From: James Morris <jmorris@namei.org>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-security-module@vger.kernel.org,
Christoph Hellwig <hch@lst.de>,
linux-ima-devel@lists.sourceforge.net,
Christoph Hellwig <hch@infradead.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 2/2] integrity: replace call to integrity_read_file with kernel version
Date: Fri, 15 Sep 2017 06:21:28 +1000 (AEST) [thread overview]
Message-ID: <alpine.LRH.2.21.1709150617350.4414@namei.org> (raw)
In-Reply-To: <1505270734-4280-2-git-send-email-zohar@linux.vnet.ibm.com>
On Tue, 12 Sep 2017, Mimi Zohar wrote:
> From: Christoph Hellwig <hch@lst.de>
>
> The CONFIG_IMA_LOAD_X509 and CONFIG_EVM_LOAD_X509 options permit
> loading x509 signed certificates onto the trusted keyrings without
> verifying the x509 certificate file's signature.
>
> This patch replaces the call to the integrity_read_file() specific
> function with the common kernel_read_file_from_path() function.
> To avoid verifying the file signature, this patch defines
> READING_X509_CERTFICATE.
So, to be clear, this patch solves the XFS deadlock using a different
approach (to the now reverted integrity_read approach), which Christoph
also says is more correct generally. Correct?
What testing has this had?
Should this go in with the rest of the security changes now or wait until
either -rc or the next merge window?
--
James Morris
<jmorris@namei.org>
next prev parent reply other threads:[~2017-09-14 20:22 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-13 2:45 [PATCH 1/2] vfs: constify path argument to kernel_read_file_from_path Mimi Zohar
2017-09-13 2:45 ` [PATCH 2/2] integrity: replace call to integrity_read_file with kernel version Mimi Zohar
2017-09-14 20:21 ` James Morris [this message]
2017-09-14 20:49 ` Christoph Hellwig
2017-09-14 21:00 ` James Morris
2017-09-14 23:21 ` James Morris
2017-09-13 16:33 ` [PATCH 1/2] vfs: constify path argument to kernel_read_file_from_path Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LRH.2.21.1709150617350.4414@namei.org \
--to=jmorris@namei.org \
--cc=hch@infradead.org \
--cc=hch@lst.de \
--cc=linux-ima-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®