Re: [PATCH 0/1] KEYS: Measure keys in trusted keyring

[Mimi Zohar <zohar@linux.ibm.com>]

On Fri, 2019-10-04 at 17:10 -0700, Lakshmi Ramasubramanian wrote:
> On 10/4/19 2:58 PM, Mimi Zohar wrote:
> 
> > The measurements could be added to an IMA pending measurement
> > workqueue, until the TPM is enabled, assuming there is a TPM, and then
> > processed.  All of this code would be within IMA.
> 
> Good point. I will look into this.
> 
> >> I prefer gathering data on trusted keys in ima_init, but gate it by IMA
> >> policy and follow the other coding guidelines you have suggested earlier
> >> (similar to the approach taken for kexec_cmdline measurement).
> > 
> > So your intention is only to measure the initial keys added to these
> > keyrings, not anything subsequently added to the secondary keyring?
> 
> I am currently measuring only the initial keys. But I think including 
> the ones added subsequently is a good idea.
> 
> > Defining an LSM/IMA hook to measure keys, based on policy, seems
> > cleaner and more useful.
> 
> I agree.

As defining an early IMA workqueue and measuring keys are independent
of each other, they should be posted, reviewed, and upstreamed as
separate patch sets.

Mimi