Re: IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 22:11, Al Viro wrote: > On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > >> Al, you're not going to like this, but ima_calc_file_hash() calls >> ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order >> to calculate the file hash. > > And if it happens

Re: IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 19:59, Al Viro wrote: > On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: >> Hi, >> >> I have discovered one IMA related issue. >> >> IMA file hash is re-calculate if needed on file close. >> >> It works with ftruncate(fd, length) syscall, because it operates on >>

Re: IMA & truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: > Al, you're not going to like this, but ima_calc_file_hash() calls > ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order > to calculate the file hash. And if it happens to be on NFS and server says "no reads for

Re: IMA & truncate

2014-05-06 Thread Mimi Zohar
On Tue, 2014-05-06 at 17:59 +0100, Al Viro wrote: > On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: > > Hi, > > > > I have discovered one IMA related issue. > > > > IMA file hash is re-calculate if needed on file close. > > > > It works with ftruncate(fd, length) syscall,

Re: IMA & truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: > Hi, > > I have discovered one IMA related issue. > > IMA file hash is re-calculate if needed on file close. > > It works with ftruncate(fd, length) syscall, because it operates on > "opened" file. > Recalculation is happening on

Re: IMA & truncate

2014-05-06 Thread Javier González
Hi, > I have discovered one IMA related issue. > > IMA file hash is re-calculate if needed on file close. > > It works with ftruncate(fd, length) syscall, because it operates on > "opened" file. > Recalculation is happening on file close. > > truncate(path, length) syscall works with path and

IMA & truncate

2014-05-06 Thread Dmitry Kasatkin
Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates on "opened" file. Recalculation is happening on file close. truncate(path, length) syscall works with path and no file open/close

Re: IMA truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 19:59, Al Viro v...@zeniv.linux.org.uk wrote: On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates

Re: IMA truncate

2014-05-06 Thread Dmitry Kasatkin
On 6 May 2014 22:11, Al Viro v...@zeniv.linux.org.uk wrote: On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: Al, you're not going to like this, but ima_calc_file_hash() calls ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order to calculate the file hash. And

IMA truncate

2014-05-06 Thread Dmitry Kasatkin
Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates on opened file. Recalculation is happening on file close. truncate(path, length) syscall works with path and no file open/close

Re: IMA truncate

2014-05-06 Thread Javier González
Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates on opened file. Recalculation is happening on file close. truncate(path, length) syscall works with path and no file

Re: IMA truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates on opened file. Recalculation is happening on file

Re: IMA truncate

2014-05-06 Thread Mimi Zohar
On Tue, 2014-05-06 at 17:59 +0100, Al Viro wrote: On Tue, May 06, 2014 at 04:32:27PM +0300, Dmitry Kasatkin wrote: Hi, I have discovered one IMA related issue. IMA file hash is re-calculate if needed on file close. It works with ftruncate(fd, length) syscall, because it operates

Re: IMA truncate

2014-05-06 Thread Al Viro
On Tue, May 06, 2014 at 02:39:17PM -0400, Mimi Zohar wrote: Al, you're not going to like this, but ima_calc_file_hash() calls ima_calc_file_hash_tfm(), which already sets/unsets FMODE_READ in order to calculate the file hash. And if it happens to be on NFS and server says no reads for you? --