Re: ima: use of radix tree cache indexing == massive waste of memory?

["John Stoffel" <john@stoffel.org>]

>>>>> "Mimi" == Mimi Zohar <zohar@linux.vnet.ibm.com> writes:

Mimi> On Mon, 2010-10-18 at 02:25 -0400, Kyle McMartin wrote:
>> If someone gives me a good reason why Fedora actually needs this
>> enabled, I'm going to apply the following patch to our kernel so that
>> IMA is globally an opt-in feature... Otherwise I'm inclined to just
>> disable it.

Mimi> Am hoping others will chime in.

I'll chime in.  I run Debian Squeeze and Ubuntu 10.10 and neither of
them seem to have this monstrosity enabled at all, which is good.  It
should default to OFF and have a big fat warning saying it's a memory
pig.

>> (But the more I look at this, the more it looks like a completely niche
>> option that has little use outside of three-letter agencies.)
>> 
>> I regret not looking at this more closely when it was enabled,
>> (although, in my defence, when the option first showed up, I left it
>> off...)
>> 
>> It's probably way more heavyweight than necessary, as I think in most
>> cases the iint_initalized test will cover the call into IMA. But better
>> safe than sorry or something and there's a bunch of other cases where
>> -ENOMEM will leak back up from failing kmem_cache_alloc, iirc.
>> 
>> regards, Kyle

Mimi> Thanks, will compile/test patch.

>From what I'm reading, it's not even useful unless you have TPM
hardware?  

I dunno... I'm just hesitant to use this or SElinux because the
hassles are not worth the payoff.  

John