diff for duplicates of <20170623172016.GA19551@mail.hallyn.com> diff --git a/a/1.txt b/N1/1.txt index 91d1c50..5e51d77 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,6 +1,6 @@ -Quoting James Bottomley (James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org): +Quoting James Bottomley (James.Bottomley at HansenPartnership.com): > On Fri, 2017-06-23 at 11:30 -0500, Serge E. Hallyn wrote: -> > Quoting Casey Schaufler (casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org): +> > Quoting Casey Schaufler (casey at schaufler-ca.com): > > > Or maybe just security.ns.capability, taking James' comment into > > > account. > > @@ -28,13 +28,13 @@ it as proper. > with a standard base, each of the files has a security.ima signature. > Now I add my layer, which involves updating a file, so I need to write > a new signature to security.ima. Because I'm running user namespaced, -> the update gets written at security.ima@uid=1000 when I do a docker +> the update gets written at security.ima at uid=1000 when I do a docker > save. > > Now supposing I deploy that image to a cloud. As a tenant, the cloud > gives me real uid 4531 and maps that to root. Execution of the binary > fails because it tries to use the underlying signature (in -> security.ima) as there is no xattr named security.ima@uid=4531 +> security.ima) as there is no xattr named security.ima at uid=4531 In this example, how do you, if you do, shift the owner of the file into the mapped user namespace? Or are you happy to have the file owned @@ -50,3 +50,7 @@ many cases - because you have to shift the uid. However you're doing that, you may be able to shift the xattr the same way. -serge +-- +To unsubscribe from this list: send the line "unsubscribe linux-security-module" in +the body of a message to majordomo at vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/a/content_digest b/N1/content_digest index 5029f22..6109def 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -4,24 +4,15 @@ "ref\0aa62373e-7cd6-39dd-2e38-2b6d6dbe18a8@schaufler-ca.com\0" "ref\020170623163030.GA18820@mail.hallyn.com\0" "ref\01498237641.3641.15.camel@HansenPartnership.com\0" - "ref\01498237641.3641.15.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org\0" - "From\0Serge E. Hallyn <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>\0" - "Subject\0Re: [PATCH 0/3] Enable namespaced file capabilities\0" + "From\0serge@hallyn.com (Serge E. Hallyn)\0" + "Subject\0[PATCH 0/3] Enable namespaced file capabilities\0" "Date\0Fri, 23 Jun 2017 12:20:16 -0500\0" - "To\0James Bottomley <James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>\0" - "Cc\0Mimi Zohar <zohar-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>" - Linux Containers <containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org> - xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org - linux-kernel <linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> - LSM List <linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> - Eric W. Biederman <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> - Casey Schaufler <casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org> - " lkp-JC7UmRfGjtg@public.gmane.org\0" + "To\0linux-security-module@vger.kernel.org\0" "\00:1\0" "b\0" - "Quoting James Bottomley (James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org):\n" + "Quoting James Bottomley (James.Bottomley at HansenPartnership.com):\n" "> On Fri, 2017-06-23 at 11:30 -0500, Serge E. Hallyn wrote:\n" - "> > Quoting Casey Schaufler (casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org):\n" + "> > Quoting Casey Schaufler (casey at schaufler-ca.com):\n" "> > > Or maybe just security.ns.capability, taking James' comment into\n" "> > > account.\n" "> > \n" @@ -49,13 +40,13 @@ "> with a standard base, each of the files has a security.ima signature. \n" "> Now I add my layer, which involves updating a file, so I need to write\n" "> a new signature to security.ima. Because I'm running user namespaced,\n" - "> the update gets written at security.ima@uid=1000 when I do a docker\n" + "> the update gets written at security.ima at uid=1000 when I do a docker\n" "> save. \n" "> \n" "> Now supposing I deploy that image to a cloud. As a tenant, the cloud\n" "> gives me real uid 4531 and maps that to root. Execution of the binary\n" "> fails because it tries to use the underlying signature (in\n" - "> security.ima) as there is no xattr named security.ima@uid=4531\n" + "> security.ima) as there is no xattr named security.ima at uid=4531\n" "\n" "In this example, how do you, if you do, shift the owner of the file\n" "into the mapped user namespace? Or are you happy to have the file owned\n" @@ -70,6 +61,10 @@ "many cases - because you have to shift the uid. However you're doing\n" "that, you may be able to shift the xattr the same way.\n" "\n" - -serge + "-serge\n" + "--\n" + "To unsubscribe from this list: send the line \"unsubscribe linux-security-module\" in\n" + "the body of a message to majordomo at vger.kernel.org\n" + More majordomo info at http://vger.kernel.org/majordomo-info.html -643b73a38f5d05fa72e015684e2112aedfa7ae055f0f384aa18725392b7bdc80 +55387ca3e7330ee0ea6f7431e274372ad1f0e6c8f51ae11cc24adaa40fe8831e
diff --git a/a/1.txt b/N2/1.txt index 91d1c50..f2a5db2 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -1,6 +1,6 @@ -Quoting James Bottomley (James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org): +Quoting James Bottomley (James.Bottomley@HansenPartnership.com): > On Fri, 2017-06-23 at 11:30 -0500, Serge E. Hallyn wrote: -> > Quoting Casey Schaufler (casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org): +> > Quoting Casey Schaufler (casey@schaufler-ca.com): > > > Or maybe just security.ns.capability, taking James' comment into > > > account. > > diff --git a/a/content_digest b/N2/content_digest index 5029f22..3f293cf 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -4,24 +4,29 @@ "ref\0aa62373e-7cd6-39dd-2e38-2b6d6dbe18a8@schaufler-ca.com\0" "ref\020170623163030.GA18820@mail.hallyn.com\0" "ref\01498237641.3641.15.camel@HansenPartnership.com\0" - "ref\01498237641.3641.15.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org\0" - "From\0Serge E. Hallyn <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>\0" + "From\0Serge E. Hallyn <serge@hallyn.com>\0" "Subject\0Re: [PATCH 0/3] Enable namespaced file capabilities\0" "Date\0Fri, 23 Jun 2017 12:20:16 -0500\0" - "To\0James Bottomley <James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>\0" - "Cc\0Mimi Zohar <zohar-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>" - Linux Containers <containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org> - xiaolong.ye-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org - linux-kernel <linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> - LSM List <linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org> - Eric W. Biederman <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> - Casey Schaufler <casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org> - " lkp-JC7UmRfGjtg@public.gmane.org\0" + "To\0James Bottomley <James.Bottomley@hansenpartnership.com>\0" + "Cc\0Serge E. Hallyn <serge@hallyn.com>" + Casey Schaufler <casey@schaufler-ca.com> + Amir Goldstein <amir73il@gmail.com> + Stefan Berger <stefanb@linux.vnet.ibm.com> + Eric W. Biederman <ebiederm@xmission.com> + Linux Containers <containers@lists.linux-foundation.org> + lkp@01.org + xiaolong.ye@intel.com + linux-kernel <linux-kernel@vger.kernel.org> + Mimi Zohar <zohar@linux.vnet.ibm.com> + Tycho Andersen <tycho@docker.com> + christian.brauner@mailbox.org + Vivek Goyal <vgoyal@redhat.com> + " LSM List <linux-security-module@vger.kernel.org>\0" "\00:1\0" "b\0" - "Quoting James Bottomley (James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org):\n" + "Quoting James Bottomley (James.Bottomley@HansenPartnership.com):\n" "> On Fri, 2017-06-23 at 11:30 -0500, Serge E. Hallyn wrote:\n" - "> > Quoting Casey Schaufler (casey-iSGtlc1asvQWG2LlvL+J4A@public.gmane.org):\n" + "> > Quoting Casey Schaufler (casey@schaufler-ca.com):\n" "> > > Or maybe just security.ns.capability, taking James' comment into\n" "> > > account.\n" "> > \n" @@ -72,4 +77,4 @@ "\n" -serge -643b73a38f5d05fa72e015684e2112aedfa7ae055f0f384aa18725392b7bdc80 +cb6732519389f0e1dc323b14f4293a78dab59b7382e4b06aabcb5fee963ad0eb
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.