Re: [PATCH] ima: clear IMA_AUDITED when the file is modified

[Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx>]

On Thu, 2012-06-21 at 15:56 +1000, James Morris wrote:
> On Wed, 20 Jun 2012, Mimi Zohar wrote:
> 
> > On Wed, 2012-06-20 at 12:26 -0700, Peter Moody wrote:
> > > Failing to clear the IMA_AUDITED flag means that the inode would
> > > never be remeasured even if the file had changed.
> > > 
> > > Signed-off-by: Peter Moody <pmoody@xxxxxxxxxx>
> > 
> > Thanks!
> > 
> > Signed-off-by: Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx>
> 
> Mimi: are you going to put this in a tree of yours to push, or should I 
> take it directly?

Peter's patches are in
git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
#linux-integrity-next-audit-hashes, but they are on top of the
IMA-appraisal patches, including the "ima: defer calling __fput()"
patch, which needs to be removed.

A number of changes were made in preparation to defer fput() (eg. making
the syscalls use fget/fput_light(), signal changes), but I'm not sure
what's happening with the deferral itself.  Wishing someone could shed
some light on the status.

thanks,

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html