On Mo, 03.01.22 13:07, Roberto Sassu (roberto.sassu@huawei.com) wrote:
That would work if all digest lists are supported by the kernel. The first version worked that way, I developed a simple parser of RPM headers, so that the kernel could process then without having an additional user space process. Much better in term of protection: no interference with other user space processes that should be handled with an ad-hoc LSM, no time to measure time to use race condition.
Why would you need to convert the digests on-the-fly? Can't you instead convert in an "offline" fashion, i.e. convert the RPM data into a kernel-understood digest list, and then wrap that in a cpio for use in an initrd? I mean, given the digests are only updated whenever RPM updates are done it sound like something perfectly doable in an "offline" fashion, i.e. convert at the moment of RPM update, and then just stick the covnerted format?
Lennart
-- Lennart Poettering, Berlin