Re: [PATCH] ima: remove ACPI dependency

[Eric Paris]

On Tue, 2009-10-27 at 11:59 -0400, David Safford wrote:
> On Tue, 2009-10-27 at 09:58 -0400, Eric Paris wrote:
> > On Mon, Oct 26, 2009 at 9:26 AM, Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:
> > > Remove ACPI dependency on systems without a TPM enabled.
> > 
> > I'm confused why you need ACPI at all.  The TPM code doesn't require
> > ACPI (I wish it did but Alan Cox Nak'd that patch).  I don't see acpi
> > anywhere in the ima code.  What's the problem we are solving?  Why
> > does IMA care about ACPI at all?  And aren't you really just dropping
> > the build requirement on TCG_TPM?  Is that a great idea?
> > 
> > -Eric
> 
> This is discussed in the LSM thread:
> http://marc.info/?l=linux-security-module&m=125322062401677&w=2
> 
> Basically, if running on a system with a TPM, IMA wants the TPM
> boot measurement log, which the TPM driver can only get through
> ACPI. If the platform does not have a TPM, then IMA does not 
> need ACPI.

I'm afraid I'm not seeing the connection.  Where does IMA gets the boot
measurement log?  I see that the TPM exports that log in securityfs as 2
files (ascii and binary) in tpm_bios.c but I don't see how IMA ever
makes use of that log either internally to the kernel or through the
securityfs files.

If I'm missing it, and IMA is getting and making use of the bios boot
log I think we need to instead make the TPM code send a reasonable
failure code without ACPI and IMA should be changed to handle it.  I
really don't like the obscure ACPI requirement.

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/