From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
James.Bottomley@HansenPartnership.com,
linux-integrity@vger.kernel.org
Cc: eric.snowberg@oracle.com, dhowells@redhat.com,
mathew.j.martineau@linux.intel.com, matthewgarrett@google.com,
sashal@kernel.org, jamorris@linux.microsoft.com,
linux-kernel@vger.kernel.org, keyrings@vger.kernel.org
Subject: Re: [PATCH] IMA: Defined timer to process queued keys
Date: Sat, 21 Dec 2019 23:40:36 +0000 [thread overview]
Message-ID: <1576971636.5241.95.camel@linux.ibm.com> (raw)
In-Reply-To: <20191221015256.2775-1-nramas@linux.microsoft.com>
On Fri, 2019-12-20 at 17:52 -0800, Lakshmi Ramasubramanian wrote:
> keys queued for measurement should still be processed even if
> a custom IMA policy was not loaded. Otherwise, the keys will
> remain queued forever consuming kernel memory.
>
> This patch defines a timer to handle the above scenario. The timer
> is setup to expire 5 minutes after IMA initialization is completed.
>
> If a custom IMA policy is loaded before the timer expires, the timer
> is removed and any queued keys are processed. But if a custom policy
> was not loaded, on timer expiration any queued keys are processed.
>
> On timer expiration the keys are still processed. This will enable
> keys to be measured in case the built-in IMA policy defines a key
> measurement rule.
If there was a built-in policy rule for measuring the early boot keys,
then there wouldn't be a need for queueing the "key" measurements.
 Just free the queued keys.
Mimi
WARNING: multiple messages have this Message-ID (diff)
From: Mimi Zohar <zohar@linux.ibm.com>
To: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
James.Bottomley@HansenPartnership.com,
linux-integrity@vger.kernel.org
Cc: eric.snowberg@oracle.com, dhowells@redhat.com,
mathew.j.martineau@linux.intel.com, matthewgarrett@google.com,
sashal@kernel.org, jamorris@linux.microsoft.com,
linux-kernel@vger.kernel.org, keyrings@vger.kernel.org
Subject: Re: [PATCH] IMA: Defined timer to process queued keys
Date: Sat, 21 Dec 2019 18:40:36 -0500 [thread overview]
Message-ID: <1576971636.5241.95.camel@linux.ibm.com> (raw)
In-Reply-To: <20191221015256.2775-1-nramas@linux.microsoft.com>
On Fri, 2019-12-20 at 17:52 -0800, Lakshmi Ramasubramanian wrote:
> keys queued for measurement should still be processed even if
> a custom IMA policy was not loaded. Otherwise, the keys will
> remain queued forever consuming kernel memory.
>
> This patch defines a timer to handle the above scenario. The timer
> is setup to expire 5 minutes after IMA initialization is completed.
>
> If a custom IMA policy is loaded before the timer expires, the timer
> is removed and any queued keys are processed. But if a custom policy
> was not loaded, on timer expiration any queued keys are processed.
>
> On timer expiration the keys are still processed. This will enable
> keys to be measured in case the built-in IMA policy defines a key
> measurement rule.
If there was a built-in policy rule for measuring the early boot keys,
then there wouldn't be a need for queueing the "key" measurements.
Just free the queued keys.
Mimi
next prev parent reply other threads:[~2019-12-21 23:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-21 1:52 [PATCH] IMA: Defined timer to process queued keys Lakshmi Ramasubramanian
2019-12-21 1:52 ` Lakshmi Ramasubramanian
2019-12-21 23:40 ` Mimi Zohar [this message]
2019-12-21 23:40 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1576971636.5241.95.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=dhowells@redhat.com \
--cc=eric.snowberg@oracle.com \
--cc=jamorris@linux.microsoft.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mathew.j.martineau@linux.intel.com \
--cc=matthewgarrett@google.com \
--cc=nramas@linux.microsoft.com \
--cc=sashal@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.