linux-kernel - Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8FCA52F6-F9AB-473F-AC9E-73D2F74AA02E@fb.com>
Date: Tue, 17 Dec 2024 22:04:12 +0000
From: Song Liu <songliubraving@...a.com>
To: Paul Moore <paul@...l-moore.com>
CC: Casey Schaufler <casey@...aufler-ca.com>, Song Liu <song@...nel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org"
	<linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "roberto.sassu@...wei.com"
	<roberto.sassu@...wei.com>,
        "dmitry.kasatkin@...il.com"
	<dmitry.kasatkin@...il.com>,
        "eric.snowberg@...cle.com"
	<eric.snowberg@...cle.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com" <serge@...lyn.com>,
        Kernel Team <kernel-team@...a.com>,
        "brauner@...nel.org" <brauner@...nel.org>,
        "jack@...e.cz" <jack@...e.cz>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM



> On Dec 17, 2024, at 1:59 PM, Paul Moore <paul@...l-moore.com> wrote:
> 
> On Tue, Dec 17, 2024 at 4:29 PM Casey Schaufler <casey@...aufler-ca.com> wrote:
>> On 12/17/2024 12:25 PM, Song Liu wrote:
>>> While reading and testing LSM code, I found IMA/EVM consume per inode
>>> storage even when they are not in use. Add options to diable them in
>>> kernel command line. The logic and syntax is mostly borrowed from an
>>> old serious [1].
>> 
>> Why not omit ima and evm from the lsm= parameter?
> 
> Exactly.  Here is a link to the kernel documentation if anyone is
> interested (search for "lsm"):
> 
> https://docs.kernel.org/admin-guide/kernel-parameters.html
> 
> It is worth mentioning that this works for all the LSMs.

I guess this is a bug that ima and evm do cannot be disabled
by (not being add to) lsm= parameter?

Thanks,
Song


> 
>>> [1] https://lore.kernel.org/lkml/cover.1398259638.git.d.kasatkin@samsung.com/
>>> 
>>> Song Liu (2):
>>>  ima: Add kernel parameter to disable IMA
>>>  evm: Add kernel parameter to disable EVM
>>> 
>>> security/integrity/evm/evm.h       |  6 ++++++
>>> security/integrity/evm/evm_main.c  | 22 ++++++++++++++--------
>>> security/integrity/evm/evm_secfs.c |  3 ++-
>>> security/integrity/ima/ima_main.c  | 13 +++++++++++++
>>> 4 files changed, 35 insertions(+), 9 deletions(-)
>>> 
>>> --
>>> 2.43.5
> 
> -- 
> paul-moore.com