Re: [PATCH v2] ima: export the measurement list when needed

[david.safford@gmail.com]

On Thu, 2020-02-13 at 15:11 -0500, Ken Goldman wrote:
> On 2/11/2020 11:10 AM, david.safford@gmail.com wrote:
> > There is no reason to resend the same data for every attestation,
> > nor is there any reason to store already attested measurements anywhere
> > on the client. By versioning the log file names, userspace gets a
> > simple way to know what has and has not been attested, and for small
> > embedded devices we don't need to waste memory or filesystem space
> > on the data already attested.
> 
> Yes ... no.
> 
> There isn't any reason to resend measurements that a verifier has 
> already received.  In fact, the logic I coded also said "if PCR 10 
> didn't change, there's no need to even ask for the measurement log".
> 
> However, don't you have to save already attested measurements for
> the case where there are multiple verifiers?  A different verifier would 
> have to receive all measurements.

Certainly for the use case of multiple verifiers, the client would not 
delete the data until all verifiers had acknowledged receipt.

My main point was that there are at least some use cases in which the
client does not need to keep the measurement list, and IMA should 
support the option of exporting and deleting the list in these cases.

dave