linux-kernel - Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <C01F96FE-0E0F-46B1-A50C-42E83543B9E1@fb.com>
Date: Wed, 18 Dec 2024 17:07:01 +0000
From: Song Liu <songliubraving@...a.com>
To: Mimi Zohar <zohar@...ux.ibm.com>
CC: Casey Schaufler <casey@...aufler-ca.com>, Song Liu <song@...nel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>,
        "linux-security-module@...r.kernel.org"
	<linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>,
        "roberto.sassu@...wei.com"
	<roberto.sassu@...wei.com>,
        "dmitry.kasatkin@...il.com"
	<dmitry.kasatkin@...il.com>,
        "eric.snowberg@...cle.com"
	<eric.snowberg@...cle.com>,
        "paul@...l-moore.com" <paul@...l-moore.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com"
	<serge@...lyn.com>,
        Kernel Team <kernel-team@...a.com>,
        "brauner@...nel.org"
	<brauner@...nel.org>,
        "jack@...e.cz" <jack@...e.cz>,
        "viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>
Subject: Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

Hi Mimi, 

Thanks for your comments!

> On Dec 18, 2024, at 3:02 AM, Mimi Zohar <zohar@...ux.ibm.com> wrote:
> 
> On Tue, 2024-12-17 at 13:29 -0800, Casey Schaufler wrote:
>> On 12/17/2024 12:25 PM, Song Liu wrote:
>>> While reading and testing LSM code, I found IMA/EVM consume per inode
>>> storage even when they are not in use. Add options to diable them in
>>> kernel command line. The logic and syntax is mostly borrowed from an
>>> old serious [1].
>> 
>> Why not omit ima and evm from the lsm= parameter?
> 
> Casey, Paul, always enabling IMA & EVM as the last LSMs, if configured, were the
> conditions for making IMA and EVM LSMs.  Up to that point, only when an inode
> was in policy did it consume any memory (rbtree).  I'm pretty sure you remember
> the rather heated discussion(s).

I didn't know about this history until today. I apologize if this 
RFC/PATCH is moving to the direction against the original agreement. 
I didn't mean to break any agreement. 

My motivation is actually the per inode memory consumption of IMA 
and EVM. Once enabled, EVM appends a whole struct evm_iint_cache to 
each inode via i_security. IMA is better on memory consumption, as 
it only adds a pointer to i_security. 

It appears to me that a way to disable IMA and EVM at boot time can 
be useful, especially for distro kernels. But I guess there are 
reasons to not allow this (thus the earlier agreement). Could you 
please share your thoughts on this?

Thanks,
Song