On Thu, 2024-06-20 at 11:12 +0200, Roberto Sassu wrote:

On Wed, 2024-06-19 at 14:43 -0400, Paul Moore wrote:

quoted

On Wed, Jun 19, 2024 at 12:38 PM Roberto Sassu
[off-list ref] wrote:

quoted

Making it a kernel subsystem would likely mean replicating what the LSM
infrastructure is doing, inode (security) blob and being notified about
file/directory changes.

Just because the LSM framework can be used for something, perhaps it
even makes the implementation easier, it doesn't mean the framework
should be used for everything.

It is supporting 3 LSMs: IMA, IPE and BPF LSM.

That makes it a clear target for the security subsystem, and as you
suggested to start for IMA, if other kernel subsystems require them, we

If other kernel subsystems require the same functionality,

Roberto

can make it as an independent subsystem.

Starting from IMA means that we are mixing two different things in the
inode security blob, and I'm not sure that it is more straightforward
than making the digest_cache LSM require the space it needs and be
notified about security events.

Thanks

Roberto