From mboxrd@z Thu Jan 1 00:00:00 1970 From: James.Bottomley@HansenPartnership.com (James Bottomley) Date: Fri, 14 Jul 2017 11:52:42 -0700 Subject: [PATCH v2] xattr: Enable security.capability in user namespaces In-Reply-To: <1500058090.3583.28.camel@linux.vnet.ibm.com> References: <87y3rscz9j.fsf@xmission.com> <20170713164012.brj2flnkaaks2oci@thunk.org> <87k23cb6os.fsf@xmission.com> <847ccb2a-30c0-a94c-df6f-091c8901eaa0@linux.vnet.ibm.com> <87bmoo8bxb.fsf@xmission.com> <9a3010e5-ca2b-5e7a-656b-fcc14f7bec4e@linux.vnet.ibm.com> <87h8yf7szd.fsf@xmission.com> <65dbe654-0d99-03fa-c838-5a726b462826@linux.vnet.ibm.com> <20170714133437.GA16737@mail.hallyn.com> <596f808b-e21d-8296-5fef-23c1ce7ab778@linux.vnet.ibm.com> <20170714173556.GA19669@mail.hallyn.com> <1500058090.3583.28.camel@linux.vnet.ibm.com> Message-ID: <1500058362.2853.28.camel@HansenPartnership.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Fri, 2017-07-14 at 14:48 -0400, Mimi Zohar wrote: > The concern is with a shared filesystems. ?In that case, for IMA it > would make sense to support a native and a namespace xattr. ?If due > to xattr space limitations we have to limit the number of xattrs, > then we should limit it to two - a native and a namespace version, > with a "uid=" tag - first namespace gets permission to write the > namespace xattr. ?Again, like in the layered case, if the namespace > xattr doesn't exist, fall back to using the native xattr. Just on this point: if we're really concerned about the need on shared filesystems to have multiple IMA signatures per file, might it not make sense simply to support multiple signatures within the security.ima xattr? The rules for writing signature updates within user namespaces would be somewhat complex (say only able to replace a signature for which you demonstrate you possess the key) but it would lead to an implementation which would work for traditional shared filesystems (like NFS) as well as containerised bind mounts. James -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============7671678331897773428==" MIME-Version: 1.0 From: James Bottomley To: lkp@lists.01.org Subject: Re: [PATCH v2] xattr: Enable security.capability in user namespaces Date: Fri, 14 Jul 2017 11:52:42 -0700 Message-ID: <1500058362.2853.28.camel@HansenPartnership.com> In-Reply-To: <1500058090.3583.28.camel@linux.vnet.ibm.com> List-Id: --===============7671678331897773428== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Fri, 2017-07-14 at 14:48 -0400, Mimi Zohar wrote: > The concern is with a shared filesystems. =C2=A0In that case, for IMA it > would make sense to support a native and a namespace xattr. =C2=A0If due > to xattr space limitations we have to limit the number of xattrs, > then we should limit it to two - a native and a namespace version, > with a "uid=3D" tag - first namespace gets permission to write the > namespace xattr. =C2=A0Again, like in the layered case, if the namespace > xattr doesn't exist, fall back to using the native xattr. Just on this point: if we're really concerned about the need on shared filesystems to have multiple IMA signatures per file, might it not make sense simply to support multiple signatures within the security.ima xattr? The rules for writing signature updates within user namespaces would be somewhat complex (say only able to replace a signature for which you demonstrate you possess the key) but it would lead to an implementation which would work for traditional shared filesystems (like NFS) as well as containerised bind mounts. James --===============7671678331897773428==-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751150AbdGNSwr (ORCPT ); Fri, 14 Jul 2017 14:52:47 -0400 Received: from bedivere.hansenpartnership.com ([66.63.167.143]:43830 "EHLO bedivere.hansenpartnership.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750819AbdGNSwp (ORCPT ); Fri, 14 Jul 2017 14:52:45 -0400 Message-ID: <1500058362.2853.28.camel@HansenPartnership.com> Subject: Re: [PATCH v2] xattr: Enable security.capability in user namespaces From: James Bottomley To: Mimi Zohar , "Serge E. Hallyn" , Stefan Berger , Mimi Zohar Cc: "Eric W. Biederman" , "Theodore Ts'o" , containers@lists.linux-foundation.org, lkp@01.org, linux-kernel@vger.kernel.org, tycho@docker.com, vgoyal@redhat.com, christian.brauner@mailbox.org, amir73il@gmail.com, linux-security-module@vger.kernel.org, casey@schaufler-ca.com Date: Fri, 14 Jul 2017 11:52:42 -0700 In-Reply-To: <1500058090.3583.28.camel@linux.vnet.ibm.com> References: <87y3rscz9j.fsf@xmission.com> <20170713164012.brj2flnkaaks2oci@thunk.org> <87k23cb6os.fsf@xmission.com> <847ccb2a-30c0-a94c-df6f-091c8901eaa0@linux.vnet.ibm.com> <87bmoo8bxb.fsf@xmission.com> <9a3010e5-ca2b-5e7a-656b-fcc14f7bec4e@linux.vnet.ibm.com> <87h8yf7szd.fsf@xmission.com> <65dbe654-0d99-03fa-c838-5a726b462826@linux.vnet.ibm.com> <20170714133437.GA16737@mail.hallyn.com> <596f808b-e21d-8296-5fef-23c1ce7ab778@linux.vnet.ibm.com> <20170714173556.GA19669@mail.hallyn.com> <1500058090.3583.28.camel@linux.vnet.ibm.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2017-07-14 at 14:48 -0400, Mimi Zohar wrote: > The concern is with a shared filesystems.  In that case, for IMA it > would make sense to support a native and a namespace xattr.  If due > to xattr space limitations we have to limit the number of xattrs, > then we should limit it to two - a native and a namespace version, > with a "uid=" tag - first namespace gets permission to write the > namespace xattr.  Again, like in the layered case, if the namespace > xattr doesn't exist, fall back to using the native xattr. Just on this point: if we're really concerned about the need on shared filesystems to have multiple IMA signatures per file, might it not make sense simply to support multiple signatures within the security.ima xattr? The rules for writing signature updates within user namespaces would be somewhat complex (say only able to replace a signature for which you demonstrate you possess the key) but it would lead to an implementation which would work for traditional shared filesystems (like NFS) as well as containerised bind mounts. James