lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 1/9] integrity: Prepare for having "ima" and "evm" available in "integrity" LSM
    From
    Date
    On Thu, 2022-10-13 at 15:36 -0700, Kees Cook wrote:
    > Move "integrity" LSM to the end of the Kconfig list and prepare for
    > having ima and evm LSM initialization called from the top-level
    > "integrity" LSM.

    The securityfs integrity directory and the "iint_cache" are shared
    IMA/EVM resources. Just because the "iint_cache" was on an LSM hook,
    it should never have been treated as an LSM on its own. IMA maintains
    and verifies file data integrity, while EVM maintains and verifies file
    metadata integrity. IMA and EVM may both be configured and enabled, or
    independently of each other. However, only if either IMA or EVM are
    configured and enabled, should the iint_cache be created. There is
    absolutely no need for an independent "integrity" LSM.
    --
    thanks,

    Mimi

    \
     
     \ /
      Last update: 2022-10-19 16:49    [W:4.286 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site