>>>>> "Mimi" == Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> writes: Mimi> On Mon, 2010-10-18 at 02:25 -0400, Kyle McMartin wrote: >> If someone gives me a good reason why Fedora actually needs this >> enabled, I'm going to apply the following patch to our kernel so that >> IMA is globally an opt-in feature... Otherwise I'm inclined to just >> disable it. Mimi> Am hoping others will chime in. I'll chime in. I run Debian Squeeze and Ubuntu 10.10 and neither of them seem to have this monstrosity enabled at all, which is good. It should default to OFF and have a big fat warning saying it's a memory pig. >> (But the more I look at this, the more it looks like a completely niche >> option that has little use outside of three-letter agencies.) >> >> I regret not looking at this more closely when it was enabled, >> (although, in my defence, when the option first showed up, I left it >> off...) >> >> It's probably way more heavyweight than necessary, as I think in most >> cases the iint_initalized test will cover the call into IMA. But better >> safe than sorry or something and there's a bunch of other cases where >> -ENOMEM will leak back up from failing kmem_cache_alloc, iirc. >> >> regards, Kyle Mimi> Thanks, will compile/test patch. >From what I'm reading, it's not even useful unless you have TPM hardware? I dunno... I'm just hesitant to use this or SElinux because the hassles are not worth the payoff. John _______________________________________________ kernel mailing list kernel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/kernel
