From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)
To: Stefan Berger
<stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
Cc: John Johansen
<john.johansen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>,
tycho-FCduhRhOUaTQT0dZR+AlfA@public.gmane.org,
Mehmet Kayaalp
<mkayaalp-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>,
sunyuqiong1988-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org,
containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
david.safford-JJi787mZWgc@public.gmane.org,
James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org,
linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
mkayaalp-4hyTIkVWTs8LubxHQvXPfYdd74u8MsAO@public.gmane.org,
linux-integrity-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
Yuqiong Sun <suny-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>,
Mimi Zohar
<zohar-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
Subject: Re: [RFC PATCH v3 1/3] ima: extend clone() with IMA namespace support
Date: Thu, 26 Apr 2018 19:49:59 -0500 [thread overview]
Message-ID: <87fu3hbhhk.fsf__9253.11472169614$1524790097$gmane$org@xmission.com> (raw)
In-Reply-To: <0d2b2635-d7fb-d240-7dd0-2a81014c58ba-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> (Stefan Berger's message of "Thu, 26 Apr 2018 17:18:43 -0400")
Stefan Berger <stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:
> On 04/19/2018 11:35 AM, John Johansen wrote:
>> It sounds like its already decided, with ima and selinux going with an unshare file within their own fs.
>>
>> AppArmor went a different route already, splitting namespace creation (mkdir in the apparmorfs policy/namespace dir) and the task entering the namespace with a write apparmor's equiv of setexeccon.
>>
> I am supporting procfs entries for the IMA namespace spawned by writing a
> boolean '1' into IMA's securityfs 'unshare' file. It would allow to use
> setns(fd, 0), obviously with the 0 parameter. I think this is an important
> function to support considering entering a set of namespace. I am just wondering
> about the 0 parameter. We don't have a CLONE flag for it, so there's not other
> way to support it then. Does it matter ?
That should be fine. We can pick a flag for setns at some point for
IMA. The setns function uses the flag field as an enumeration so any of
the low 8 bits or a combination with overlapping bit is valid to setns.
Eric
next prev parent reply other threads:[~2018-04-27 0:49 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1522159038-14175-1-git-send-email-stefanb@linux.vnet.ibm.com>
[not found] ` <1522159038-14175-1-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-03-27 13:57 ` [RFC PATCH v3 1/3] ima: extend clone() with IMA namespace support Stefan Berger
[not found] ` <1522159038-14175-2-git-send-email-stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-03-27 23:01 ` Eric W. Biederman
[not found] ` <87sh8lcecn.fsf@xmission.com>
[not found] ` <87sh8lcecn.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-03-28 11:10 ` Stefan Berger
2018-04-13 16:25 ` Mimi Zohar
[not found] ` <bc03161e-394b-bf4d-48c4-858dcf05458a@linux.vnet.ibm.com>
[not found] ` <20180328121418.GA24712@wind.enjellic.com>
[not found] ` <20180328121418.GA24712-DHO+NtfOqB5PEDpkEIzg7wC/G2K4zDHf@public.gmane.org>
2018-03-28 12:44 ` Stefan Berger
[not found] ` <bc03161e-394b-bf4d-48c4-858dcf05458a-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-03-28 12:14 ` Dr. Greg Wettstein
2018-04-18 15:59 ` John Johansen
[not found] ` <1523636702.3272.63.camel@linux.vnet.ibm.com>
[not found] ` <1523636702.3272.63.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-04-18 16:09 ` John Johansen
[not found] ` <d8c30d7d-c679-9323-7a25-d3148e9b96c6@canonical.com>
[not found] ` <d8c30d7d-c679-9323-7a25-d3148e9b96c6-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
2018-04-18 19:57 ` Mimi Zohar
[not found] ` <1524081472.3272.319.camel@linux.vnet.ibm.com>
[not found] ` <1524081472.3272.319.camel-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-04-18 20:12 ` Eric W. Biederman
[not found] ` <87wox4s282.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-04-18 20:27 ` Mimi Zohar
2018-04-18 21:32 ` John Johansen
[not found] ` <8895cb9c-7b9e-2f82-e3d8-a15f5fc26e25@canonical.com>
[not found] ` <8895cb9c-7b9e-2f82-e3d8-a15f5fc26e25-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
2018-04-19 11:03 ` Stefan Berger
[not found] ` <2103bbb9-3f2a-78f8-f7ad-28859659973f@linux.vnet.ibm.com>
[not found] ` <2103bbb9-3f2a-78f8-f7ad-28859659973f-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-04-19 15:35 ` John Johansen
[not found] ` <f84ae8af-fa5b-9f31-fbef-5a49f90dd45a@canonical.com>
[not found] ` <f84ae8af-fa5b-9f31-fbef-5a49f90dd45a-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
2018-04-26 21:18 ` Stefan Berger
[not found] ` <0d2b2635-d7fb-d240-7dd0-2a81014c58ba@linux.vnet.ibm.com>
[not found] ` <0d2b2635-d7fb-d240-7dd0-2a81014c58ba-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-04-27 0:49 ` Eric W. Biederman [this message]
2018-03-27 13:57 ` [RFC PATCH v3 2/3] ima: Add ns_status for storing namespaced iint data Stefan Berger
2018-03-27 13:57 ` [RFC PATCH v3 3/3] ima: mamespace audit status flags Stefan Berger
[not found] <stefanb@linux.vnet.ibm.com>
2018-03-29 17:44 ` [RFC PATCH v3 1/3] ima: extend clone() with IMA namespace support Dr. Greg Wettstein
[not found] ` <201803291744.w2THiZoV005866-DHO+NtfOqB5PEDpkEIzg7wC/G2K4zDHf@public.gmane.org>
2018-04-02 11:20 ` Stefan Berger
[not found] ` <d7e1b214-6565-6c0b-9cdc-2b3dec361161@linux.vnet.ibm.com>
[not found] ` <d7e1b214-6565-6c0b-9cdc-2b3dec361161-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>
2018-04-03 15:04 ` Dr. Greg Wettstein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='87fu3hbhhk.fsf__9253.11472169614$1524790097$gmane$org@xmission.com' \
--to=ebiederm-as9lmozglivwk0htik3j/w@public.gmane.org \
--cc=James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=david.safford-JJi787mZWgc@public.gmane.org \
--cc=john.johansen-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org \
--cc=linux-integrity-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mkayaalp-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org \
--cc=mkayaalp-4hyTIkVWTs8LubxHQvXPfYdd74u8MsAO@public.gmane.org \
--cc=stefanb-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org \
--cc=suny-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org \
--cc=sunyuqiong1988-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
--cc=tycho-FCduhRhOUaTQT0dZR+AlfA@public.gmane.org \
--cc=zohar-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).