Re: [PATHC v2 0/9] ima: carry the measurement list across kexec

Thiago Jung Bauermann [off-list ref] writes:

Hello Eric,

Am Dienstag, 20 September 2016, 11:07:29 schrieb Eric W. Biederman:

quoted

A semi-generic concept called a hand-over buffer seems to be a
construction of infrustructure for no actual reason that will just
result in confusion.  There are lots of things that are handed over, the
flattend device tree, ramdisks, bootparams on x86, etc, etc.  ima is not
special in this execpt for being perhaps the first addition that we are
going to want the option of including on most architectures.

Ok, I understand. I decided to implement a generic concept because I thought 
that proposing a feature that is more useful than what I need it for would  
increase its chance of being accepted. It's interesting to see that it had 
the opposite effect.

Yes.  In this case it was not clear that anyone else could use it, and
being less generic you can tweak the needs of the code to ima without
anyone having to worry about it.

So thank you very much for making the code more specific to the circumstances.

I reworked and simplified the code and folded the hand-over buffer patches 
into Mimi's patch series to carry the measurement list across kexec. The 
kexec buffer code is in the following patches now:

[PATCH v5 01/10] powerpc: ima: Get the kexec buffer passed by the previous 
kernel
[PATCH v5 05/10] powerpc: ima: Send the kexec buffer to the next
kernel

That plus  [PATCH v5 06/10] ima: on soft reboot, save the measurement list

Each patch has a changelog listing what I changed to make it specific to 
IMA.

I am a little sad to see you needed to modify kexec_file.c to get where
you were going, but that isn't a huge issue either way.

Eric

Am Donnerstag, 29 September 2016, 16:43:08 schrieb Eric W. Biederman:

Thiago Jung Bauermann [off-list ref] writes:

quoted

Hello Eric,

Am Dienstag, 20 September 2016, 11:07:29 schrieb Eric W. Biederman:

quoted

A semi-generic concept called a hand-over buffer seems to be a
construction of infrustructure for no actual reason that will just
result in confusion.  There are lots of things that are handed over,
the
flattend device tree, ramdisks, bootparams on x86, etc, etc.  ima is
not
special in this execpt for being perhaps the first addition that we are
going to want the option of including on most architectures.

Ok, I understand. I decided to implement a generic concept because I
thought that proposing a feature that is more useful than what I need
it for would increase its chance of being accepted. It's interesting to
see that it had the opposite effect.

Yes.  In this case it was not clear that anyone else could use it, and
being less generic you can tweak the needs of the code to ima without
anyone having to worry about it.

So thank you very much for making the code more specific to the
circumstances.

Thank you very much for your feedback and your reviews!

-- 
[]'s
Thiago Jung Bauermann
IBM Linux Technology Center