Re: IMA & truncate

[Dmitry Kasatkin]

On 6 May 2014 22:11, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
> On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote:
>
>> Al, you're not going to like this, but ima_calc_file_hash() calls
>> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order
>> to calculate the file hash.
>
> And if it happens to be on NFS and server says "no reads for you"?

Sorry for repost. Lousy Android gmail client is not able to send with
plain text, even with reply.

IMA works by policy. It ignores non-local file systems by default.

But if someone still tries to enable nfs in the custom policy, it
might get into such situation. But then there are other issues like
security xattrs. Anyone using ima needs to be aware what he does.


> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html


-- 
Thanks,
Dmitry
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/