Re: IMA: kernel reading files opened with O_DIRECT

2014-07-16 Thread Mimi Zohar
On Tue, 2014-07-15 at 15:03 +0200, Pavel Machek wrote: > On Sat 2014-07-12 01:22:04, Dmitry Kasatkin wrote: > > On 11 July 2014 23:10, Pavel Machek wrote: > > > On Wed 2014-07-02 11:40:50, Christoph Hellwig wrote: > > >> On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: > > >> > It's ac

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-15 Thread Pavel Machek
On Sat 2014-07-12 01:22:04, Dmitry Kasatkin wrote: > On 11 July 2014 23:10, Pavel Machek wrote: > > On Wed 2014-07-02 11:40:50, Christoph Hellwig wrote: > >> On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: > >> > It's acceptable. > >> > >> It's not because it will then also affect othe

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-11 Thread Dmitry Kasatkin
On 11 July 2014 23:10, Pavel Machek wrote: > On Wed 2014-07-02 11:40:50, Christoph Hellwig wrote: >> On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: >> > It's acceptable. >> >> It's not because it will then also affect other reads going on at the >> same time. >> >> The whole concept o

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-11 Thread Pavel Machek
On Wed 2014-07-02 11:40:50, Christoph Hellwig wrote: > On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: > > It's acceptable. > > It's not because it will then also affect other reads going on at the > same time. > > The whole concept of ima is just broken, and if you want to do these >

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-02 Thread Dmitry Kasatkin
On 2 July 2014 21:45, Jeff Moyer wrote: > Christoph Hellwig writes: > >> On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: >>> It's acceptable. >> >> It's not because it will then also affect other reads going on at the >> same time. > > OK, that part I was fuzzy on. I wasn't sure if

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-02 Thread Jeff Moyer
Christoph Hellwig writes: > On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: >> It's acceptable. > > It's not because it will then also affect other reads going on at the > same time. OK, that part I was fuzzy on. I wasn't sure if they were preventing other reads/writes to the same f

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-02 Thread Christoph Hellwig
On Wed, Jul 02, 2014 at 11:55:41AM -0400, Jeff Moyer wrote: > It's acceptable. It's not because it will then also affect other reads going on at the same time. The whole concept of ima is just broken, and if you want to do these sort of verification they need to happen inside the filesystem and n

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-02 Thread Dmitry Kasatkin
Hi Jeff, Thanks for reply. On 2 July 2014 18:55, Jeff Moyer wrote: > Hi, Dmitry, > > Dmitry Kasatkin writes: > >> Hi, >> >> We are looking for advice on reading files opened for direct_io. > > [snip] > >> 2. Temporarily clear O_DIRECT in file->f_flags. > > [snip] > >> 3. Open another instance o

Re: IMA: kernel reading files opened with O_DIRECT

2014-07-02 Thread Jeff Moyer
Hi, Dmitry, Dmitry Kasatkin writes: > Hi, > > We are looking for advice on reading files opened for direct_io. [snip] > 2. Temporarily clear O_DIRECT in file->f_flags. [snip] > 3. Open another instance of the file with 'dentry_open' [snip] > Is temporarily clearing O_DIRECT flag really una

IMA: kernel reading files opened with O_DIRECT

2014-07-02 Thread Dmitry Kasatkin
Hi, We are looking for advice on reading files opened for direct_io. IMA subsystem (security/integrity/ima) reads file content to kernel buffer with kernel_read() like function to calculate a file hash. It does not open another instance of 'struct file' but uses one allocated via 'open' system ca