On 6 May 2014 22:11, Al Viro <v...@zeniv.linux.org.uk> wrote: > On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > >> Al, you're not going to like this, but ima_calc_file_hash() calls >> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order >> to calculate the file hash. > > And if it happens to be on NFS and server says "no reads for you"?
Sorry for repost. Lousy Android gmail client is not able to send with plain text, even with reply. IMA works by policy. It ignores non-local file systems by default. But if someone still tries to enable nfs in the custom policy, it might get into such situation. But then there are other issues like security xattrs. Anyone using ima needs to be aware what he does. > -- > To unsubscribe from this list: send the line "unsubscribe > linux-security-module" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Thanks, Dmitry -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
