[Linux-ima-devel] [RFC PATCH 2/4] ima: define new ima_sb_post_new_mount hook

On Wed, 16 Aug 2017, Mimi Zohar wrote:

In this context, I'm not sure what you mean by "loaded".? IMA needs to
be enabled from the very beginning to capture all measurements and
verify the integrity of files, without any gaps. ?At some point this
would include other LSM policies.

I think it's better to keep IMA orthogonal to LSM for this reason.

The original motivation to implement IMA as a separate API was because LSM 
was at the time considered specific to access control mechanisms, although 
that is not the case now.

-- 
James Morris
[off-list ref]