From: Jarkko Sakkinen <jarkko@kernel.org>
To: Mimi Zohar <zohar@linux.ibm.com>,
Roberto Sassu <roberto.sassu@huaweicloud.com>,
linux-integrity@vger.kernel.org
Cc: James.Bottomley@HansenPartnership.com, roberto.sassu@huawei.com,
mapengyu@gmail.com, David Howells <dhowells@redhat.com>,
Paul Moore <paul@paul-moore.com>,
James Morris <jmorris@namei.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Peter Huewe <peterhuewe@gmx.de>, Jason Gunthorpe <jgg@ziepe.ca>,
keyrings@vger.kernel.org, linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v5 0/5] Lazy flush for the auth session
Date: Mon, 14 Oct 2024 15:34:02 +0300 [thread overview]
Message-ID: <64710fe1db1432ca8857ec83fff4809ab1550137.camel@kernel.org> (raw)
In-Reply-To: <04dc04872f2925166f969b43852161d468ee899a.camel@linux.ibm.com>
On Mon, 2024-10-14 at 07:45 -0400, Mimi Zohar wrote:
> > > For server/IMA use case I'll add a boot parameter it can be
> > > either on or off by default, I will state that in the commit
> > > message and we'll go from there.
>
> Sounds good.
But only after this patch set lands. I gave this a thought and since
this patch set is specifically for a specific Bugzilla bug that it
closes, I have no interest to increase its scope.
>
> >
> > Up until legit fixes are place distributors can easily disable
> > the feature. It would be worse if TCG_TPM2_HMAC did not exist.
> >
> > So I think it is better to focus on doing right things right,
> > since the feature itself is useful objectively, and make sure
> > that those fixes bring the wanted results.
>
> Are you backtracking on having a boot parameter here specifically to
> turn on/off
> HMAC encryption for IMA?
I'm not really sure yet but obviously any change goes through review.
Also fastest route is to send your own RFC's to IMA specific issue.
For me it will take some time (post this patch set).
>
> Mimi
>
>
BR, Jarkko
BR, Jarkko
next prev parent reply other threads:[~2024-10-14 12:34 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-21 12:08 [PATCH v5 0/5] Lazy flush for the auth session Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 1/5] tpm: Return on tpm2_create_null_primary() failure Jarkko Sakkinen
2024-10-03 14:57 ` Stefan Berger
2024-10-07 23:47 ` Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 2/5] tpm: Implement tpm2_load_null() rollback Jarkko Sakkinen
2024-10-03 15:27 ` Stefan Berger
2024-09-21 12:08 ` [PATCH v5 3/5] tpm: flush the null key only when /dev/tpm0 is accessed Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 4/5] tpm: Allocate chip->auth in tpm2_start_auth_session() Jarkko Sakkinen
2024-09-24 13:33 ` James Bottomley
2024-09-24 16:13 ` Jarkko Sakkinen
2024-09-24 18:13 ` Jarkko Sakkinen
2024-09-21 12:08 ` [PATCH v5 5/5] tpm: flush the auth session only when /dev/tpm0 is open Jarkko Sakkinen
2024-09-24 13:43 ` James Bottomley
2024-09-24 16:13 ` Jarkko Sakkinen
2024-09-24 18:07 ` Jarkko Sakkinen
2024-09-24 18:40 ` James Bottomley
2024-09-24 21:35 ` Jarkko Sakkinen
2024-09-24 21:51 ` James Bottomley
2024-09-25 7:42 ` Jarkko Sakkinen
2024-09-25 7:46 ` Jarkko Sakkinen
2024-09-25 7:53 ` Jarkko Sakkinen
2024-09-21 12:36 ` [PATCH v5 0/5] Lazy flush for the auth session Paul Menzel
2024-09-21 13:13 ` Jarkko Sakkinen
2024-09-21 14:38 ` Jarkko Sakkinen
2024-09-22 17:51 ` Jarkko Sakkinen
2024-09-24 13:48 ` James Bottomley
2024-09-24 16:29 ` Jarkko Sakkinen
2024-09-24 16:33 ` James Bottomley
2024-09-24 16:36 ` Jarkko Sakkinen
2024-09-24 17:26 ` Jarkko Sakkinen
2024-09-24 17:28 ` Jarkko Sakkinen
2024-09-24 18:01 ` Jarkko Sakkinen
2024-10-01 18:10 ` Mimi Zohar
2024-10-07 23:45 ` Jarkko Sakkinen
2024-10-03 15:14 ` Stefan Berger
2024-10-07 23:49 ` Jarkko Sakkinen
2024-10-11 14:06 ` Jarkko Sakkinen
2024-10-11 16:10 ` Roberto Sassu
2024-10-11 16:25 ` Jarkko Sakkinen
2024-10-12 10:56 ` Jarkko Sakkinen
2024-10-14 11:45 ` Mimi Zohar
2024-10-14 12:34 ` Jarkko Sakkinen [this message]
2024-10-15 20:08 ` Mimi Zohar
2024-10-15 22:14 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=64710fe1db1432ca8857ec83fff4809ab1550137.camel@kernel.org \
--to=jarkko@kernel.org \
--cc=James.Bottomley@HansenPartnership.com \
--cc=dhowells@redhat.com \
--cc=jgg@ziepe.ca \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mapengyu@gmail.com \
--cc=paul@paul-moore.com \
--cc=peterhuewe@gmx.de \
--cc=roberto.sassu@huawei.com \
--cc=roberto.sassu@huaweicloud.com \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).