Re: [RFC 04/11] ima: add support to namespace securityfs file

From	Tycho Andersen <tycho@docker.com>
Newsgroups	linux.kernel
Subject	Re: [RFC 04/11] ima: add support to namespace securityfs file
Date	2017-05-18 23:40 +0200
Message-ID	<tIBjj-Bq-3@gated-at.bofh.it> (permalink)
References	<tFXJn-7DY-19@gated-at.bofh.it> <tFZ8v-dN-37@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi Guilherme,

On Thu, May 11, 2017 at 10:59:56AM -0300, Guilherme Magalhaes wrote:
> +static int ima_open_namespaces(struct inode *inode, struct file *filp)
> +{
> +	if (!(filp->f_flags & O_WRONLY))
> +		return -EACCES;
> +
> +	if (!capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
> +	if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags))
> +		return -EBUSY;

It probably makes sense to do something like:

if (!(ima_appraise & IMA_APPRAISE_NAMESPACE))
	return -EINVAL;

here.

I'll keep playing around with this patchset and see if I have any
other feedback.

Cheers,

Tycho

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

Re: [RFC 04/11] ima: add support to namespace securityfs file Tycho Andersen <tycho@docker.com> - 2017-05-18 23:40 +0200

csiph-web