Re: [PATCH v6 0/8] IMA: support for measuring kernel integrity critical data

From: Mimi Zohar <zohar@linux.ibm.com>
To: Pavel Machek <pavel@ucw.cz>
Cc: Tushar Sugandhi <tusharsu@linux.microsoft.com>,
	stephen.smalley.work@gmail.com, casey@schaufler-ca.com,
	agk@redhat.com, snitzer@redhat.com, gmazyland@gmail.com,
	paul@paul-moore.com, tyhicks@linux.microsoft.com,
	sashal@kernel.org, jmorris@namei.org, nramas@linux.microsoft.com,
	linux-integrity@vger.kernel.org, selinux@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, dm-devel@redhat.com
Subject: Re: [PATCH v6 0/8] IMA: support for measuring kernel integrity critical data
Date: Mon, 23 Nov 2020 14:49:10 -0500	[thread overview]
Message-ID: <7990c489ed6fb3ae36978820400b7cf60c55c126.camel@linux.ibm.com> (raw)
In-Reply-To: <20201123171800.GA6407@duo.ucw.cz>

On Mon, 2020-11-23 at 18:18 +0100, Pavel Machek wrote:
> > > Basically every other data structure in kernel is "critical" by your
> > > definition, and you can't really measure them all; some of them change
> > > rather often. Going piecemeal does not really help here.
> > 
> > Agreed, measuring data structures that change is not really applicable.
> > However, measuring data structures that once initialized don't change,
> > does make sense (similar concept to __ro_after_init).  The attestation
> > server doesn't need to know anything about the measurement, other than
> > more than a single measurement is indicative of a problem.
> 
> So, why not simply measure everything that is ro_after_init?

I guess we could, but the original discussion, a long time ago prior to
LSM stacking, was limited to measuring the LSM hooks.

Mimi