Re: [PATCH v0 2/2] IMA: Call queue functions to measure keys

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Thanks for reviewing the changes Mimi. I'll address your comments in the next update.


Overwriting the initial policy is highly recommended, but not everyone
defines a custom policy.  Should there be a time limit or some other
criteria before deleting the key measurement queue?

Mimi

For the above, I feel checking for the presence of custom policy, if that is possible, would be a more deterministic approach compared to having a time limit.

On my machine, systemd loads the custom IMA policy from /etc/ima/ima-policy if that file is present. Is this the recommended way to configure custom IMA policy? If yes, can the IMA initialization function check for the presence of the above file?

Another way to address this issue is to define a new CONFIG parameter to determine whether or not to support deferred processing of keys. If this config is chosen, custom IMA policy must be defined.

Least preferred option would be to leave the queued keys as is if custom policy is not defined - at the cost of, maybe, a non-trivial amount of kernel memory consumed.

If detection of custom policy is not possible, then define a timer to drain the key measurement queue.

Please let me know which approach you think is optimal.

thanks,
 -lakshmi




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux Kernel]     [Linux Kernel Hardening]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux SCSI]

  Powered by Linux