Re: [RFC PATCH 3/5] ima: mamespace audit status flags

2017-08-02 Thread Tycho Andersen
On Tue, Aug 01, 2017 at 01:25:31PM -0400, Mehmet Kayaalp wrote: > >> +unsigned long iint_flags(struct integrity_iint_cache *iint, > >> + struct ns_status *status) > >> +{ > >> + if (!status) > >> + return iint->flags; > >> + > >> + return iint->flags & (status->flags &

Re: [RFC PATCH 3/5] ima: mamespace audit status flags

2017-08-01 Thread Mehmet Kayaalp
> On Aug 1, 2017, at 1:17 PM, Tycho Andersen wrote: > > Hi Mehmet, > > On Thu, Jul 20, 2017 at 06:50:31PM -0400, Mehmet Kayaalp wrote: >> --- a/security/integrity/ima/ima_ns.c >> +++ b/security/integrity/ima/ima_ns.c >> @@ -301,3 +301,24 @@ struct ns_status *ima_get_ns_status(struct >> ima_nam

Re: [RFC PATCH 3/5] ima: mamespace audit status flags

2017-08-01 Thread Tycho Andersen
Hi Mehmet, On Thu, Jul 20, 2017 at 06:50:31PM -0400, Mehmet Kayaalp wrote: > --- a/security/integrity/ima/ima_ns.c > +++ b/security/integrity/ima/ima_ns.c > @@ -301,3 +301,24 @@ struct ns_status *ima_get_ns_status(struct ima_namespace > *ns, > > return status; > } > + > +#define IMA_NS_S

[RFC PATCH 3/5] ima: mamespace audit status flags

2017-07-20 Thread Mehmet Kayaalp
The iint cache stores whether the file is measured, appraised, audited etc. This patch moves the IMA_AUDITED flag into the per-namespace ns_status, enabling IMA audit mechanism to audit the same file each time it is accessed in a new namespace. The ns_status is not looked up if the CONFIG_IMA_NS i