linux-kernel - Re: ima: use of radix tree cache indexing == massive waste of memory?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101017003526.GA29677@dastard>
Date:	Sun, 17 Oct 2010 11:35:26 +1100
From:	Dave Chinner <david@...morbit.com>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	Christoph Hellwig <hch@...radead.org>,
	linux-kernel@...r.kernel.org, Mimi Zohar <zohar@...ibm.com>,
	warthog9@...nel.org, devel@...ts.fedoraprojet.org
Subject: Re: ima: use of radix tree cache indexing == massive waste of
 memory?

On Sat, Oct 16, 2010 at 02:10:29PM -0700, H. Peter Anvin wrote:
> "Christoph Hellwig" <hch@...radead.org> wrote:
> >Besides the algorithmic problems with ima, why is kernel.org using
> >IMA to start with?  Except for IBM looking for a reason to jusity why
> >TPM isn't a completely waster of ressources it's pointless.  And it was
> >only merged under the premise that it would not affect innocent normal
> >users.
>
> I'm confused ... what makes you think we are?  This might have
> been an unintentional misconfiguration...

It's enabled in the kernel that is running:

$ grep CONFIG_IMA /boot/config-2.6.34.7-56.fc11.x86_64
CONFIG_IMA=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_AUDIT=y
CONFIG_IMA_LSM_RULES=y
$

and it's using lots of memory, so if you're not actually using it I
think it should be disabled.

If this is a stock fedora config, then they've got some work to
do....

Cheers,

Dave.
-- 
Dave Chinner
david@...morbit.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/