Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1639884

[RFC 08/11] ima: block initial namespace id on the namespace policy interface

Show all headers | View raw

The initial namespace policy is set through the existent interface
in the ima/policy securityfs file. Block the initial namespace
id when it is written to the ima/namespace securityfs file.

Signed-off-by: Guilherme Magalhaes <guilherme.magalhaes@hpe.com>
---
 security/integrity/ima/ima_fs.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 61f8da1..65c43e7 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -365,6 +365,16 @@ static int check_mntns(unsigned int ns_id)
 	return result;
 }
 
+static unsigned int initial_mntns_id;
+static void get_initial_mntns_id(void)
+{
+	struct ns_common *ns;
+
+	ns = mntns_operations.get(&init_task);
+	initial_mntns_id = ns->inum;
+	mntns_operations.put(ns);
+}
+
 /*
  * ima_find_namespace_id_from_inode
  * @policy_inode: the inode of the securityfs policy file for a given
@@ -699,6 +709,12 @@ static ssize_t handle_new_namespace_policy(const char *data, size_t datalen)
 		goto out;
 	}
 
+	if (ns_id == initial_mntns_id) {
+		pr_err("IMA: invalid use of the initial mount namespace\n");
+		result = -EINVAL;
+		goto out;
+	}
+
 	ima_namespace_lock();
 	if (check_mntns(ns_id)) {
 		result = -ENOENT;
@@ -835,6 +851,8 @@ int __init ima_fs_init(void)
 						&ima_namespaces_ops);
 	if (IS_ERR(ima_namespaces))
 		goto out;
+
+	get_initial_mntns_id();
 #endif
 
 	return 0;
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC 00/11] ima: namespace support for IMA policy Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 01/11] ima: qualify pathname in audit info record Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 04/11] ima: add support to namespace securityfs file Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
    Re: [RFC 04/11] ima: add support to namespace securityfs file Tycho Andersen <tycho@docker.com> - 2017-05-18 23:40 +0200
    Re: [RFC 04/11] ima: add support to namespace securityfs file Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-05-24 22:20 +0200
  [RFC 02/11] ima: qualify pathname in audit measurement record Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 10/11] ima: handling all policy flags per namespace using ima_ns_policy structure Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:30 +0200
  [RFC 07/11] ima: new namespace policy structure to track initial namespace policy data Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 08/11] ima: block initial namespace id on the namespace policy interface Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 05/11] ima: store new namespace policy structure in a radix tree Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 06/11] ima, fs: release namespace policy resources Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200
  [RFC 09/11] ima: delete namespace policy securityfs file in write-once mode Guilherme Magalhaes <guilherme.magalhaes@hpe.com> - 2017-05-11 18:40 +0200

csiph-web