Re: IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 22:11, Al Viro wrote: > On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > >> Al, you're not going to like this, but ima_calc_file_hash() calls >> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order >> to calculate the file hash. > > And if it happens t

Re: IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 19:59, Al Viro wrote: > On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: >> Hi, >> >> I have discovered one IMA related issue. >> >> IMA file hash is re-calculate if needed on file close. >> >> It works with ftruncate(fd, length) syscall, because it operates on >> "op

Re: IMA & truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > Al, you're not going to like this, but ima_calc_file_hash() calls > ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order > to calculate the file hash. And if it happens to be on NFS and server says "no reads for you"

Re: IMA & truncate

2014-05-06 Thread Mimi Zohar
On Tue, 2014-05-06 at 17:59 +0100, Al Viro wrote: > On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: > > Hi, > > > > I have discovered one IMA related issue. > > > > IMA file hash is re-calculate if needed on file close. > > > > It works with ftruncate(fd, length) syscall, becau

Re: IMA & truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: > Hi, > > I have discovered one IMA related issue. > > IMA file hash is re-calculate if needed on file close. > > It works with ftruncate(fd, length) syscall, because it operates on > "opened" file. > Recalculation is happening on

Re: IMA & truncate

2014-05-06 Thread Javier González
Hi, > I have discovered one IMA related issue. > > IMA file hash is re-calculate if needed on file close. > > It works with ftruncate(fd, length) syscall, because it operates on > "opened" file. > Recalculation is happening on file close. > > truncate(path, length) syscall works with path and n