On 2019/05/03 1:28, Casey Schaufler wrote: > On 5/2/2019 8:48 AM, Mimi Zohar wrote: >> [Cc'ing Paul, John, Casey] >> >> On Mon, 2019-04-22 at 20:18 -0400, Mimi Zohar wrote: >>> [Cc'ing LSM mailing list] >>> >>> On Fri, 2019-04-19 at 17:30 -0700, prakhar srivastava wrote: >>> >>>> 2) Adding a LSM hook >>>> We are doing both the command line and kernel version measurement in IMA. >>>> Can you please elaborate on how this can be used outside of the scenario? >>>> That will help me come back with a better design and code. I am >>>> neutral about this. >>> As I said previously, initially you might want to only measure the >>> kexec boot command line, but will you ever want to verify or audit log >>> the boot command line hash? Perhaps LSMs would be interested in the >>> boot command line. Should this be an LSM hook? >> From an LSM perspective, is there any interest in the boot command line? > > I can imagine an LSM that cares about the command line, > but I don't have interest in it for any work I have in progress. > Since the kernel command line controls which LSMs to enable, I doubt that an LSM which cares about the command line can detect that the kernel command line was tampered when the kernel command line was tampered...
