Re: [PATCH 2/7] integrity: IMA as an integrity service provider

["Serge E. Hallyn" <serge@hallyn.com>]

Quoting Mimi Zohar (zohar@linux.vnet.ibm.com):
> IMA provides hardware (TPM) based measurement and attestation for
> file measurements. As the Trusted Computing (TPM) model requires,
> IMA measures all files before they are accessed in any way (on the
> integrity_bprm_check, integrity_path_check and integrity_file_mmap
> hooks), and commits the measurements to the TPM. Once added to the
> TPM, measurements can not be removed.
> 
> In addition, IMA maintains a list of these file measurements, which
> can be used to validate the aggregate value stored in the TPM.  The
> TPM can sign these measurements, and thus the system can prove, to
> itself and to a third party, the system's integrity in a way that
> cannot be circumvented by malicious or compromised software.
> 
> - alloc ima_template_entry before calling ima_store_template()
> - log ima_add_boot_aggregate() failure
> - removed unused IMA_TEMPLATE_NAME_LEN
> - replaced hard coded string length with #define name
> 
> Signed-off-by: Mimi Zohar <zohar@us.ibm.com>

Acked-by: Serge Hallyn <serue@us.ibm.com>