Linux-Integrity Archive on lore.kernel.org
 help / color / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Janne Karhunen <janne.karhunen@gmail.com>
Cc: david.safford@gmail.com, linux-integrity@vger.kernel.org,
	linux-security-module <linux-security-module@vger.kernel.org>,
	Ken Goldman <kgold@linux.ibm.com>,
	"Wiseman, Monty (GE Global Research, US)" <monty.wiseman@ge.com>,
	Amir Goldstein <amir73il@gmail.com>,
	linux-fsdevel <linux-fsdevel@vger.kernel.org>
Subject: Re: [PATCH v2] ima: export the measurement list when needed
Date: Tue, 18 Feb 2020 10:36:55 -0500
Message-ID: <1582040215.5067.10.camel@linux.ibm.com> (raw)
In-Reply-To: <CAE=NcrYwBZVT+xTn384K3fit6UFUES62zsibL=7A5C8_nYaq8A@mail.gmail.com>

On Thu, 2020-02-13 at 08:41 +0200, Janne Karhunen wrote:
> On Thu, Feb 13, 2020 at 3:03 AM Mimi Zohar <zohar@linux.ibm.com> wrote:
> 
> > > This is a pretty important new feature.
> > > A lot of people can't use IMA because of the memory issue.
> > > Also, I really think we need to let administrators choose the tradeoffs
> > > of keeping the list in memory, on a local file, or only on the
> > > attestation server, as best fits their use cases.
> >
> > Dave, I understand that some use cases require the ability of
> > truncating the measurement list.  We're discussing how to truncate the
> > measurement list.  For example, in addition to the existing securityfs
> > binary_runtime_measurements file, we could define a new securityfs
> > file indicating the number of records to delete.
> 
> I don't have strong opinions either way, just let me know how to adapt
> the patch and we will get it done asap. I'd prefer a solution where
> the kernel can initiate the flush, but if not then not.

If the measurement list isn't stored in kernel memory, then we would
have the best of both worlds.  The measurement list staying intact for
attestation, with userspace's ability to truncate the measurement list
as desired.  Barring any implementation details, I see this as a win-
win solution.

Mimi


  reply index

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-08 11:17 Janne Karhunen
2020-01-10  8:48 ` Janne Karhunen
2020-01-22 15:56   ` Mimi Zohar
2020-01-23  8:41     ` Janne Karhunen
2020-01-26 17:01       ` Mimi Zohar
2020-01-27  9:03         ` Janne Karhunen
2020-02-06 14:13   ` Mimi Zohar
2020-02-10  8:04     ` Janne Karhunen
2020-02-10 15:26       ` Mimi Zohar
2020-02-10 18:18     ` david.safford
2020-02-10 20:24       ` Mimi Zohar
2020-02-11  8:06         ` Janne Karhunen
2020-02-11 16:10         ` david.safford
2020-02-11 23:10           ` Mimi Zohar
2020-02-12 21:08             ` david.safford
2020-02-13  1:03               ` Mimi Zohar
2020-02-13  6:41                 ` Janne Karhunen
2020-02-18 15:36                   ` Mimi Zohar [this message]
2020-02-13 20:11           ` Ken Goldman
2020-02-18 14:50             ` david.safford
2020-01-24 14:46 ` david.safford
2020-01-27  8:48   ` Janne Karhunen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1582040215.5067.10.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=amir73il@gmail.com \
    --cc=david.safford@gmail.com \
    --cc=janne.karhunen@gmail.com \
    --cc=kgold@linux.ibm.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=monty.wiseman@ge.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Integrity Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-integrity/0 linux-integrity/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-integrity linux-integrity/ https://lore.kernel.org/linux-integrity \
		linux-integrity@vger.kernel.org
	public-inbox-index linux-integrity

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-integrity


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git