On Tue, Oct 17, 2023 at 3:01 AM Roberto Sassu <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > On Mon, 2023-10-16 at 11:06 -0400, Paul Moore wrote: > > On Mon, Oct 16, 2023 at 8:05 AM Roberto Sassu > > <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > > > > > > Sorry, I just noticed LSM_ID_IMA. Since we have the 'integrity' LSM, I > > > think it should be LSM_ID_INTEGRITY. > > > > > > Mimi, all, do you agree? If yes, I send a patch shortly. > > > > I believe LSM_ID_IMA is the better option, despite "integrity" already > > being present in Kconfig and possibly other areas. "IMA" is a > > specific thing/LSM whereas "integrity" is a property, principle, or > > quality. Especially as we move forward with promoting IMA as a full > > and proper LSM, we should work towards referring to it as "IMA" and > > not "integrity". > > > > If anything we should be working to support "IMA" in places where we > > currently have "integrity" so that we can eventually deprecate > > "integrity". > > Hi Paul > > I fully understand your argument. However, 'integrity' has been the > word to identify the integrity subsystem since long time ago. > > Reducing the scope to 'ima' would create some confusion since, while > 'ima' is associated to integrity, it would not encompass EVM. Using LSM_ID_IMA to reference the combination of IMA+EVM makes much more sense to me than using LSM_ID_INTEGRITY, especially as we move towards promoting IMA+EVM and adopting LSM hooks for integrity verification, opening the door for other integrity focused LSMs. -- paul-moore.com
