On Tue, 2017-11-21 at 16:25 +0100, Roberto Sassu wrote: > In the next version of the patch set 'ima: preserve integrity of dynamic > data', I will introduce the policy low watermark for objects. Instead of > denying writing of mutable files by processes outside the TCB, IMA will > allow the operation and demote those files (remove the HMAC). There has been no consensus for the existing patch set you've posted. In fact, everyone who has responded said to make it a separate LSM. Extending the patch set makes no sense. Mimi
