On Mon, 2023-10-16 at 11:06 -0400, Paul Moore wrote: > On Mon, Oct 16, 2023 at 8:05 AM Roberto Sassu > <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > > > > Sorry, I just noticed LSM_ID_IMA. Since we have the 'integrity' LSM, I > > think it should be LSM_ID_INTEGRITY. > > > > Mimi, all, do you agree? If yes, I send a patch shortly. > > I believe LSM_ID_IMA is the better option, despite "integrity" already > being present in Kconfig and possibly other areas. "IMA" is a > specific thing/LSM whereas "integrity" is a property, principle, or > quality. Especially as we move forward with promoting IMA as a full > and proper LSM, we should work towards referring to it as "IMA" and > not "integrity". > > If anything we should be working to support "IMA" in places where we > currently have "integrity" so that we can eventually deprecate > "integrity". Hi Paul I fully understand your argument. However, 'integrity' has been the word to identify the integrity subsystem since long time ago. Reducing the scope to 'ima' would create some confusion since, while 'ima' is associated to integrity, it would not encompass EVM. The term 'integrity', although it is a property, it precisely identifies in the kernel context the scope and goals of the subsystem, and is general enough to encompass new projects going in a similar direction (such as my integrity digest cache). >From a technical perspective, at the moment it is not possible to split 'integrity' in two standalone LSMs 'ima' and 'evm', as IMA and EVM work on shared integrity metadata. Also my integrity digest cache is using the same metadata. In addition, making IMA and EVM as standalone LSMs would require a much longer development cycle to make them use disjoint metadata and to define proper communication interfaces. It would be not anymore a technical move of function calls from a place to another, like for the current patch set, but would require substantial time to validate the new design. To submit my patch set in the current state, the only thing I need is to have LSM_ID_INTEGRITY defined. Roberto
