifying d-ng would break existing attestation
servers.

Yes, I would also prefer to avoid modification of d-ng.


Perhaps instead of making the template format dynamic based on fields,
as I suggested above, define a per policy rule template format option.

This should not be too complicated. The template to use will be returned
by ima_get_action() to process_measurement().

Some time ago I made some patches:

https://sourceforge.net/p/linux-ima/mailman/message/31655784/

Roberto

--
HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
Managing Director: Bo PENG, Jian LI, Yanli SHI



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux