Re: [RFC PATCH v2 1/4] security: ima: call ima_init() again at late_initcall_sync for defered TPM
Paul Moore <[email protected]>
| Newsgroups | org.kernel.vger.linux-integrity,dev.linux.lists.kvmarm,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel,org.kernel.vger.linux-security-module |
|---|---|
| Message-ID | <CAHC9VhRT1v3mM9CFvz7Dh5Zrv_MF3vgBk+BZ=q8wOMkPB6O6Fw@mail.gmail.com> |
On Sat, Apr 25, 2026 at 12:53 AM Yeoreum Yun <[email protected]> wrote: > > > I understand the need to ensure that the TPM is available, but if it > > > isn't safe to wait to initialize IMA at late_initcall_sync() then it > > > would seem like this is a bad option and we need another mechanism to > > > synchronize IMA with TPM devices. If it is safe to initalize IMA in > > > late_initcall_sync(), just do that and be done with it. > > > > Within the same initcall level there is no way of ordering the initialization. > > Yeorum attempted to address the ordering issue in commit 0e0546eabcd6 > > ("firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall"), > > which is being reverted in this patch set. > > > > Ordering within an initcall level needs to be fixed, but for now retrying at > > late_initcall_sync works for some, hopefully most, cases. > > Ordering within an initcall level is not good idea. Agreed. That's why we have the different initcall levels. -- paul-moore.com