lkml.org 
[lkml]   [2009]   [Aug]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] allow disabling IMA at runtime
From
Date
On Wed, 2009-08-26 at 08:07 -0400, Mimi Zohar wrote:
> Kyle McMartin <kyle@infradead.org> wrote on 08/25/2009 10:10:05 PM:
>
> > From: Kyle McMartin <kyle@redhat.com>
> >
> > Due to a memory leak in IMA that we're currently debugging in Fedora
> > rawhide, it would be nice to be able to disable that support at runtime.
> > Currently it's only able to be built in, and there's no toggle to avoid
> > initializing it.
> >
> > Provide one, in order to enhance debuggability. If a user can reboot a
> > machine and edit its command line, one can do a far sight worse things
> > than disabling a security precaution.
> >
> > Signed-off-by: Kyle McMartin <kyle@redhat.com>
>
> Have you tried using Eric's patch
> "IMA: Minimal IMA policy and boot param for TCB IMA policy"
> (commit 5789ba3bd0a3cd20df5980ebf03358f2eb44fd67), which introduced
> the ima_tcb=1 command line option? It wasn't backported to 2.6.30.

Hey Mimi, I was going to get in touch with you today, I don't really
think this patch is necessary. Kyle hacked it together because it was a
quick and dirty 'fix' for a memory leak that he didn't want to hunt down
and he knows I won't let him compile IMA out *smile*. Intended to try
to track it down this morning, but I'm getting swamped already, maybe
you can try to figure out what's going on before I get a chance to come
back to it this afternoon?

nfs_inode_cache 34 34 1824 17 8 : tunables 0 0 0 : slabdata 2 2 0
fuse_inode 22 22 1472 22 8 : tunables 0 0 0 : slabdata 1 1 0
rpc_inode_cache 40 40 1600 20 8 : tunables 0 0 0 : slabdata 2 2 0
btrfs_inode_cache 10622 10668 2328 14 8 : tunables 0 0 0 : slabdata 762 762 0
iint_cache 369714 369720 312 26 2 : tunables 0 0 0 : slabdata 14220 14220 0
mqueue_inode_cache 19 19 1664 19 8 : tunables 0 0 0 : slabdata 1 1 0
isofs_inode_cache 0 0 1288 25 8 : tunables 0 0 0 : slabdata 0 0 0
hugetlbfs_inode_cache 24 24 1312 24 8 : tunables 0 0 0 : slabdata 1 1 0
ext4_inode_cache 0 0 1864 17 8 : tunables 0 0 0 : slabdata 0 0 0
ext3_inode_cache 19 19 1656 19 8 : tunables 0 0 0 : slabdata 1 1 0
inotify_inode_mark_entry 253 255 240 17 1 : tunables 0 0 0 : slabdata 15 15 0
shmem_inode_cache 2740 3003 1560 21 8 : tunables 0 0 0 : slabdata 143 143 0
sock_inode_cache 902 920 1408 23 8 : tunables 0 0 0 : slabdata 40 40 0
proc_inode_cache 3060 3075 1288 25 8 : tunables 0 0 0 : slabdata 123 123 0
inode_cache 9943 10192 1240 26 8 : tunables 0 0 0 : slabdata 392 392 0
selinux_inode_security 27237 27838 264 31 2 : tunables 0 0 0 : slabdata 898 898 0

So the iint_cache is a LOT larger than all of the inode caches put
together. This is a 2.6.31-0.167.rc6.git6.fc12.x86_64 kernel without
any kernel options.

-Eric

-Eric



\
 
 \ /
  Last update: 2009-08-26 14:21    [W:0.075 / U:0.568 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site