Re: [RFC 0/2] ima: evm: Add kernel cmdline options to disable IMA/EVM

Paul Moore
2024-12-17T22:00:03Z

On Tue, Dec 17, 2024 at 4:29 PM Casey Schaufler <casey@schaufler-ca.com> wrote:
> On 12/17/2024 12:25 PM, Song Liu wrote:
> > While reading and testing LSM code, I found IMA/EVM consume per inode
> > storage even when they are not in use. Add options to diable them in
> > kernel command line. The logic and syntax is mostly borrowed from an
> > old serious [1].
>
> Why not omit ima and evm from the lsm= parameter?

Exactly. Here is a link to the kernel documentation if anyone is
interested (search for "lsm"):

https://docs.kernel.org/admin-guide/kernel-parameters.html

It is worth mentioning that this works for all the LSMs.

> > [1] https://lore.kernel.org/lkml/cover.1398259638.git.d.kasatkin@samsung.com/
> >
> > Song Liu (2):
> > ima: Add kernel parameter to disable IMA
> > evm: Add kernel parameter to disable EVM
> >
> > security/integrity/evm/evm.h | 6 ++++++
> > security/integrity/evm/evm_main.c | 22 ++++++++++++++--------
> > security/integrity/evm/evm_secfs.c | 3 ++-
> > security/integrity/ima/ima_main.c | 13 +++++++++++++
> > 4 files changed, 35 insertions(+), 9 deletions(-)
> >
> > --
> > 2.43.5

--
paul-moore.com