On Mon, 2022-02-28 at 14:44 +0100, Petr Vorel wrote:

Hi Mimi, all,

quoted

Hi Petr, Casey,

quoted

On Thu, 2022-02-24 at 10:51 -0800, Casey Schaufler wrote:

quoted

On 2/24/2022 9:42 AM, Petr Vorel wrote:

quoted

quoted

It was always my expectation, which appears to have been poorly
communicated, that "making integrity an LSM" meant using the LSM
hook infrastructure. Just adding "integrity" to lsm= doesn't make
it an LSM to my mind.

quoted

Agreed.  The actual commit that introduced the change was 3d6e5f6dcf65
("LSM: Convert security_initcall() into DEFINE_LSM()").

I wonder whether we can improve things now.

I'm not sure it is possible to revert the change.  Perhaps the simplest
solution would be to move integrity off the security hook.  It just
needs to be initialized before EVM and IMA.

thanks,

Mimi