lkml.org 
[lkml]   [2020]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] IMA: Turn IMA_MEASURE_ASYMMETRIC_KEYS off by default
From
Date
On Tue, 2020-01-21 at 12:38 -0800, Lakshmi Ramasubramanian wrote:
> On 1/21/2020 11:52 AM, James Bottomley wrote:
>
> >> - really small devices/sensors being able to queue certificates
> >
> > seems like the answer to this one would be don't queue. I realise it's
> > after the submit design, but what about measuring when the key is added
> > if there's a policy otherwise measure the keyring when the policy is
> > added ... that way no queueing.
>
> Without the "deferred key processing" changes, only keys added at
> runtime were measured (if policy permitted).
>
> "deferred key processing" enabled queuing keys added early in the boot
> process and measured them when the policy is loaded.
>
> We can make this (the queuing) optional through a config, but leave the
> runtime key measurement auto-enabled (as is the config
> IMA_MEASURE_ASYMMETRIC_KEYS now).

Thanks, Lakshmi.  This requires moving the code around.  Instead of
doing this on the current code base, I suggest posting a v9 version of
the entire "IMA: Deferred measurement of keys".

I suggest making the switch from spinlock to mutex, as you had it
originally, before posting v9.  The commit history will then be a lot
cleaner.

thanks,

Mimi

\
 
 \ /
  Last update: 2020-01-22 21:03    [W:0.062 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site