[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 08 May 2020 10:01:07 -0400
From: Mimi Zohar <zohar@...ux.ibm.com>
To: "Lev R. Oshvang ." <levonshe@...il.com>,
Mickaël Salaün
<mic@...ikod.net>
Cc: David Laight <David.Laight@...lab.com>,
"linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>,
Aleksa Sarai <cyphar@...har.com>, Alexei
Starovoitov <ast@...nel.org>,
Al Viro <viro@...iv.linux.org.uk>, Andy
Lutomirski <luto@...nel.org>,
Christian Heimes <christian@...hon.org>,
Daniel Borkmann <daniel@...earbox.net>,
Deven Bowers
<deven.desai@...ux.microsoft.com>,
Eric Chiang <ericchiang@...gle.com>,
Florian Weimer <fweimer@...hat.com>, James Morris <jmorris@...ei.org>,
Jan
Kara <jack@...e.cz>, Jann Horn <jannh@...gle.com>,
Jonathan Corbet
<corbet@....net>, Kees Cook <keescook@...omium.org>,
Lakshmi
Ramasubramanian <nramas@...ux.microsoft.com>,
Matthew Garrett
<mjg59@...gle.com>,
Matthew Wilcox <willy@...radead.org>,
Michael Kerrisk
<mtk.manpages@...il.com>,
Mickaël Salaün
<mickael.salaun@....gouv.fr>,
Philippe Trébuchet
<philippe.trebuchet@....gouv.fr>,
Scott Shell <scottsh@...rosoft.com>,
Sean
Christopherson <sean.j.christopherson@...el.com>,
Shuah Khan
<shuah@...nel.org>, Steve Dower <steve.dower@...hon.org>,
Steve Grubb
<sgrubb@...hat.com>,
Thibaut Sautereau <thibaut.sautereau@....gouv.fr>,
Vincent Strubel <vincent.strubel@....gouv.fr>,
"kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>,
"linux-api@...r.kernel.org"
<linux-api@...r.kernel.org>,
"linux-integrity@...r.kernel.org"
<linux-integrity@...r.kernel.org>,
"linux-security-module@...r.kernel.org"
<linux-security-module@...r.kernel.org>,
"linux-fsdevel@...r.kernel.org"
<linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH v5 0/6] Add support for O_MAYEXEC
On Fri, 2020-05-08 at 10:15 +0300, Lev R. Oshvang . wrote:
> I can suggest something better ( I believe)
> Some time ago I proposed patch to IMA - Add suffix in IMA policy rule criteria
> It allows IMA to verify scripts, configuration files and even single file.
> It is very simple and does not depend on open flags.
> Mimi Zohar decided not to include this patch on the reason it tries to
> protect the file name.
> ( Why ??).
Your patch relies on the filename, but does nothing to protect it.
Mimi
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
