Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] IMA: Turn IMA_MEASURE_ASYMMETRIC_KEYS off by default
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
        James Bottomley <James.Bottomley@HansenPartnership.com>,
        linux-integrity@vger.kernel.org
Cc:     sashal@kernel.org, linux-kernel@vger.kernel.org
Date:   Wed, 22 Jan 2020 15:02:59 -0500
In-Reply-To: <ac6c559e-2d68-afcb-d316-6ac49a570831@linux.microsoft.com>
References: <20200121171302.4935-1-nramas@linux.microsoft.com>
         <1579628090.3390.28.camel@HansenPartnership.com>
         <1579634035.5125.311.camel@linux.ibm.com>
         <1579636351.3390.35.camel@HansenPartnership.com>
         <ac6c559e-2d68-afcb-d316-6ac49a570831@linux.microsoft.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1579723379.5182.130.camel@linux.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, 2020-01-21 at 12:38 -0800, Lakshmi Ramasubramanian wrote:
> On 1/21/2020 11:52 AM, James Bottomley wrote:
> 
> >> - really small devices/sensors being able to queue certificates
> > 
> > seems like the answer to this one would be don't queue.  I realise it's
> > after the submit design, but what about measuring when the key is added
> > if there's a policy otherwise measure the keyring when the policy is
> > added ... that way no queueing.
> 
> Without the "deferred key processing" changes, only keys added at 
> runtime were measured (if policy permitted).
> 
> "deferred key processing" enabled queuing keys added early in the boot 
> process and measured them when the policy is loaded.
> 
> We can make this (the queuing) optional through a config, but leave the 
> runtime key measurement auto-enabled (as is the config 
> IMA_MEASURE_ASYMMETRIC_KEYS now).

Thanks, Lakshmi.  This requires moving the code around.  Instead of
doing this on the current code base, I suggest posting a v9 version of
the entire "IMA: Deferred measurement of keys".

I suggest making the switch from spinlock to mutex, as you had it
originally, before posting v9.  The commit history will then be a lot
cleaner.

thanks,

Mimi