Re: [PATCH v9 5/8] IMA: limit critical data measurement based on a label

[Tushar Sugandhi]

On 2020-12-12 11:20 a.m., Tyler Hicks wrote:
> On 2020-12-12 10:02:48, Tushar Sugandhi wrote:
> > System administrators should be able to limit which kernel subsystems
> > they want to measure the critical data for. To enable that, an IMA policy
> > condition to choose specific kernel subsystems is needed. This policy
> > condition would constrain the measurement of the critical data based on
> > a label for the given subsystems.
> >
> > Add a new IMA policy condition - "data_source:=" to the IMA func
> > CRITICAL_DATA to allow measurement of various kernel subsystems. This
> > policy condition would enable the system administrators to restrict the
> > measurement to the labels listed in "data_source:=".
> >
> > Limit the measurement to the labels that are specified in the IMA
> > policy - CRITICAL_DATA+"data_source:=". If "data_sources:=" is not
> > provided with the func CRITICAL_DATA, the data from all the
> > supported kernel subsystems is measured.
> >
> > Signed-off-by: Tushar Sugandhi <tusharsu@xxxxxxxxxxxxxxxxxxx>
>
> Reviewed-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx>
>
> Tyler
Thanks again Tyler.

~Tushar