linux-kernel - Re: ima: use of radix tree cache indexing == massive waste of memory?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 18 Oct 2010 11:09:20 -0400
From:	Christoph Hellwig <hch@...radead.org>
To:	Eric Paris <eparis@...hat.com>
Cc:	Ted Ts'o <tytso@....edu>, Peter Zijlstra <peterz@...radead.org>,
	Eric Paris <eparis@...isplace.org>,
	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	Christoph Hellwig <hch@...radead.org>,
	Dave Chinner <david@...morbit.com>,
	linux-kernel@...r.kernel.org, Mimi Zohar <zohar@...ibm.com>,
	warthog9@...nel.org, hpa@...or.com
Subject: Re: ima: use of radix tree cache indexing == massive waste of memory?

> It can be turned on any time inside the initrd without loss of integrity
> assuming the kernel and initrd were both measured and stored in a TPM
> PCR.  I'm willing to agree that the usefulness might be limited, but it
> isn't non-existant.  I'm going to make a note to look at other ways to
> cut down the memory usage.

It's not just memory overhead - it also adds another global reasource
and global lock for every inode allocation/freeing.  That's okay if
people actually want to use IMA - but if you do it everywhere it's
a real PITA.

If there's seriously no way to fix it up to not cause harm by default
just extending the inode is the much better way to go.  But given
that it's already in distros with a kABI I suspect some people will
be interested in fixing it for people instead of forcing this overhead
on their customers for years.  We might want to just piggyback on that.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/