Subject: Re: nfs optimization and veriexec
To: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp>
From: Simon J. Gerraty <sjg@crufty.net>
List: tech-security
Date: 10/28/2007 21:57:35
>i'd like to make a change like the following, which optimize a RPC away
>in some cases.
>however, i think it breaks veriexec. (specifically, breaks assumptions
>held by veriexec_openchk.)
>can any veriexec people take a look and suggest how it should be solved?

I'm still using an ancient version of veriexec with several mods,
but I think the current version has a state variable you can check.
This would allow you to skip the optimization if veriexec is enabled.
You could perhaps even test if the kernel has any finger-prints loaded for 
the mounted fs - if not, then veriexec won't matter - the fs is presumably 
being used for data only. 

--sjg