On Thu, 2024-06-20 at 11:12 +0200, Roberto Sassu wrote: > On Wed, 2024-06-19 at 14:43 -0400, Paul Moore wrote: > > On Wed, Jun 19, 2024 at 12:38 PM Roberto Sassu > > <roberto.sassu@xxxxxxxxxxxxxxx> wrote: > > > > > > Making it a kernel subsystem would likely mean replicating what the LSM > > > infrastructure is doing, inode (security) blob and being notified about > > > file/directory changes. > > > > Just because the LSM framework can be used for something, perhaps it > > even makes the implementation easier, it doesn't mean the framework > > should be used for everything. > > It is supporting 3 LSMs: IMA, IPE and BPF LSM. > > That makes it a clear target for the security subsystem, and as you > suggested to start for IMA, if other kernel subsystems require them, we If other kernel subsystems require the same functionality, Roberto > can make it as an independent subsystem. > > Starting from IMA means that we are mixing two different things in the > inode security blob, and I'm not sure that it is more straightforward > than making the digest_cache LSM require the space it needs and be > notified about security events. > > Thanks > > Roberto >
