Re: IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 22:11, Al Viro wrote: > On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > >> Al, you're not going to like this, but ima_calc_file_hash() calls >> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order >> to calculate the file hash. > > And if it happens t

Re: IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 19:59, Al Viro wrote: > On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: >> Hi, >> >> I have discovered one IMA related issue. >> >> IMA file hash is re-calculate if needed on file close. >> >> It works with ftruncate(fd, length) syscall, because it operates on >> "op

Re: IMA & truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > Al, you're not going to like this, but ima_calc_file_hash() calls > ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order > to calculate the file hash. And if it happens to be on NFS and server says "no reads for you"

Re: IMA & truncate

2014-05-06 Thread Mimi Zohar
On Tue, 2014-05-06 at 17:59 +0100, Al Viro wrote: > On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: > > Hi, > > > > I have discovered one IMA related issue. > > > > IMA file hash is re-calculate if needed on file close. > > > > It works with ftruncate(fd, length) syscall, becau

Re: IMA & truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: > Hi, > > I have discovered one IMA related issue. > > IMA file hash is re-calculate if needed on file close. > > It works with ftruncate(fd, length) syscall, because it operates on > "opened" file. > Recalculation is happening on

Re: IMA & truncate

2014-05-06 Thread Javier González
Hi, > I have discovered one IMA related issue. > > IMA file hash is re-calculate if needed on file close. > > It works with ftruncate(fd, length) syscall, because it operates on > "opened" file. > Recalculation is happening on file close. > > truncate(path, length) syscall works with path and n

IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates on "opened" file. Recalculation is happening on file close. truncate(path, length) syscall works with path and no file open/close