Quoting Mimi Zohar (zohar@linux.vnet.ibm.com):

On Mon, 2017-11-20 at 10:40 +0100, Roberto Sassu wrote:

quoted

On 11/19/2017 12:23 AM, Mimi Zohar wrote:

quoted

Hi Serge,

On Fri, 2017-11-17 at 22:20 -0600, Serge E. Hallyn wrote:

quoted

On Tue, Nov 07, 2017 at 11:37:01AM +0100, Roberto Sassu wrote:

quoted

from a predefined position (/etc/ima/digest_lists/metadata), when rootfs
becomes available. Digest lists must be loaded before IMA appraisal is in
enforcing mode.

I'm sure there's a good reason for it, but this seems weird to me.
Why read it from a file on disk instead of accepting it through say
a securityfile write?

There are two reasons.

Digest lists must be loaded before any file is accessed, otherwise IMA
will deny the operation if appraisal is in enforcing mode. With digest
lists it is possible to appraise files in the initial ram disk without
including extended attributes (the default policy excludes those files).

There are a number of people interested in extending CPIO to support
extended attributes, not just for IMA-appraisal. (Years ago I started
but unfortunately haven't had time to finish it.)  Isn't the right
solution to add extended attribute support to CPIO?

(For the record) Yes, yes it is.