Re: F36 Change: DIGLIM (System-Wide Change proposal)
On Mo, 03.01.22 13:07, Roberto Sassu (roberto.sassu(a)huawei.com) wrote:
That would work if all digest lists are supported by the kernel.
The first version worked that way, I developed a simple parser
of RPM headers, so that the kernel could process then without
having an additional user space process. Much better in term
of protection: no interference with other user space processes
that should be handled with an ad-hoc LSM, no time to measure
time to use race condition.
Why would you need to convert the digests on-the-fly? Can't you
instead convert in an "offline" fashion, i.e. convert the RPM data
into a kernel-understood digest list, and then wrap that in a cpio for
use in an initrd? I mean, given the digests are only updated whenever
RPM updates are done it sound like something perfectly doable in an
"offline" fashion, i.e. convert at the moment of RPM update, and then
just stick the covnerted format?
Lennart
--
Lennart Poettering, Berlin