On Thu, Jun 20, 2024 at 5:12 AM Roberto Sassu <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > On Wed, 2024-06-19 at 14:43 -0400, Paul Moore wrote: > > On Wed, Jun 19, 2024 at 12:38 PM Roberto Sassu > > <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > > > > > > Making it a kernel subsystem would likely mean replicating what the LSM > > > infrastructure is doing, inode (security) blob and being notified about > > > file/directory changes. > > > > Just because the LSM framework can be used for something, perhaps it > > even makes the implementation easier, it doesn't mean the framework > > should be used for everything. > > It is supporting 3 LSMs: IMA, IPE and BPF LSM. > > That makes it a clear target for the security subsystem, and as you > suggested to start for IMA, if other kernel subsystems require them, we > can make it as an independent subsystem. Have you discussed the file digest cache functionality with either the IPE or BPF LSM maintainers? While digest_cache may support these LSMs, I don't recall seeing any comments from the other LSM developers; if you are going to advocate for this as something outside of IMA, it would be good to see a show of support for the other LSMs. -- paul-moore.com
