Subject: Re: nfs optimization and veriexec
To: None <sjg@crufty.net>
From: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
List: tech-security
Date: 10/29/2007 16:38:07
[ re-add cc: tech-kern ]

> >i'd like to make a change like the following, which optimize a RPC away
> >in some cases.
> >however, i think it breaks veriexec. (specifically, breaks assumptions
> >held by veriexec_openchk.)
> >can any veriexec people take a look and suggest how it should be solved?
> 
> I'm still using an ancient version of veriexec with several mods,
> but I think the current version has a state variable you can check.
> This would allow you to skip the optimization if veriexec is enabled.
> You could perhaps even test if the kernel has any finger-prints loaded for 
> the mounted fs - if not, then veriexec won't matter - the fs is presumably 
> being used for data only. 
> 
> --sjg

yes, but i really don't want to have veriexec specific code in
each filesystems.  can't veriexec be modified to deal with it?

YAMAMOTO Takashi