From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukasz Pawelczyk Subject: Re: [PATCH v4 00/11] Smack namespace Date: Mon, 09 Nov 2015 16:40:24 +0100 Message-ID: <1447083624.2216.14.camel@samsung.com> References: <1444826525-9758-1-git-send-email-l.pawelczyk@samsung.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-reply-to: <1444826525-9758-1-git-send-email-l.pawelczyk-Sze3O3UU22JBDgjK7y7TUQ@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "David S. Miller" , "Eric W. Biederman" , "Serge E. Hallyn" , Al Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Calvin Owens , Casey Schaufler , David Howells , Eric Dumazet , Eric Paris , Greg Kroah-Hartman , James Morris , Jann Horn , Jiri Slaby , Joe Perches , John Johansen , Jonathan Corbet , Kees Cook , Mauro Carvalho Chehab , NeilBrown , Paul Moore Serge Cc: Lukasz Pawelczyk List-Id: containers.vger.kernel.org If I understand correctly the security window for 4.4 has been closed now (as changes went to next). Anyway, I updated the series to the latest smack-for-4.4 branch. Including the new relabel-self interface that received namespace treatment as well. Also the RCU fix reported on the list has been included. The latest version is available here: https://github.com/Havner/smack-namespace/tree/smack-namespace-current Also I've uploaded our Linux Test Project branch I use for Smack and Smack namespace testing (including regressions): https://github.com/Havner/ltp It has the basic smack tests rewritten to C. The ones that were scripts before. They are integrated with LTP framework. Inside testcases/kernel/security/smack/ns is a separate set of tests that share some common functions with the former, but are not otherwise integrated with LTP (yet). In this regard this is very much WIP. Those tests have an advantage though that they run a common set of tests in 6 Smack environments: no namespace, user namespace, user namespace + smack map. Each in a privileged and non-privileged scenario. To run them do the following: cd testcases/kernel/security/smack/ns make ./smack_ns_run.sh smackfs has to be mounted in /smack (following the regular tests). mount -o bind /sys/fs/smackfs /smack is enough. -- Lukasz Pawelczyk Samsung R&D Institute Poland Samsung Electronics From mboxrd@z Thu Jan 1 00:00:00 1970 Message-id: <1447083624.2216.14.camel@samsung.com> Subject: Re: [PATCH v4 00/11] Smack namespace From: Lukasz Pawelczyk To: "David S. Miller" , "Eric W. Biederman" , "Serge E. Hallyn" , Al Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Calvin Owens , Casey Schaufler , David Howells , Eric Dumazet , Eric Paris , Greg Kroah-Hartman , James Morris , Jann Horn , Jiri Slaby , Joe Perches , John Johansen , Jonathan Corbet , Kees Cook , Mauro Carvalho Chehab , NeilBrown , Paul Moore , Serge Hallyn , Stephen Smalley , Tejun Heo , Tetsuo Handa , containers@lists.linuxfoundation.org, linux-doc@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Cc: Lukasz Pawelczyk Date: Mon, 09 Nov 2015 16:40:24 +0100 In-reply-to: <1444826525-9758-1-git-send-email-l.pawelczyk@samsung.com> References: <1444826525-9758-1-git-send-email-l.pawelczyk@samsung.com> Content-type: text/plain; charset=UTF-8 MIME-version: 1.0 List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: If I understand correctly the security window for 4.4 has been closed now (as changes went to next). Anyway, I updated the series to the latest smack-for-4.4 branch. Including the new relabel-self interface that received namespace treatment as well. Also the RCU fix reported on the list has been included. The latest version is available here: https://github.com/Havner/smack-namespace/tree/smack-namespace-current Also I've uploaded our Linux Test Project branch I use for Smack and Smack namespace testing (including regressions): https://github.com/Havner/ltp It has the basic smack tests rewritten to C. The ones that were scripts before. They are integrated with LTP framework. Inside testcases/kernel/security/smack/ns is a separate set of tests that share some common functions with the former, but are not otherwise integrated with LTP (yet). In this regard this is very much WIP. Those tests have an advantage though that they run a common set of tests in 6 Smack environments: no namespace, user namespace, user namespace + smack map. Each in a privileged and non-privileged scenario. To run them do the following: cd testcases/kernel/security/smack/ns make ./smack_ns_run.sh smackfs has to be mounted in /smack (following the regular tests). mount -o bind /sys/fs/smackfs /smack is enough. -- Lukasz Pawelczyk Samsung R&D Institute Poland Samsung Electronics