Re: [PATCH 3/3] ima: use fs method to read integrity data

From	Mimi Zohar <zohar@linux.vnet.ibm.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH 3/3] ima: use fs method to read integrity data
Date	2017-09-15 17:30 +0200
Message-ID	<uq0J4-4Ms-7@gated-at.bofh.it> (permalink)
References	<upQTo-6ps-3@gated-at.bofh.it> <upQTo-6ps-9@gated-at.bofh.it> <upUNk-JO-23@gated-at.bofh.it> <uq0g1-4jX-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, 2017-09-15 at 07:49 -0700, Christoph Hellwig wrote:
> On Thu, Sep 14, 2017 at 10:50:27PM -0700, Linus Torvalds wrote:
> > This is still wrong.
> > 
> > (a) there is no explanation for why we need that exclusive lock in the
> > first place
> > 
> > Why should a read need exclusive access? You'd think shared is sufficient.
> > But regardless, it needs *explanation*.
> 
> Shared is sufficient, and nothing in the patch (except for the
> description) actually requires an exclusive lock.  It just happens that
> ima holds it exclusive for other internal reasons.

Although reading the file to calculate the file hash doesn't require
taking the lock exclusively, in either "fix" mode or called from
__fput, immediately after calculating the file hash, the file hash is
written out as an xattr.  Writing the xattr requires taking the lock
exclusively.

Mimi

Thread

[PATCH 3/3] ima: use fs method to read integrity data Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-15 07:00 +0200
  Re: [PATCH 3/3] ima: use fs method to read integrity data Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-15 11:10 +0200
    Re: [PATCH 3/3] ima: use fs method to read integrity data Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-15 11:20 +0200
    Re: [PATCH 3/3] ima: use fs method to read integrity data Linus Torvalds <torvalds@linux-foundation.org> - 2017-09-15 20:10 +0200
  Re: [PATCH 3/3] ima: use fs method to read integrity data Christoph Hellwig <hch@infradead.org> - 2017-09-15 17:00 +0200
    Re: [PATCH 3/3] ima: use fs method to read integrity data Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-15 17:30 +0200
  Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-15 22:30 +0200
    Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Linus Torvalds <torvalds@linux-foundation.org> - 2017-09-16 20:30 +0200
      Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-17 07:50 +0200
      Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Christoph Hellwig <hch@infradead.org> - 2017-09-17 17:20 +0200
        Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Linus Torvalds <torvalds@linux-foundation.org> - 2017-09-17 17:30 +0200
          Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Christoph Hellwig <hch@infradead.org> - 2017-09-17 17:40 +0200
          Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-17 18:20 +0200
            Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Linus Torvalds <torvalds@linux-foundation.org> - 2017-09-17 18:40 +0200
              Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Al Viro <viro@ZenIV.linux.org.uk> - 2017-09-17 18:40 +0200
                Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Steven Whitehouse <swhiteho@redhat.com> - 2017-09-18 11:20 +0200
                Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Jan Kara <jack@suse.cz> - 2017-09-18 12:20 +0200
                Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-18 17:00 +0200
                Re: [PATCH 3/3] ima: use fs method to read integrity data (updated  patch description) Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-09-25 01:00 +0200

csiph-web