linux-kernel - Re: ima: use of radix tree cache indexing == massive waste of memory?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101017193908.GA20157@elf.ucw.cz>
Date:	Sun, 17 Oct 2010 21:39:09 +0200
From:	Pavel Machek <pavel@....cz>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	Christoph Hellwig <hch@...radead.org>,
	Dave Chinner <david@...morbit.com>,
	linux-kernel@...r.kernel.org, Mimi Zohar <zohar@...ibm.com>,
	warthog9@...nel.org, hpa@...or.com, devel@...ts.fedoraprojet.org
Subject: Re: ima: use of radix tree cache indexing == massive waste of
 memory?

On Sun 2010-10-17 01:57:57, Mimi Zohar wrote:
> On Sat, 2010-10-16 at 15:20 -0400, Christoph Hellwig wrote:
> > Besides the algorithmic problems with ima, why is kernel.org using
> > IMA to start with?  Except for IBM looking for a reason to jusity why
> > TPM isn't a completely waster of ressources it's pointless.  And it was
> > only merged under the premise that it would not affect innocent normal
> > users.
> > 
> 
> Can we keep this at the design level please? When IMA is enabled, it
> needs to store information on a per inode basis, yet has to wait to
> late_initcall() for the TPM, at which point some inodes would have
> already been created.  For this reason, there is a two step

Move TPM earlier in the boot process...?

And... having huge structure for storing just number of writers (as
Eric explained) seems just wrong. Surely, you can do something like
lsof; which will be slow but only done when actually enabling IMA?


								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/