Re: ima: use of radix tree cache indexing == massive waste of memory?

Dave Chinner
2010-10-17T00:35:58Z

On Sat, Oct 16, 2010 at 02:10:29PM -0700, H. Peter Anvin wrote:
> "Christoph Hellwig" <hch@infradead.org> wrote:
> >Besides the algorithmic problems with ima, why is kernel.org using
> >IMA to start with? Except for IBM looking for a reason to jusity why
> >TPM isn't a completely waster of ressources it's pointless. And it was
> >only merged under the premise that it would not affect innocent normal
> >users.
>
> I'm confused ... what makes you think we are? This might have
> been an unintentional misconfiguration...

It's enabled in the kernel that is running:

$ grep CONFIG_IMA /boot/config-2.6.34.7-56.fc11.x86_64
CONFIG_IMA=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_AUDIT=y
CONFIG_IMA_LSM_RULES=y
$

and it's using lots of memory, so if you're not actually using it I
think it should be disabled.

If this is a stock fedora config, then they've got some work to
do....

Cheers,

Dave.
--
Dave Chinner
david@fromorbit.com