Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

Song Liu
2024-12-17T22:04:34Z

> On Dec 17, 2024, at 1:59 PM, Paul Moore <paul@paul-moore.com> wrote:
>
> On Tue, Dec 17, 2024 at 4:29 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
>> On 12/17/2024 12:25 PM, Song Liu wrote:
>>> While reading and testing LSM code, I found IMA/EVM consume per inode
>>> storage even when they are not in use. Add options to diable them in
>>> kernel command line. The logic and syntax is mostly borrowed from an
>>> old serious [1].
>>
>> Why not omit ima and evm from the lsm= parameter?
>
> Exactly. Here is a link to the kernel documentation if anyone is
> interested (search for "lsm"):
>
> https://docs.kernel.org/admin-guide/kernel-parameters.html
>
> It is worth mentioning that this works for all the LSMs.

I guess this is a bug that ima and evm do cannot be disabled
by (not being add to) lsm= parameter?

Thanks,
Song

>
>>> [1] https://lore.kernel.org/lkml/cover.1398259638.git.d.kasatkin@samsung.com/
>>>
>>> Song Liu (2):
>>> ima: Add kernel parameter to disable IMA
>>> evm: Add kernel parameter to disable EVM
>>>
>>> security/integrity/evm/evm.h | 6 ++++++
>>> security/integrity/evm/evm_main.c | 22 ++++++++++++++--------
>>> security/integrity/evm/evm_secfs.c | 3 ++-
>>> security/integrity/ima/ima_main.c | 13 +++++++++++++
>>> 4 files changed, 35 insertions(+), 9 deletions(-)
>>>
>>> --
>>> 2.43.5
>
> --
> paul-moore.com