Re: [PATCH v5 00/13] ima: Introduce staging mechanism

[Mimi Zohar <zohar@linux.ibm.com>]

On Mon, 2026-05-11 at 10:29 -0700, Lakshmi Ramasubramanian wrote:
> Roberto, Mimi:
> 
> I want to add on to the point Steven has brought up.
> 
> With "Stage and Delete N" approach, we have the following sequence of 
> tasks for trimming the IMA log:
> 
> 	1. User mode locks the IMA measurement list through the "write interface".
> 		a. While this prevents any other user mode process from updating the 
> IMA log, kernel can still add new IMA events to the measurement log
> 	2. User mode reads the TPM Quote and the IMA measurement events and 
> sends it to the remote attestation service
> 	3. Once the remote service has successfully processed the IMA events, 
> the user mode determines the number of IMA events "N" to be removed from 
> the measurement list maintained in the kernel
> 	4. User mode provides the value "N" to the kernel
> 	5. Kernel now determines the point at which to snap the IMA measurement 
> list using "N" - without holding a lock
> 	6. Then, the kernel lock is held and the list is snapped at the point 
> determined in the previous step thus keeping the kernel lock time to the 
> minimum.
> 	7. Now, user mode removes the "write" lock on the IMA measurement list
> 
> With the above, we believe "Stage and Delete N" alone is sufficient to 
> trim IMA log.

Prior versions of removing measurement records (aka "trimming") were rejected
for being overly complicated, locking, requiring a new record type, and code
quality.  Patch 11 ("stage and delete N") is much better, but the level of
precision in removing only those measurements records needed for the TPM quote
seems necessary only if the records are not being saved.

The reason for the two methods might be the same — removing measurement records
from the IMA measurement list — but the motivation for the two methods does not
appear to be the same. The motivation for Patch 9 ("stage and delete") is
clearly to free kernel memory by exporting and saving the measurement records.

Remember, the only reason for upstreaming a feature to remove measurement
records from the IMA measurement list is to address the kernel memory issue —
clearly not to drop measurement records and break attestation.

Upstreaming patch 11 (stage and delete N) would be a concession for your
environment, but is definitely not the recommended solution.

Mimi