Re: [PATCH] integrity: track ctime in addition to i_version for assessment

2017-07-06 Thread Jeff Layton
On Thu, 2017-07-06 at 17:00 -0400, Mimi Zohar wrote: > Hi Jeff, > > On Thu, 2017-07-06 at 12:23 -0400, Jeff Layton wrote: > > From: Jeff Layton > > > > The IMA assessment code tries to use the i_version counter to detect > > when changes to a file have occurred. Many

Re: [PATCH] integrity: track ctime in addition to i_version for assessment

2017-07-06 Thread Jeff Layton
On Thu, 2017-07-06 at 17:00 -0400, Mimi Zohar wrote: > Hi Jeff, > > On Thu, 2017-07-06 at 12:23 -0400, Jeff Layton wrote: > > From: Jeff Layton > > > > The IMA assessment code tries to use the i_version counter to detect > > when changes to a file have occurred. Many filesystems don't increment

Re: [PATCH] integrity: track ctime in addition to i_version for assessment

2017-07-06 Thread Mimi Zohar
Hi Jeff, On Thu, 2017-07-06 at 12:23 -0400, Jeff Layton wrote: > From: Jeff Layton > > The IMA assessment code tries to use the i_version counter to detect > when changes to a file have occurred. Many filesystems don't increment > it properly (or at all) so detecting changes

Re: [PATCH] integrity: track ctime in addition to i_version for assessment

2017-07-06 Thread Mimi Zohar
Hi Jeff, On Thu, 2017-07-06 at 12:23 -0400, Jeff Layton wrote: > From: Jeff Layton > > The IMA assessment code tries to use the i_version counter to detect > when changes to a file have occurred. Many filesystems don't increment > it properly (or at all) so detecting changes with that is not

[PATCH] integrity: track ctime in addition to i_version for assessment

2017-07-06 Thread Jeff Layton
From: Jeff Layton The IMA assessment code tries to use the i_version counter to detect when changes to a file have occurred. Many filesystems don't increment it properly (or at all) so detecting changes with that is not always reliable. That check should really be gated on

[PATCH] integrity: track ctime in addition to i_version for assessment

2017-07-06 Thread Jeff Layton
From: Jeff Layton The IMA assessment code tries to use the i_version counter to detect when changes to a file have occurred. Many filesystems don't increment it properly (or at all) so detecting changes with that is not always reliable. That check should really be gated on IS_I_VERSION. When