Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

Song Liu
2024-12-18T06:41:59Z

> On Dec 17, 2024, at 3:33 PM, Song Liu <songliubraving@meta.com> wrote:

[...]

>
>>> +
>>> found = true;
>>> }
>>> }
>>> @@ -386,7 +389,7 @@ static void __init ordered_lsm_parse(const char *order, const char *origin)
>>>
>>> /* LSM_ORDER_LAST is always last. */
>>> for (lsm = __start_lsm_info; lsm < __end_lsm_info; lsm++) {
>>> - if (lsm->order == LSM_ORDER_LAST)
>>> + if (lsm->order == LSM_ORDER_LAST && is_enabled(lsm))
>>> append_ordered_lsm(lsm, " last");
>
> Before this change, lsm with order==LSM_ORDER_LAST is always considered
> enabled, which is a bug (if I understand you and Casey correctly).

According to commit 42994ee3cd7298b27698daa6848ed7168e72d056, LSMs with
order LSM_ORDER_LAST is expected to be always enabled:

"Similarly to LSM_ORDER_FIRST, LSMs with LSM_ORDER_LAST are always enabled
and put at the end of the LSM list, if selected in the kernel
configuration. "

Roberto, it feels weird to have two "last and always on" LSMs (ima and evm)
I guess this is not the expected behavior? At least, it appears to be a
surprise for Paul and Casey.

I will send patch that allow enable/disable ima and evm with lsm= cmdline.
We can further discuss the topic with the patch.

Thanks,
Song