Home » Mailing list archives » linux-kernel » 2010 » October » 25

Re: [PATCH 01/11] IMA: use rbtree instead of radix tree for inode information cache

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: J.H.
Subject: Re: [PATCH 01/11] IMA: use rbtree instead of radix tree for inode information cache
Date: Monday, October 25, 2010 - 12:38 pm

On 10/25/2010 12:21 PM, John Stoffel wrote:

I'll second both points.  If IMA is disabled, but compiled in, it *HAS*
to consume 0 resources.  It's defective by design if something that is
only useful to 1% of the userbase (guesstimating) consumes even 1% of
the resources on any and all machines that are deployed with it.  It's
just plain wasteful of power, cooling, ram, compute resources, etc.

Keep in mind distros are going to err on the side of compiling things in
(either into the kernel or as modules) because there is a customer
*SOMEWHERE* that wants it.  Penalizing the rest of us, and forcing us
(effectively) to buy more ram, is not a good option.


Wouldn't an enterprising root-kit snag root, muck with IMA and then muck
with other files?  I mean I'm happy that it will trip-wire the
incompetent or old root kits, but if root can enable/disable this
outside of boot it's completely pointless.


Ignore backups, file servers and large webservers (read: basically
kernel.org's *ENTIRE* infrastructure) basically trips over this case.
To throw fire on the whole thing, if there are 100 mirrors in a
mirroring infrastructure (not uncommon for some distros) and they all
have IMA disabled but compiled in, and they are all rsyncing data (say a
distro release is ongoing) you are talking about a huge amount of waste
across all those machines.

I'd argue disabled = takes up no resources, that's what a sysadmin is
going to generally expect particularly for something that not many of
them are going to want to take advantage of.

Just my $0.02usd anyway.

- John 'Warthog9' Hawley
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH 01/11] IMA: use rbtree instead of radix tree for in ..., Eric Paris, (Mon Oct 25, 11:41 am)
[PATCH 02/11] IMA: drop the inode opencount since it isn't ..., Eric Paris, (Mon Oct 25, 11:41 am)
[PATCH 03/11] IMA: use unsigned int instead of long for co ..., Eric Paris, (Mon Oct 25, 11:41 am)
[PATCH 05/11] IMA: use inode->i_lock to protect read and w ..., Eric Paris, (Mon Oct 25, 11:41 am)
[PATCH 06/11] IMA: use i_writecount rather than a private ..., Eric Paris, (Mon Oct 25, 11:41 am)
[PATCH 07/11] IMA: move read counter into struct inode, Eric Paris, (Mon Oct 25, 11:41 am)
[PATCH 08/11] IMA: only allocate iint when needed, Eric Paris, (Mon Oct 25, 11:42 am)
[PATCH 09/11] IMA: drop refcnt from ima_iint_cache since i ..., Eric Paris, (Mon Oct 25, 11:42 am)
[PATCH 10/11] IMA: explicit IMA i_flag to remove global lo ..., Eric Paris, (Mon Oct 25, 11:42 am)
[PATCH 11/11] IMA: fix the ToMToU logic, Eric Paris, (Mon Oct 25, 11:42 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., John Stoffel, (Mon Oct 25, 12:21 pm)
Re: [PATCH 06/11] IMA: use i_writecount rather than a priv ..., John Stoffel, (Mon Oct 25, 12:27 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., J.H., (Mon Oct 25, 12:38 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Linus Torvalds, (Mon Oct 25, 1:55 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Christoph Hellwig, (Mon Oct 25, 1:57 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Linus Torvalds, (Mon Oct 25, 2:11 pm)
Re: [PATCH 06/11] IMA: use i_writecount rather than a priv ..., Eric Paris, (Mon Oct 25, 2:52 pm)
Re: [PATCH 06/11] IMA: use i_writecount rather than a priv ..., H. Peter Anvin, (Mon Oct 25, 3:25 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Dave Chinner, (Mon Oct 25, 4:22 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Eric Paris, (Mon Oct 25, 5:12 pm)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., John Stoffel, (Tue Oct 26, 6:45 am)
Re: [PATCH 06/11] IMA: use i_writecount rather than a priv ..., John Stoffel, (Tue Oct 26, 6:53 am)
Re: [PATCH 06/11] IMA: use i_writecount rather than a priv ..., John Stoffel, (Tue Oct 26, 6:57 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., John Stoffel, (Tue Oct 26, 7:01 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., John Stoffel, (Tue Oct 26, 7:07 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Linus Torvalds, (Tue Oct 26, 8:22 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Eric Paris, (Tue Oct 26, 8:30 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., Al Viro, (Tue Oct 26, 11:13 am)
Re: [PATCH 01/11] IMA: use rbtree instead of radix tree fo ..., James Morris, (Wed Oct 27, 6:35 am)