Re: [PATCH] ima: remove ACPI dependency

[David Safford <safford@watson.ibm.com>]

On Tue, 2009-10-27 at 12:36 -0400, Eric Paris wrote:
> On Tue, 2009-10-27 at 11:59 -0400, David Safford wrote:
> > Basically, if running on a system with a TPM, IMA wants the TPM
> > boot measurement log, which the TPM driver can only get through
> > ACPI. If the platform does not have a TPM, then IMA does not 
> > need ACPI.
> 
> I'm afraid I'm not seeing the connection.  Where does IMA gets the boot
> measurement log?  I see that the TPM exports that log in securityfs as 2
> files (ascii and binary) in tpm_bios.c but I don't see how IMA ever
> makes use of that log either internally to the kernel or through the
> securityfs files.
> 
sorry - bad explanation. IMA reads PCR 0-7, and combines them into
a single "boot_aggregate" as the first entry in the IMA list. For full
attestation, a user level program needs access to both IMA's
boot aggregate, and to the detailed TPM event log upon which
the aggregate is based. So IMA does not itself access the logs,
but the boot aggregate is less useful without them.

As a separate issue, IMA requires the TPM driver to be compiled in
(not loaded as a module) so it is available at IMA initialization, and
the driver apparently requires ACPI in this case. I believe Rajiv
will comment more on this.

dave

> If I'm missing it, and IMA is getting and making use of the bios boot
> log I think we need to instead make the TPM code send a reasonable
> failure code without ACPI and IMA should be changed to handle it.  I
> really don't like the obscure ACPI requirement.

> -Eric