Messages in this thread | | | Date | Sat, 16 Oct 2010 17:54:11 -0700 | From | "J.H." <> | Subject | Re: ima: use of radix tree cache indexing == massive waste of memory? |
| |
On 10/16/2010 05:35 PM, Dave Chinner wrote: > On Sat, Oct 16, 2010 at 02:10:29PM -0700, H. Peter Anvin wrote: >> "Christoph Hellwig" <hch@infradead.org> wrote: >>> Besides the algorithmic problems with ima, why is kernel.org using >>> IMA to start with? Except for IBM looking for a reason to jusity why >>> TPM isn't a completely waster of ressources it's pointless. And it was >>> only merged under the premise that it would not affect innocent normal >>> users. >> >> I'm confused ... what makes you think we are? This might have >> been an unintentional misconfiguration... > > It's enabled in the kernel that is running: > > $ grep CONFIG_IMA /boot/config-2.6.34.7-56.fc11.x86_64 > CONFIG_IMA=y > CONFIG_IMA_MEASURE_PCR_IDX=10 > CONFIG_IMA_AUDIT=y > CONFIG_IMA_LSM_RULES=y > $ > > and it's using lots of memory, so if you're not actually using it I > think it should be disabled. > > If this is a stock fedora config, then they've got some work to > do....
Considering the only change to the RPM I made for 2.6.34 (the kernel currently running on master) was a one line change to get XFS to not kill the box, it's standard.
Taking a quick glance at my laptop (F12) I'll note the following:
config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA=y config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA_MEASURE_PCR_IDX=10 config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA_AUDIT=y config-2.6.32.16-150.fc12.x86_64:CONFIG_IMA_LSM_RULES=y
config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA=y config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA_MEASURE_PCR_IDX=10 config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA_AUDIT=y config-2.6.32.21-166.fc12.x86_64:CONFIG_IMA_LSM_RULES=y
config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA=y config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA_MEASURE_PCR_IDX=10 config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA_AUDIT=y config-2.6.32.21-168.fc12.x86_64:CONFIG_IMA_LSM_RULES=y
So I would happily punt this at Fedora as an issue upstream (Fedora) in this case. This seems to be a boolean value inside the kernel, it's either enabled, or it's not.
There does seem to be a boot option to disable it, but it seems to be on by default if it's compiled in, and it's not like it's obvious that this is there and chewing up resources, is there a way to find out how much memory this is chewing up?
I can understand the distributions wanting to turn this on, there is likely user requests to be able to use this. It's just annoying that it's completely non-obvious that this change went in, it's on by default and it's stealing memory, particularly when it's not being used for anything.
Speaking to TPM, it's not quite an entire waste of resources - you can use it as a random number generator source from hardware, so that's useful - can't say much beyond that.
- John 'Warthog9' Hawley
| |