Re: [PATCH 2/3] integrity: Linux Integrity Module(LIM)

Dave Hansen
2008-10-31T16:52:09Z

On Tue, 2008-10-14 at 09:28 -0400, Christoph Hellwig wrote:
> > --- a/include/linux/fs.h
> > +++ b/include/linux/fs.h
> > @@ -683,6 +683,9 @@ struct inode {
> > #ifdef CONFIG_SECURITY
> > void *i_security;
> > #endif
> > +#ifdef CONFIG_INTEGRITY
> > + void *i_integrity;
> > +#endif
>
> Sorry, but as said before bloating the inode for this is not an option.
> Please use something like the MRU approach I suggested in the last
> review round.

Why don't we just have a 'void *i_lots_of_bloat field', and let the
security folks stick whatever they want in it? They can trade their
i_security space for a new one. I know we want to conceptually separate
security from integrity, so let's separate it:

struct i_bloat_inodes {
#ifdef CONFIG_SECURITY
void *i_security;
#endif
#ifdef CONFIG_INTEGRITY
void *i_integrity;
#endif
};

By the way, if there's no TPM hardware, why would I want i_integrity
anyway?

-- Dave