Re: IMA: How to manage user space signing policy with others

[Mimi Zohar <zohar@linux.vnet.ibm.com>]

On Wed, 2013-03-06 at 18:38 -0500, Vivek Goyal wrote:
> On Wed, Mar 06, 2013 at 05:48:01PM -0500, Mimi Zohar wrote:
> > On Wed, 2013-03-06 at 10:54 -0500, Vivek Goyal wrote:

[...]
> > > - Because policy can be replaced easily, some of the functionality
> > >   will automatically be disabled. (because associated policy is not
> > >   there any more). And this can be very unintutive.
> > 
> > Limiting the additional functionality to a single policy, is wrong. A
> > new policy option (eg. memlock) or even action primitive (eg.
> > appraise_memlock) should be defined, allowing any policy to achieve the
> > same results.
> 
> Sorry I did not get this part. How does any policy achieve the same
> results.

This discussion has gone through many twists and turns - original direct
crypto calls to verify appended signature, 'optional' policy flag,
locking memory, fixing appraisal results, differentiating ima vs. evm
appraisal results, iint caching, merging policies vs. either/or policy, 
new policy memory lock option/action, separating policy from locking
memory, and now exporting integrity calls.

Once you resolve the 'special' processing (eg. memory locking issue)
being tied to the policy, either by removing the requirement or by
defining a new policy option/action primitive, you'll be able to resolve
your policy requirements, without merging rules or limiting
functionality for other policies.

Limiting functionality (eg. kexec) to a single builtin policy is
unacceptable.  The same mechanism, that the builtin kmem_lock policy
uses to make kexec permissible, should be available to all policies.  It
is then up to the system administrator to define an appropriate policy.

thanks,

Mimi