On Fri, 17 Nov 2017, Roberto Sassu wrote: > LSMs are responsible to enforce a security policy at run-time, while > IMA/EVM protect data and metadata against offline attacks. In my view, IMA can also protect against making an online attack persistent across boots, and that would be the most compelling use of it for many general purpose applications. -- James Morris <james.l.morris@xxxxxxxxxx>
