Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1732559

Re: [PATCH 2/2] integrity: replace call to integrity_read_file with kernel version

Show all headers | View raw

On Tue, 12 Sep 2017, Mimi Zohar wrote:

> From: Christoph Hellwig <hch@lst.de>
> 
> The CONFIG_IMA_LOAD_X509 and CONFIG_EVM_LOAD_X509 options permit
> loading x509 signed certificates onto the trusted keyrings without
> verifying the x509 certificate file's signature.
> 
> This patch replaces the call to the integrity_read_file() specific
> function with the common kernel_read_file_from_path() function.
> To avoid verifying the file signature, this patch defines
> READING_X509_CERTFICATE.

So, to be clear, this patch solves the XFS deadlock using a different 
approach (to the now reverted integrity_read approach), which Christoph 
also says is more correct generally.  Correct?

What testing has this had?

Should this go in with the rest of the security changes now or wait until 
either -rc or the next merge window?


-- 
James Morris
<jmorris@namei.org>

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 2/2] integrity: replace call to integrity_read_file with kernel version Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-13 04:50 +0200
  Re: [PATCH 2/2] integrity: replace call to integrity_read_file with  kernel version James Morris <jmorris@namei.org> - 2017-09-14 22:30 +0200
    Re: [PATCH 2/2] integrity: replace call to integrity_read_file with  kernel version Christoph Hellwig <hch@infradead.org> - 2017-09-14 23:00 +0200
      Re: [PATCH 2/2] integrity: replace call to integrity_read_file with  kernel version James Morris <jmorris@namei.org> - 2017-09-14 23:10 +0200
      Re: [PATCH 2/2] integrity: replace call to integrity_read_file with  kernel version James Morris <jmorris@namei.org> - 2017-09-15 01:30 +0200

csiph-web