IMA appraisal extension

Posted Mar 29, 2012 15:21 UTC (Thu) by etienne (guest, #25256)
Parent article: IMA appraisal extension

Bye Bye demand loading (i.e. loading only used pages in memory) of executables, libraries and data files in Linux?

IMA appraisal extension

Posted Mar 29, 2012 20:39 UTC (Thu) by nix (subscriber, #2304) [Link] (2 responses)

No. Demand-loaded executables have always worked by mmap()ing the executable then relying on normal paging to load it into memory. The mmap()ed executable cannot be overwritten while someone has it open (any attempt returns one of -EBUSY or -ETXTBSY, though for some time this did not apply to shared libraries, so attempts to overwrite those caused segfaults, whoops). And, of course, the usual rules apply to unlink()-and-recreate: the old file is still accessed by the users who have it open.

IMA appraisal extension

Posted Mar 30, 2012 0:09 UTC (Fri) by nybble41 (subscriber, #55106) [Link] (1 responses)

I think the concern was more along the lines that you have to read the entire file into memory to verify the hash before you can use any of the data safely. Filesystems with data checksumming generally hash each block separately (with a Merkle tree or similar to link the hashes together at the inode level), but the article seemed to imply just one hash per file.

IMA appraisal extension

Posted Mar 30, 2012 12:46 UTC (Fri) by nix (subscriber, #2304) [Link]

If so, that would make initial loading of binaries slower (a lot slower for big binaries), but would not preclude use of demand paging after startup.