Re: ima: use of radix tree cache indexing == massive waste of memory?

[Christoph Hellwig <hch@infradead.org>]

> It can be turned on any time inside the initrd without loss of integrity
> assuming the kernel and initrd were both measured and stored in a TPM
> PCR.  I'm willing to agree that the usefulness might be limited, but it
> isn't non-existant.  I'm going to make a note to look at other ways to
> cut down the memory usage.

It's not just memory overhead - it also adds another global reasource
and global lock for every inode allocation/freeing.  That's okay if
people actually want to use IMA - but if you do it everywhere it's
a real PITA.

If there's seriously no way to fix it up to not cause harm by default
just extending the inode is the much better way to go.  But given
that it's already in distros with a kABI I suspect some people will
be interested in fixing it for people instead of forcing this overhead
on their customers for years.  We might want to just piggyback on that.