Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <cacde31235f08eeec698c63025a0eef81e10fe71.camel@linux.ibm.com>
Subject: Re: [PATCH 2/2] integrity: double check iint_cache was initialized
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Petr Vorel <pvorel@suse.cz>
Cc:     Casey Schaufler <casey@schaufler-ca.com>, dvyukov@google.com,
        ebiggers@kernel.org, jmorris@namei.org, keescook@chromium.org,
        linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org, serge@hallyn.com
Date:   Mon, 28 Feb 2022 11:48:33 -0500
In-Reply-To: <YhzRvhsOPxrKHzq9@pevik>
References: <20210322154207.6802-2-zohar@linux.ibm.com>
         <20220224142025.2587-1-pvorel@suse.cz>
         <418628ea-f524-05a1-8bfc-a688fa2d625d@schaufler-ca.com>
         <YhfDhYQYZTU0clAf@pevik>
         <9405bcfc-78bd-8e7f-41d4-b919221f73e4@schaufler-ca.com>
         <c4842493db13fd6f05eda54c1ef4c94e9d687850.camel@linux.ibm.com>
         <YhzRvhsOPxrKHzq9@pevik>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Mon, 2022-02-28 at 14:44 +0100, Petr Vorel wrote:
> Hi Mimi, all,
> 
> > Hi Petr, Casey,
> 
> > On Thu, 2022-02-24 at 10:51 -0800, Casey Schaufler wrote:
> > > On 2/24/2022 9:42 AM, Petr Vorel wrote:
> 
> > > It was always my expectation, which appears to have been poorly
> > > communicated, that "making integrity an LSM" meant using the LSM
> > > hook infrastructure. Just adding "integrity" to lsm= doesn't make
> > > it an LSM to my mind.
> 
> > Agreed.  The actual commit that introduced the change was 3d6e5f6dcf65
> > ("LSM: Convert security_initcall() into DEFINE_LSM()").
> I wonder whether we can improve things now.

I'm not sure it is possible to revert the change.  Perhaps the simplest
solution would be to move integrity off the security hook.  It just
needs to be initialized before EVM and IMA.

thanks,

Mimi