RE: [RFC PATCH 00/30] ima: Introduce IMA namespace

From: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: "mkayaalp@cs.binghamton.edu" <mkayaalp@cs.binghamton.edu>,
	"sunyuqiong1988@gmail.com" <sunyuqiong1988@gmail.com>,
	Silviu Vlasceanu <Silviu.Vlasceanu@huawei.com>,
	"nick.dusek@gmail.com" <nick.dusek@gmail.com>,
	"Dr. Greg" <greg@enjellic.com>,
	"jannh@google.com" <jannh@google.com>,
	Luke Hinds <lhinds@redhat.com>,
	"viro@zeniv.linux.org.uk" <viro@zeniv.linux.org.uk>,
	"christian@brauner.io" <christian@brauner.io>,
	"dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
	"containers@lists.linux-foundation.org"
	<containers@lists.linux-foundation.org>,
	Roberto Sassu <roberto.sassu@huawei.com>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	"luto@amacapital.net" <luto@amacapital.net>,
	"linux-security-module@vger.kernel.org"
	<linux-security-module@vger.kernel.org>,
	"ebiederm@xmission.com" <ebiederm@xmission.com>,
	"linux-integrity@vger.kernel.org"
	<linux-integrity@vger.kernel.org>,
	"torvalds@linux-foundation.org" <torvalds@linux-foundation.org>
Subject: RE: [RFC PATCH 00/30] ima: Introduce IMA namespace
Date: Mon, 19 Oct 2020 09:30:27 +0000	[thread overview]
Message-ID: <a75a6541991d4f8dbaa30e0af517b829@huawei.com> (raw)
In-Reply-To: d405bab0d262b32fd16e85444791b6c49d820aa2.camel@linux.ibm.com

> From: Krzysztof Struczynski
> Sent: Monday, September 14, 2020 2:08 PM
> > When Roberto Sassu and Krzysztof Struczynski contacted me about the
> > status of Stefan Berger's patch set, based on Yuqiong Sun's work, I was
> > under the impression that they would be rebasing it on the latest
> > kernel and going forward from there.   Obviously things changed.  I
> > pointed out to them resolving the "IMA namespacing" issue would be the
> > first thing that needs to be addressed.  So here we are.
> >
> 
> The concept of the IMA namespace as a separate namespace, not attached to
> the user or mount namespace, remains the same as in the last set of
> Stefan's patches. The creation and configuration mechanism changed,
> partially because of the changes in the upstream kernel like extension of
> the CLONE_ flags, that facilitated other solutions. The main inspiration
> in this regard was the new time namespace.
> 
> The implemented mechanism is intended to make the configuration of the
> IMA
> namespace as similar as possible to the upstream IMA implementation and
> allows to configure the new IMA namespace before any process enters that
> namespace, so the very first actions can be measured/appraised/audited.
> 
> In this implementation many design points formulated by Stefan still stand.
> The significant difference in the presented design is the threat model.
> The actions of the host's root and any other user within the container are
> measured/appraised/audited according to the container's policy. However,
> every action that affects objects in the root namespace, is detected when
> processes from the root namespace access them.

Do you think that the above proposal addresses the aforementioned "IMA
namespacing" issue? If it doesn't, would you please clarify what are the
main, outstanding problems?

> > Definitely, let's have this discussion.

Shall we continue the discussion here, or in addition use a format similar
to the Stefan's "drawing board":
https://kernsec.org/wiki/index.php/IMA_Namespacing_design_considerations

Best regards,
Krzysztof Struczynski
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers