Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1696030

Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support

Show all headers | View raw

On Tue, 2017-07-25 at 12:53 -0500, Serge E. Hallyn wrote:
> On Thu, Jul 20, 2017 at 06:50:29PM -0400, Mehmet Kayaalp wrote:
> > 
> > From: Yuqiong Sun <suny@us.ibm.com>
> > 
> > Add new CONFIG_IMA_NS config option.  Let clone() create a new IMA
> > namespace upon CLONE_NEWNS flag. Add ima_ns data structure in
> > nsproxy.
> > ima_ns is allocated and freed upon IMA namespace creation and exit.
> > Currently, the ima_ns contains no useful IMA data but only a dummy
> > interface. This patch creates the framework for namespacing the
> > different
> > aspects of IMA (eg. IMA-audit, IMA-measurement, IMA-appraisal).
> > 
> > Signed-off-by: Yuqiong Sun <suny@us.ibm.com>
> > 
> > Changelog:
> > * Use CLONE_NEWNS instead of a new CLONE_NEWIMA flag
> 
> Hi,
> 
> So this means that every mount namespace clone will clone a new IMA
> namespace.  Is that really ok?

Based on what: space concerns (struct ima_ns is reasonably small)? or
whether tying it to the mount namespace is the correct thing to do.  On
the latter, it does seem that this should be a property of either the
mount or user ns rather than its own separate ns.  I could see a use
where even a container might want multiple ima keyrings within the
container (say containerised apache service with multiple tenants), so
instinct tells me that mount ns is the correct granularity for this.

James

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC PATCH 1/5] ima: extend clone() with IMA namespace support Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> - 2017-07-21 01:00 +0200
  Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support "Serge E. Hallyn" <serge@hallyn.com> - 2017-07-25 20:00 +0200
    Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-07-25 20:50 +0200
      Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support "Serge E. Hallyn" <serge@hallyn.com> - 2017-07-25 21:10 +0200
        Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-07-25 21:10 +0200
          Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-07-25 21:50 +0200
            Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-07-25 22:20 +0200
              Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support "Serge E. Hallyn" <serge@hallyn.com> - 2017-07-25 22:50 +0200
                Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-07-25 23:00 +0200
                Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support "Serge E. Hallyn" <serge@hallyn.com> - 2017-07-25 23:10 +0200
                Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-07-26 00:30 +0200
                Re: [Linux-ima-devel] [RFC PATCH 1/5] ima: extend clone() with IMA  namespace support Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-07-27 16:50 +0200
                Re: [Linux-ima-devel] [RFC PATCH 1/5] ima: extend clone() with IMA  namespace support Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-07-27 19:50 +0200
                Re: [Linux-ima-devel] [RFC PATCH 1/5] ima: extend clone() with IMA  namespace support Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-07-27 23:00 +0200
                Re: [Linux-ima-devel] [RFC PATCH 1/5] ima: extend clone() with IMA  namespace support Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-07-31 13:40 +0200
                Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Stefan Berger <stefanb@linux.vnet.ibm.com> - 2017-07-25 23:40 +0200
            Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-07-25 22:40 +0200
              Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Mimi Zohar <zohar@linux.vnet.ibm.com> - 2017-07-25 22:50 +0200

csiph-web