[apparmor] PATCH [2/2] force update of stale cache

[Kees Cook]

On Tue, Sep 14, 2010 at 11:20:27AM -0700, John Johansen wrote:
> On 09/14/2010 11:15 AM, Kees Cook wrote:
> > On Tue, Sep 14, 2010 at 03:53:06AM -0700, John Johansen wrote:
> >> This patch forces a cache update in the case that There is a cache file
> >> that is present and invalid, and the features of the kernel and cache match.  This is done even if the-W flag is not specified.
> > 
> > NAK on this; I feel strongly that cache writing should only happen when the
> > tool is explicitly directed to write them out. (This is supported by the
> > caching test which fails when this patch is applied.)
> > 
> 
> I won't contest it for now. The problem becomes that we revert to old
> straight load performance if the cache test fails.  In the case that
> we already have a cache file it make sense to invalidate and update it.
> I will certainly agree that a cache file should not ever be automatically
> generated.

Reverting to a full load when the cache fails is totally correct behavior
(and it does this both with the old and new caching). This is what I'd call
"invalidating" the cache.

However, I think making filesystem changes (either deleting the cache or
regenerating it) is a mistake unless the tool was explicitly called with
"--write-cache". The tool doesn't know the larger conditions under which it
is being run -- maybe someone is booting a test kernel and doesn't want to
throw away their old caches, etc.

> If this is causing the caching tests to fail the patch certainly needs
> to be fixed/extended.

Well, it only causes it to fail the portion that explicitly tests that
caches are not updated unless --write-cache is specified. :)

-Kees

-- 
Kees Cook
Ubuntu Security Team