On 10/4/19 2:58 PM, Mimi Zohar wrote:
The measurements could be added to an IMA pending measurement
workqueue, until the TPM is enabled, assuming there is a TPM, and then
processed. All of this code would be within IMA.
Good point. I will look into this.
I prefer gathering data on trusted keys in ima_init, but gate it by IMA
policy and follow the other coding guidelines you have suggested earlier
(similar to the approach taken for kexec_cmdline measurement).
So your intention is only to measure the initial keys added to these
keyrings, not anything subsequently added to the secondary keyring?
I am currently measuring only the initial keys. But I think including
the ones added subsequently is a good idea.
Defining an LSM/IMA hook to measure keys, based on policy, seems
cleaner and more useful.
I agree.
thanks,
-lakshmi
