On 10/4/19 12:57 PM, Mimi Zohar wrote:
IMA is late because it is waiting for the TPM to be available.
>
Another option would be to queue the measurements and then replay them once the TPM and IMA are available. I'm not sure I like this approach any better.
I agree - I too don't like this approach (queue the measurements and then replay). Even in that approach IMA will have to invoke functions outside of IMA to retrieve the stored measurements.
I prefer gathering data on trusted keys in ima_init, but gate it by IMA policy and follow the other coding guidelines you have suggested earlier (similar to the approach taken for kexec_cmdline measurement).
Please let me know if you agree - I can send the new patch set by next week. Thanks, -lakshmi
