diff for duplicates of <1500060374.3583.57.camel@linux.vnet.ibm.com> diff --git a/a/1.txt b/N1/1.txt index cc9019a..71ce71a 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,19 +1,19 @@ On Fri, 2017-07-14 at 13:17 -0500, Eric W. Biederman wrote: > "Serge E. Hallyn" <serge@hallyn.com> writes: > -> > Quoting Stefan Berger (stefanb at linux.vnet.ibm.com): +> > Quoting Stefan Berger (stefanb(a)linux.vnet.ibm.com): > >> On 07/14/2017 09:34 AM, Serge E. Hallyn wrote: -> >> >Quoting Stefan Berger (stefanb at linux.vnet.ibm.com): +> >> >Quoting Stefan Berger (stefanb(a)linux.vnet.ibm.com): > >> >>On 07/13/2017 08:38 PM, Eric W. Biederman wrote: > >> >>>Stefan Berger <stefanb@linux.vnet.ibm.com> writes: > >> >>> > >> >>>>On 07/13/2017 01:49 PM, Eric W. Biederman wrote: > >> >>>> > >> >>>>>My big question right now is can you implement Ted's suggested -> >> >>>>>restriction. Only one security.foo or secuirty.foo at ... attribute ? +> >> >>>>>restriction. Only one security.foo or secuirty.foo(a)... attribute ? > >> >>>>We need to raw-list the xattrs and do the check before writing them. I am fairly sure this can be done. > >> >>>> -> >> >>>>So now you want to allow security.foo and one security.foo at uid=<> or just a single one security.foo(@[[:print:]]*)? +> >> >>>>So now you want to allow security.foo and one security.foo(a)uid=<> or just a single one security.foo(@[[:print:]]*)? > >> >>>> > >> >>>The latter. > >> >>That case would prevent a container user from overriding the xattr @@ -30,7 +30,7 @@ On Fri, 2017-07-14 at 13:17 -0500, Eric W. Biederman wrote: > >> need to get rid of security.ima first, possibly by copying each > >> file, deleting the original file, and renaming the copied file to > >> the original name, or should I just be able to write out a new -> >> signature, thus creating security.ima at uid=1000 besides the +> >> signature, thus creating security.ima(a)uid=1000 besides the > >> security.ima ? > >> > >> Stefan @@ -53,7 +53,7 @@ security.evm contains either a signature or an hmac of the security xattrs and other file metadata. (file meta-data) The same rules would apply to security.evm, as described in my -response. ?Based on it's view of the security xattrs, either the +response. Based on it's view of the security xattrs, either the native or namespace security.evm would be updated. > If there is an attribute with a simple file hash I think it only make @@ -61,8 +61,8 @@ native or namespace security.evm would be updated. > multiples. Only files that are in the IMA-appraisal policy is the file hash -calculated and written out as security.ima. ?Depending this policy, -does the security.ima exist. ?So if the file is in policy for both the +calculated and written out as security.ima. Depending this policy, +does the security.ima exist. So if the file is in policy for both the native and namespace policies, agreed the same hash doesn't need to be written as two different xattrs. @@ -101,7 +101,7 @@ Agreed. > evm content. We need to resolve the xattr issue in order to namespace IMA- -appraisal.? +appraisal. Mimi @@ -118,9 +118,3 @@ Mimi > > In short I am seeing more code that runs slower and is harder to > maintain. Please point out where I am wrong. - - --- -To unsubscribe from this list: send the line "unsubscribe linux-security-module" in -the body of a message to majordomo at vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/a/content_digest b/N1/content_digest index c7a9d1c..4bab03e 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,37 +1,26 @@ - "ref\087y3rscz9j.fsf@xmission.com\0" - "ref\020170713164012.brj2flnkaaks2oci@thunk.org\0" - "ref\087k23cb6os.fsf@xmission.com\0" - "ref\0847ccb2a-30c0-a94c-df6f-091c8901eaa0@linux.vnet.ibm.com\0" - "ref\087bmoo8bxb.fsf@xmission.com\0" - "ref\09a3010e5-ca2b-5e7a-656b-fcc14f7bec4e@linux.vnet.ibm.com\0" - "ref\087h8yf7szd.fsf@xmission.com\0" - "ref\065dbe654-0d99-03fa-c838-5a726b462826@linux.vnet.ibm.com\0" - "ref\020170714133437.GA16737@mail.hallyn.com\0" - "ref\0596f808b-e21d-8296-5fef-23c1ce7ab778@linux.vnet.ibm.com\0" - "ref\020170714173556.GA19669@mail.hallyn.com\0" "ref\0xagsmtp2.20170714182525.6604@vmsdvm4.vnet.ibm.com\0" - "From\0zohar@linux.vnet.ibm.com (Mimi Zohar)\0" - "Subject\0[PATCH v2] xattr: Enable security.capability in user namespaces\0" + "From\0Mimi Zohar <zohar@linux.vnet.ibm.com>\0" + "Subject\0Re: [PATCH v2] xattr: Enable security.capability in user namespaces\0" "Date\0Fri, 14 Jul 2017 15:26:14 -0400\0" - "To\0linux-security-module@vger.kernel.org\0" - "\00:1\0" + "To\0lkp@lists.01.org\0" + "\01:1\0" "b\0" "On Fri, 2017-07-14 at 13:17 -0500, Eric W. Biederman wrote:\n" "> \"Serge E. Hallyn\" <serge@hallyn.com> writes:\n" "> \n" - "> > Quoting Stefan Berger (stefanb at linux.vnet.ibm.com):\n" + "> > Quoting Stefan Berger (stefanb(a)linux.vnet.ibm.com):\n" "> >> On 07/14/2017 09:34 AM, Serge E. Hallyn wrote:\n" - "> >> >Quoting Stefan Berger (stefanb at linux.vnet.ibm.com):\n" + "> >> >Quoting Stefan Berger (stefanb(a)linux.vnet.ibm.com):\n" "> >> >>On 07/13/2017 08:38 PM, Eric W. Biederman wrote:\n" "> >> >>>Stefan Berger <stefanb@linux.vnet.ibm.com> writes:\n" "> >> >>>\n" "> >> >>>>On 07/13/2017 01:49 PM, Eric W. Biederman wrote:\n" "> >> >>>>\n" "> >> >>>>>My big question right now is can you implement Ted's suggested\n" - "> >> >>>>>restriction. Only one security.foo or secuirty.foo at ... attribute ?\n" + "> >> >>>>>restriction. Only one security.foo or secuirty.foo(a)... attribute ?\n" "> >> >>>>We need to raw-list the xattrs and do the check before writing them. I am fairly sure this can be done.\n" "> >> >>>>\n" - "> >> >>>>So now you want to allow security.foo and one security.foo at uid=<> or just a single one security.foo(@[[:print:]]*)?\n" + "> >> >>>>So now you want to allow security.foo and one security.foo(a)uid=<> or just a single one security.foo(@[[:print:]]*)?\n" "> >> >>>>\n" "> >> >>>The latter.\n" "> >> >>That case would prevent a container user from overriding the xattr\n" @@ -48,7 +37,7 @@ "> >> need to get rid of security.ima first, possibly by copying each\n" "> >> file, deleting the original file, and renaming the copied file to\n" "> >> the original name, or should I just be able to write out a new\n" - "> >> signature, thus creating security.ima at uid=1000 besides the\n" + "> >> signature, thus creating security.ima(a)uid=1000 besides the\n" "> >> security.ima ?\n" "> >> \n" "> >> Stefan\n" @@ -71,7 +60,7 @@ "xattrs and other file metadata. (file meta-data)\n" "\n" "The same rules would apply to security.evm, as described in my\n" - "response. ?Based on it's view of the security xattrs, either the\n" + "response. \302\240Based on it's view of the security xattrs, either the\n" "native or namespace security.evm would be updated.\n" "\n" "> If there is an attribute with a simple file hash I think it only make\n" @@ -79,8 +68,8 @@ "> multiples.\n" "\n" "Only files that are in the IMA-appraisal policy is the file hash\n" - "calculated and written out as security.ima. ?Depending this policy,\n" - "does the security.ima exist. ?So if the file is in policy for both the\n" + "calculated and written out as security.ima. \302\240Depending this policy,\n" + "does the security.ima exist. \302\240So if the file is in policy for both the\n" "native and namespace policies, agreed the same hash doesn't need to be\n" "written as two different xattrs.\n" "\n" @@ -119,7 +108,7 @@ "> evm content.\n" "\n" "We need to resolve the xattr issue in order to namespace IMA-\n" - "appraisal.?\n" + "appraisal.\302\240\n" "\n" "Mimi\n" "\n" @@ -135,12 +124,6 @@ "> access so is less efficient.\n" "> \n" "> In short I am seeing more code that runs slower and is harder to\n" - "> maintain. Please point out where I am wrong.\n" - "\n" - "\n" - "--\n" - "To unsubscribe from this list: send the line \"unsubscribe linux-security-module\" in\n" - "the body of a message to majordomo at vger.kernel.org\n" - More majordomo info at http://vger.kernel.org/majordomo-info.html + > maintain. Please point out where I am wrong. -29196baefa86c5c9136a39df28799a744422bebef9ae82114c07982de1b6d7fe +4e12bc225f9382f8aafe953e148dfb27c139d32040147739aa40b11a3a78af8b
diff --git a/a/1.txt b/N2/1.txt index cc9019a..678791f 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -1,19 +1,19 @@ On Fri, 2017-07-14 at 13:17 -0500, Eric W. Biederman wrote: > "Serge E. Hallyn" <serge@hallyn.com> writes: > -> > Quoting Stefan Berger (stefanb at linux.vnet.ibm.com): +> > Quoting Stefan Berger (stefanb@linux.vnet.ibm.com): > >> On 07/14/2017 09:34 AM, Serge E. Hallyn wrote: -> >> >Quoting Stefan Berger (stefanb at linux.vnet.ibm.com): +> >> >Quoting Stefan Berger (stefanb@linux.vnet.ibm.com): > >> >>On 07/13/2017 08:38 PM, Eric W. Biederman wrote: > >> >>>Stefan Berger <stefanb@linux.vnet.ibm.com> writes: > >> >>> > >> >>>>On 07/13/2017 01:49 PM, Eric W. Biederman wrote: > >> >>>> > >> >>>>>My big question right now is can you implement Ted's suggested -> >> >>>>>restriction. Only one security.foo or secuirty.foo at ... attribute ? +> >> >>>>>restriction. Only one security.foo or secuirty.foo@... attribute ? > >> >>>>We need to raw-list the xattrs and do the check before writing them. I am fairly sure this can be done. > >> >>>> -> >> >>>>So now you want to allow security.foo and one security.foo at uid=<> or just a single one security.foo(@[[:print:]]*)? +> >> >>>>So now you want to allow security.foo and one security.foo@uid=<> or just a single one security.foo(@[[:print:]]*)? > >> >>>> > >> >>>The latter. > >> >>That case would prevent a container user from overriding the xattr @@ -30,7 +30,7 @@ On Fri, 2017-07-14 at 13:17 -0500, Eric W. Biederman wrote: > >> need to get rid of security.ima first, possibly by copying each > >> file, deleting the original file, and renaming the copied file to > >> the original name, or should I just be able to write out a new -> >> signature, thus creating security.ima at uid=1000 besides the +> >> signature, thus creating security.ima@uid=1000 besides the > >> security.ima ? > >> > >> Stefan @@ -53,7 +53,7 @@ security.evm contains either a signature or an hmac of the security xattrs and other file metadata. (file meta-data) The same rules would apply to security.evm, as described in my -response. ?Based on it's view of the security xattrs, either the +response. Based on it's view of the security xattrs, either the native or namespace security.evm would be updated. > If there is an attribute with a simple file hash I think it only make @@ -61,8 +61,8 @@ native or namespace security.evm would be updated. > multiples. Only files that are in the IMA-appraisal policy is the file hash -calculated and written out as security.ima. ?Depending this policy, -does the security.ima exist. ?So if the file is in policy for both the +calculated and written out as security.ima. Depending this policy, +does the security.ima exist. So if the file is in policy for both the native and namespace policies, agreed the same hash doesn't need to be written as two different xattrs. @@ -101,7 +101,7 @@ Agreed. > evm content. We need to resolve the xattr issue in order to namespace IMA- -appraisal.? +appraisal. Mimi @@ -118,9 +118,3 @@ Mimi > > In short I am seeing more code that runs slower and is harder to > maintain. Please point out where I am wrong. - - --- -To unsubscribe from this list: send the line "unsubscribe linux-security-module" in -the body of a message to majordomo at vger.kernel.org -More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/a/content_digest b/N2/content_digest index c7a9d1c..8232237 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -10,28 +10,42 @@ "ref\0596f808b-e21d-8296-5fef-23c1ce7ab778@linux.vnet.ibm.com\0" "ref\020170714173556.GA19669@mail.hallyn.com\0" "ref\0xagsmtp2.20170714182525.6604@vmsdvm4.vnet.ibm.com\0" - "From\0zohar@linux.vnet.ibm.com (Mimi Zohar)\0" - "Subject\0[PATCH v2] xattr: Enable security.capability in user namespaces\0" + "From\0Mimi Zohar <zohar@linux.vnet.ibm.com>\0" + "Subject\0Re: [PATCH v2] xattr: Enable security.capability in user namespaces\0" "Date\0Fri, 14 Jul 2017 15:26:14 -0400\0" - "To\0linux-security-module@vger.kernel.org\0" + "To\0Eric W. Biederman <ebiederm@xmission.com>" + " Serge E. Hallyn <serge@hallyn.com>\0" + "Cc\0Stefan Berger <stefanb@linux.vnet.ibm.com>" + Mimi Zohar <zohar@us.ibm.com> + Theodore Ts'o <tytso@mit.edu> + containers@lists.linux-foundation.org + lkp@01.org + linux-kernel@vger.kernel.org + tycho@docker.com + James.Bottomley@hansenpartnership.com + vgoyal@redhat.com + christian.brauner@mailbox.org + amir73il@gmail.com + linux-security-module@vger.kernel.org + " casey@schaufler-ca.com\0" "\00:1\0" "b\0" "On Fri, 2017-07-14 at 13:17 -0500, Eric W. Biederman wrote:\n" "> \"Serge E. Hallyn\" <serge@hallyn.com> writes:\n" "> \n" - "> > Quoting Stefan Berger (stefanb at linux.vnet.ibm.com):\n" + "> > Quoting Stefan Berger (stefanb@linux.vnet.ibm.com):\n" "> >> On 07/14/2017 09:34 AM, Serge E. Hallyn wrote:\n" - "> >> >Quoting Stefan Berger (stefanb at linux.vnet.ibm.com):\n" + "> >> >Quoting Stefan Berger (stefanb@linux.vnet.ibm.com):\n" "> >> >>On 07/13/2017 08:38 PM, Eric W. Biederman wrote:\n" "> >> >>>Stefan Berger <stefanb@linux.vnet.ibm.com> writes:\n" "> >> >>>\n" "> >> >>>>On 07/13/2017 01:49 PM, Eric W. Biederman wrote:\n" "> >> >>>>\n" "> >> >>>>>My big question right now is can you implement Ted's suggested\n" - "> >> >>>>>restriction. Only one security.foo or secuirty.foo at ... attribute ?\n" + "> >> >>>>>restriction. Only one security.foo or secuirty.foo@... attribute ?\n" "> >> >>>>We need to raw-list the xattrs and do the check before writing them. I am fairly sure this can be done.\n" "> >> >>>>\n" - "> >> >>>>So now you want to allow security.foo and one security.foo at uid=<> or just a single one security.foo(@[[:print:]]*)?\n" + "> >> >>>>So now you want to allow security.foo and one security.foo@uid=<> or just a single one security.foo(@[[:print:]]*)?\n" "> >> >>>>\n" "> >> >>>The latter.\n" "> >> >>That case would prevent a container user from overriding the xattr\n" @@ -48,7 +62,7 @@ "> >> need to get rid of security.ima first, possibly by copying each\n" "> >> file, deleting the original file, and renaming the copied file to\n" "> >> the original name, or should I just be able to write out a new\n" - "> >> signature, thus creating security.ima at uid=1000 besides the\n" + "> >> signature, thus creating security.ima@uid=1000 besides the\n" "> >> security.ima ?\n" "> >> \n" "> >> Stefan\n" @@ -71,7 +85,7 @@ "xattrs and other file metadata. (file meta-data)\n" "\n" "The same rules would apply to security.evm, as described in my\n" - "response. ?Based on it's view of the security xattrs, either the\n" + "response. \302\240Based on it's view of the security xattrs, either the\n" "native or namespace security.evm would be updated.\n" "\n" "> If there is an attribute with a simple file hash I think it only make\n" @@ -79,8 +93,8 @@ "> multiples.\n" "\n" "Only files that are in the IMA-appraisal policy is the file hash\n" - "calculated and written out as security.ima. ?Depending this policy,\n" - "does the security.ima exist. ?So if the file is in policy for both the\n" + "calculated and written out as security.ima. \302\240Depending this policy,\n" + "does the security.ima exist. \302\240So if the file is in policy for both the\n" "native and namespace policies, agreed the same hash doesn't need to be\n" "written as two different xattrs.\n" "\n" @@ -119,7 +133,7 @@ "> evm content.\n" "\n" "We need to resolve the xattr issue in order to namespace IMA-\n" - "appraisal.?\n" + "appraisal.\302\240\n" "\n" "Mimi\n" "\n" @@ -135,12 +149,6 @@ "> access so is less efficient.\n" "> \n" "> In short I am seeing more code that runs slower and is harder to\n" - "> maintain. Please point out where I am wrong.\n" - "\n" - "\n" - "--\n" - "To unsubscribe from this list: send the line \"unsubscribe linux-security-module\" in\n" - "the body of a message to majordomo at vger.kernel.org\n" - More majordomo info at http://vger.kernel.org/majordomo-info.html + > maintain. Please point out where I am wrong. -29196baefa86c5c9136a39df28799a744422bebef9ae82114c07982de1b6d7fe +cd8b4a24046aae68e49a016066725434ca8449347daa7a0b550f58cfa6ce30ca
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.