[prev in list] [next in list] [prev in thread] [next in thread]
List: linux-integrity
Subject: Re: [PATCH V3 2/2] IMA: Support using new creds in appraisal policy
From: James Morris <james.l.morris () oracle ! com>
Date: 2017-10-26 9:14:37
Message-ID: alpine.LFD.2.20.1710261110260.14992 () localhost
[Download RAW message or body]
On Thu, 26 Oct 2017, Matthew Garrett wrote:
> The existing BPRM_CHECK functionality in IMA validates against the
> credentials of the existing process, not any new credentials that the
> child process may transition to. Add an additional CREDS_CHECK target
> and refactor IMA to pass the appropriate creds structure. In
> ima_bprm_check(), check with both the existing process credentials and
> the credentials that will be committed when the new process is started.
> This will not change behaviour unless the system policy is extended to
> include CREDS_CHECK targets - BPRM_CHECK will continue to check the same
> credentials that it did previously.
>
> Signed-off-by: Matthew Garrett <mjg59@xxxxxxxxxx>
Reviewed-by: James Morris <james.l.morris@xxxxxxxxxx>
--
James Morris
<james.l.morris@xxxxxxxxxx>
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic