This patch set modifies the credentials presented by eCryptfs to open inodes in the lower filesystem. These credentials are initially obtained through the function prepare_kernel_cred() and may be overridden in order to identify or restrict actions performed by a specific eCryptfs filesystem. More details about how to manage the eCryptfs credentials and how to measure eCryptfs files with IMA can be found in the file: 'Documentation/filesystems/ecryptfs-security.txt' Roberto Sassu Roberto Sassu (4): fs: preserve S_IMA inode flag in fsstack_copy_attr_all() eCryptfs: introduce per-filesystem credentials eCryptfs: override prepared credentials eCryptfs: added ima_file_check() call to ecryptfs_init_lower_file() Documentation/filesystems/ecryptfs-security.txt | 98 +++++++++++ fs/ecryptfs/Makefile | 2 +- fs/ecryptfs/crypto.c | 1 + fs/ecryptfs/ecryptfs_kernel.h | 21 +--- fs/ecryptfs/kthread.c | 197 ----------------------- fs/ecryptfs/main.c | 76 ++++++--- fs/stack.c | 2 +- 7 files changed, 155 insertions(+), 242 deletions(-) create mode 100644 Documentation/filesystems/ecryptfs-security.txt delete mode 100644 fs/ecryptfs/kthread.c -- 1.7.4.4
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
