Description of problem:

The IMA subsystem adds an asymmetric interface to monitoring files. That is, in-kernel users of the dentry_open interface must register their open files with IMA, but the registrations are automatically deregistered by filp_close. IMA provides verbose debugging output if it sees a file being deregistered that wasn't registered earlier.

ima_path_check(), which must be used to perform the registration, is a GPL-only symbol, so enabling IMA in effect breaks the dentry_open interface for non-GPL kernel modules. Whilst such modules can continue to function, the volume of debugging produced by IMA (a dump_stack every time a file is closed) seriously hampers the performance of the machine.

Whilst this is a general problem, in particular it breaks the Linux version of OpenAFS, which uses the dentry_open interface to access its cache files.

I raised this problem on the linux-security-module list in December 2009, and as a result the IMA interface was redesigned to remove the asymmetry of the register/unregister process. Those changes are in 2.6.33 - see the thread beginning at http://osdir.com/ml/linux-security-module/2009-12/msg00015.html for more details.

Many institutional users of OpenAFS use it with RHEL, so it would be great to have this fixed before the final release.