[RFC PATCH 0/2] Fix untangling ima mess, part 2 with counters

[Mimi Zohar]

The "Untangling ima mess, part 2 with counters" patch not
only messed up the counters, but also doesn't measure files
which should be measured. The "Untangling ima mess ..."
patchset, applied some of Eric's patches, but not all, leaving
inodes allocated before late_initcall() not allocated/measured.
(8262bb85da ima: initialize ima before inodes can be allocated)

Up to now, measuring files and updating the IMA open/read/write
counters associated with the file were done at the same time
in ima_path_check().  An imbalanced counter was an indication
that the file hadn't been measured. Each case needed to be
inspected, resulting in adding either a new ima_counts_get()
or ima_path_check() call (e.g. nfsd, ecryptfs, openAFS).

This patchset separates incrementing the counters from measuring
the file.  However, the underlying assumption is that all regular
files are opened via do_filp_open(). Is this assumption correct or,
by incrementing the file counters separately, have we inadvertently
hidden the fact that a file wasn't measured?

Mimi
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/