Re: [PATCH 2/6] integrity: Linux Integrity Module(LIM)

From: Christoph Hellwig
Date: Thu Dec 04 2008 - 08:10:00 EST

On Wed, Dec 03, 2008 at 05:17:35PM -0500, Mimi Zohar wrote:
> > I have a bit of a problem parsing the above, and it certainly doesn't
> > look like a justification for keeping all that unused code around.
> The purpose of LIM is to provide an integrity infrastructure to support
> different types of integrity data. IMA implements both the LIM
> API for it's own internal use, and exports it for others to call.
> As Dave Safford pointed out in,
> there are other projects that want to add differently structured
> measurements to the TPM measurement list. The template abstraction is
> critical to allowing these differently formatted messages to be added to
> the list.

I think we're talking past each other.

In integrity.h there are two operation vectors defines:

- struct integrity_operations delcares the operations called from the
VFS. This one is actually used. While I don't agree to Dave's
argument, because we don't put bloat in just because people might
eventually some day use it when they are in the right mood and the
sun shines, thisn't isn't the one I'm talking about in this thread.
- struct template_operations on the others is not only really badly
named for appearing in a global header but also not used in a
meaningfull way. There is one single instace of it,
ima_template_ops, and while there are five helpers added in the
second patch that use it (integrity_collect_measurement,
integrity_appraise_measurement, integrity_store_measurement,
integrity_store_template, integrity_must_measure) none of them
is used at all during the patch series. There are two direct
uses of these template added in the third path, to implement the
show operations for the "binary_runtime_measurements" and
"ascii_runtime_measurements" files ins securityfs, but given that
those are inside ima there no reason for the indirection at all.

> Mimi
---end quoted text---
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at