Re: ima: use of radix tree cache indexing == massive waste of memory?

["J.H." <warthog9@kernel.org>]

On 10/16/2010 05:35 PM, Dave Chinner wrote:
> On Sat, Oct 16, 2010 at 02:10:29PM -0700, H. Peter Anvin wrote:
>> "Christoph Hellwig" <hch@infradead.org> wrote:
>>> Besides the algorithmic problems with ima, why is kernel.org using
>>> IMA to start with?  Except for IBM looking for a reason to jusity why
>>> TPM isn't a completely waster of ressources it's pointless.  And it was
>>> only merged under the premise that it would not affect innocent normal
>>> users.
>>
>> I'm confused ... what makes you think we are?  This might have
>> been an unintentional misconfiguration...
> 
> It's enabled in the kernel that is running:
> 
> $ grep CONFIG_IMA /boot/config-2.6.34.7-56.fc11.x86_64
> CONFIG_IMA=y
> CONFIG_IMA_MEASURE_PCR_IDX=10
> CONFIG_IMA_AUDIT=y
> CONFIG_IMA_LSM_RULES=y
> $
> 
> and it's using lots of memory, so if you're not actually using it I
> think it should be disabled.
> 
> If this is a stock fedora config, then they've got some work to
> do....

Considering the only change to the RPM I made for 2.6.34 (the kernel
currently running on master) was a one line change to get XFS to not
kill the box, it's standard.

Taking a quick glance at my laptop (F12) I'll note the following:

config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA=y
config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA_MEASURE_PCR_IDX=10
config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA_AUDIT=y
config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA_LSM_RULES=y

config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA=y
config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA_MEASURE_PCR_IDX=10
config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA_AUDIT=y
config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA_LSM_RULES=y

config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA=y
config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA_MEASURE_PCR_IDX=10
config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA_AUDIT=y
config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA_LSM_RULES=y

So I would happily punt this at Fedora as an issue upstream (Fedora) in
this case.  This seems to be a boolean value inside the kernel, it's
either enabled, or it's not.

There does seem to be a boot option to disable it, but it seems to be on
by default if it's compiled in, and it's not like it's obvious that this
is there and chewing up resources, is there a way to find out how much
memory this is chewing up?

I can understand the distributions wanting to turn this on, there is
likely user requests to be able to use this.  It's just annoying that
it's completely non-obvious that this change went in, it's on by default
and it's stealing memory, particularly when it's not being used for
anything.

Speaking to TPM, it's not quite an entire waste of resources - you can
use it as a random number generator source from hardware, so that's
useful - can't say much beyond that.

- John 'Warthog9' Hawley