ima: use of radix tree cache indexing == massive waste of memory?
John Stoffel
john at stoffel.org
Mon Oct 18 19:24:10 UTC 2010
>>>>> "Mimi" == Mimi Zohar <zohar at linux.vnet.ibm.com> writes:
Mimi> On Mon, 2010-10-18 at 02:25 -0400, Kyle McMartin wrote:
>> If someone gives me a good reason why Fedora actually needs this
>> enabled, I'm going to apply the following patch to our kernel so that
>> IMA is globally an opt-in feature... Otherwise I'm inclined to just
>> disable it.
Mimi> Am hoping others will chime in.
I'll chime in. I run Debian Squeeze and Ubuntu 10.10 and neither of
them seem to have this monstrosity enabled at all, which is good. It
should default to OFF and have a big fat warning saying it's a memory
pig.
>> (But the more I look at this, the more it looks like a completely niche
>> option that has little use outside of three-letter agencies.)
>>
>> I regret not looking at this more closely when it was enabled,
>> (although, in my defence, when the option first showed up, I left it
>> off...)
>>
>> It's probably way more heavyweight than necessary, as I think in most
>> cases the iint_initalized test will cover the call into IMA. But better
>> safe than sorry or something and there's a bunch of other cases where
>> -ENOMEM will leak back up from failing kmem_cache_alloc, iirc.
>>
>> regards, Kyle
Mimi> Thanks, will compile/test patch.
>From what I'm reading, it's not even useful unless you have TPM
hardware?
I dunno... I'm just hesitant to use this or SElinux because the
hassles are not worth the payoff.
John
More information about the kernel
mailing list