From: Christian Brauner <christian.brauner@ubuntu.com>
To: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Stefan Berger <stefanb@linux.ibm.com>,
James Bottomley <James.Bottomley@HansenPartnership.com>,
linux-integrity@vger.kernel.org, containers@lists.linux.dev,
Mimi Zohar <zohar@linux.ibm.com>,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
"Eric W . Biederman" <ebiederm@xmission.com>,
krzysztof.struczynski@huawei.com,
Roberto Sassu <roberto.sassu@huawei.com>,
Michael Peters <mpeters@redhat.com>,
Luke Hinds <lhinds@redhat.com>,
Lily Sturmann <lsturman@redhat.com>,
Patrick Uiterwijk <puiterwi@redhat.com>,
Christian Brauner <christian@brauner.io>
Subject: Re: [RFC 3/3] ima: make the integrity inode cache per namespace
Date: Tue, 30 Nov 2021 14:44:07 +0100 [thread overview]
Message-ID: <20211130134407.3hy2p7vlrevei2aa@wittgenstein> (raw)
In-Reply-To: <20211130050316.GC32444@mail.hallyn.com>
On Mon, Nov 29, 2021 at 11:03:17PM -0600, Serge Hallyn wrote:
> On Mon, Nov 29, 2021 at 12:04:29PM -0500, Stefan Berger wrote:
> >
> > On 11/29/21 11:16, Christian Brauner wrote:
> > > On Mon, Nov 29, 2021 at 09:35:39AM -0600, Serge Hallyn wrote:
> > > > On Mon, Nov 29, 2021 at 09:46:55AM -0500, James Bottomley wrote:
> > > > > On Mon, 2021-11-29 at 15:22 +0100, Christian Brauner wrote:
> > > > > > On Mon, Nov 29, 2021 at 09:10:29AM -0500, James Bottomley wrote:
> > > > > >
> > > I kept thinking about this question while I was out running and while I
> > > admittedly have reacted poorly to CLONE_NEWIMA patches before it feels
> > > to me that this is the right approach after all. Making it part of
> > > userns at least in this form isn't clean.
> > >
> > > I think attaching a uuid to a userns alone for the sake of IMA is wrong.
> > > Additionally, I think a uuid only for the userns is too limited. This is
> > > similar to the problem of the audit container id. If we have some sort
> > > of uuid for ima it will automatically evolve into something like a
> > > container id (I'm not even arguing that this is necessarily wrong.).
> > > We also have the issue that we then have the container audit id thing -
> > > if this ever lands and the ima userns uuid. All that makes it quite
> > > messy.
> > >
> > > I think CLONE_NEWIMA is ultimately nicer and allows the implementation
> > > to be decoupled from the userns and self-contained as possible. This
> > > also means that ima ns works for privileged containers which sure is a
> > > valid use-case.
> >
> > The thing is that piggy backing on the user namespace at least allows us to
> > 'always see' where IMA's keyring is (across setns()). If we were using an
> > independent IMA namespace how would we guarantee that the user sees the
> > keyring for IMA appraisal? We would at least have to take a reference (as in
> > get_user_ns()) to the user namespace when the IMA namespace is created so
> > that it at least the association of IMA namespace to user namespace remains
>
> Maybe we pull they keyring info into a new struct which is referred
> to and pinned by both user_ns and ima_ns? (But I actually am ignorant
> of how ima is using the keyrings, so again I need to go do some reading.)
That's one way of doing it and we'd be able to shrink struct
user_namespace because of it if we have to go down that road anyway.
>
> More moving parts isn't my first choice. But if you need namespaced IMA
> for containers that aren't doing CLONE_NEWUSER, then a separate ima_ns is
> your only option. Is that a requirement for you?
next prev parent reply other threads:[~2021-11-30 13:44 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-27 16:45 [RFC 0/3] Namespace IMA James Bottomley
2021-11-27 16:45 ` [RFC 1/3] userns: add uuid field James Bottomley
2021-11-28 4:45 ` Serge E. Hallyn
2021-11-28 13:29 ` James Bottomley
2021-11-28 15:18 ` Serge E. Hallyn
2021-11-28 18:00 ` James Bottomley
2021-11-28 20:47 ` Serge E. Hallyn
2021-11-28 21:21 ` James Bottomley
2021-11-28 21:49 ` Serge E. Hallyn
2021-11-28 22:56 ` James Bottomley
2021-11-29 1:59 ` Serge E. Hallyn
2021-11-29 13:49 ` Stefan Berger
2021-11-29 13:56 ` Christian Brauner
2021-11-29 14:19 ` Stefan Berger
2021-11-30 13:09 ` James Bottomley
2021-11-29 13:12 ` Christian Brauner
2021-11-29 13:46 ` James Bottomley
2021-11-27 16:45 ` [RFC 2/3] ima: Namespace IMA James Bottomley
2021-11-29 2:52 ` Serge E. Hallyn
2021-11-27 16:45 ` [RFC 3/3] ima: make the integrity inode cache per namespace James Bottomley
2021-11-29 4:58 ` Serge E. Hallyn
2021-11-29 12:50 ` James Bottomley
2021-11-29 13:53 ` Stefan Berger
2021-11-29 14:10 ` James Bottomley
2021-11-29 14:22 ` Christian Brauner
2021-11-29 14:46 ` James Bottomley
2021-11-29 15:27 ` Stefan Berger
2021-11-29 16:23 ` James Bottomley
2021-11-29 15:35 ` Serge E. Hallyn
2021-11-29 16:07 ` Stefan Berger
2021-11-30 4:42 ` Serge E. Hallyn
2021-11-29 16:16 ` Christian Brauner
2021-11-29 16:23 ` Christian Brauner
2021-11-29 17:04 ` Stefan Berger
2021-11-29 17:29 ` James Bottomley
2021-11-30 5:03 ` Serge E. Hallyn
2021-11-30 11:55 ` Stefan Berger
2021-11-30 13:33 ` Christian Brauner
2021-11-30 13:44 ` Christian Brauner [this message]
2021-11-30 13:38 ` Christian Brauner
2021-11-29 16:44 ` James Bottomley
2021-11-30 4:59 ` Serge E. Hallyn
2021-11-30 13:00 ` James Bottomley
2021-11-29 14:30 ` Stefan Berger
2021-11-29 15:08 ` James Bottomley
2021-11-29 16:20 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211130134407.3hy2p7vlrevei2aa@wittgenstein \
--to=christian.brauner@ubuntu.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=christian@brauner.io \
--cc=containers@lists.linux.dev \
--cc=dmitry.kasatkin@gmail.com \
--cc=ebiederm@xmission.com \
--cc=krzysztof.struczynski@huawei.com \
--cc=lhinds@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=lsturman@redhat.com \
--cc=mpeters@redhat.com \
--cc=puiterwi@redhat.com \
--cc=roberto.sassu@huawei.com \
--cc=serge@hallyn.com \
--cc=stefanb@linux.ibm.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).