linux-kernel - Re: ima: use of radix tree cache indexing == massive waste of memory?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 18 Oct 2010 15:24:10 -0400
From:	"John Stoffel" <john@...ffel.org>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	Kyle McMartin <kyle@...artin.ca>, James Morris <jmorris@...ei.org>,
	Christoph Hellwig <hch@...radead.org>,
	kernel@...ts.fedoraproject.org, Mimi Zohar <zohar@...ibm.com>,
	warthog9@...nel.org, Dave Chinner <david@...morbit.com>,
	linux-kernel@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>,
	Serge Hallyn <serue@...ibm.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>, mingo@...e.hu,
	eparis@...hat.com
Subject: Re: ima: use of radix tree cache indexing == massive waste of memory?

>>>>> "Mimi" == Mimi Zohar <zohar@...ux.vnet.ibm.com> writes:

Mimi> On Mon, 2010-10-18 at 02:25 -0400, Kyle McMartin wrote:
>> If someone gives me a good reason why Fedora actually needs this
>> enabled, I'm going to apply the following patch to our kernel so that
>> IMA is globally an opt-in feature... Otherwise I'm inclined to just
>> disable it.

Mimi> Am hoping others will chime in.

I'll chime in.  I run Debian Squeeze and Ubuntu 10.10 and neither of
them seem to have this monstrosity enabled at all, which is good.  It
should default to OFF and have a big fat warning saying it's a memory
pig.

>> (But the more I look at this, the more it looks like a completely niche
>> option that has little use outside of three-letter agencies.)
>> 
>> I regret not looking at this more closely when it was enabled,
>> (although, in my defence, when the option first showed up, I left it
>> off...)
>> 
>> It's probably way more heavyweight than necessary, as I think in most
>> cases the iint_initalized test will cover the call into IMA. But better
>> safe than sorry or something and there's a bunch of other cases where
>> -ENOMEM will leak back up from failing kmem_cache_alloc, iirc.
>> 
>> regards, Kyle

Mimi> Thanks, will compile/test patch.

>From what I'm reading, it's not even useful unless you have TPM
hardware?  

I dunno... I'm just hesitant to use this or SElinux because the
hassles are not worth the payoff.  

John
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/