Re: [PATCH 0/2] turn on force option for FUSE in builtin policies

[Mimi Zohar]

On Mon, 2018-01-15 at 06:48 -0800, Christoph Hellwig wrote:
> On Thu, Jan 11, 2018 at 08:51:48PM +0100, Dongsu Park wrote:
> > In case of FUSE filesystem, cached integrity results in IMA could be
> > reused, when the userspace FUSE process has changed the
> > underlying files. To be able to avoid such cases, we need to turn on
> > the force option in builtin policies, for actions of measure and
> > appraise. Then integrity values become re-measured and re-appraised.
> > In that way, cached integrity results won't be used.
> 
> The same is true for any distributed file system.  Checking for magic
> numbers is always the wrong thing.  You'll need flags for specific
> behavior in struct file_system_type instead.

For XFS, which considers fsmagic numbers private to the filesystem,
*always* using the fsmagic number is wrong. ÂAs to whether this is
true for other filesystems is unclear. ÂIMA policies have been defined
in terms of fsmagic numbers for a long time. Âfsmagic numbers were
moved from the filesystems to magic.h for this purpose. ÂSomeone would
have complained earlier if it is always wrong.
Â
I just posted a patch titled "ima: define new policy condition based
on the filesystem name" to allow policies to be defined in terms of
theÂi_sb->s_type->name.

Mimi