Re: [Linux-ima-user] IMA hash update

[Mimi Z. <zo...@li...>]

On Thu, 2016-02-18 at 20:23 +0100, Patrick Ohly wrote:
> On Thu, 2016-02-18 at 13:34 -0500, Mimi Zohar wrote:
> > Hi Patrick,
> > 
> > On Thu, 2016-02-18 at 12:32 -0500, Mimi Zohar wrote:
> > > On Thu, 2016-02-18 at 15:41 +0100, Patrick Ohly wrote:
> > > > On Thu, 2016-02-18 at 07:32 -0500, Mimi Zohar wrote:
> > > > If anyone has suggestions for debugging the long delay until data gets
> > > > flushed, then I am open for suggestions. I'm still seeing that even with
> > > > "data=journal", it's only that the effect is less drastic.
> > > 
> > > Currently, S_SYNC isn't set.  Setting it looks like it would resolve the
> > > problem.
> > > fs/ext4/xattr.c:
> > >                 if (IS_SYNC(inode))
> > >                         ext4_handle_sync(handle);
> > 
> > Changing  'if (IS_SYNC(inode))" to  "if (IS_SYNC(inode)  ||
> > IS_IMA(inode))" in both places should fix the problem.
> 
> What is the expected effect of this change?
> 
> I've added the change to my kernel. When running with data=ordered and
> cutting power a few seconds after writing /etc/machine-id without
> fsync(), I still get an empty file with a security.ima for the non-empty
> file.
> 
> I also tried with a wait time of 10 seconds (i.e. more than the default
> five second commit delay), but still no luck.

I'm not sure why that didn't work.

Mike had suggested making the file system inode size larger, so that the
xattrs would be stored in the inode and not in the extra block
(i_file_acl).  Perhaps then the xattrs and the filedata would be updated
at the same time.

from mkfs.ext4 manpage:
       -I inode-size
              Specify the size of each inode in bytes.  The  inode-size  value
              must  be  a  power  of 2 larger or equal to 128.  The larger the
              inode-size the more space the inode table will consume, and this
              reduces  the  usable  space in the filesystem and can also nega‐
              tively impact performance.  It is not possible  to  change  this
              value after the filesystem is created.

              In  kernels  after  2.6.10 and some earlier vendor kernels it is
              possible to utilize  inodes  larger  than  128  bytes  to  store
              extended   attributes   for   improved   performance.   Extended
              attributes stored in large inodes are  not  visible  with  older
              kernels,  and  such  filesystems  will not be mountable with 2.4
              kernels at all.

              The default inode size is controlled by the mke2fs.conf(5) file.
              In  the  mke2fs.conf  file  shipped  with e2fsprogs, the default
              inode size is 256 bytes for most file systems, except for  small
              file systems where the inode size will be 128 bytes.

Mimi