Re: [RFC PATCH 00/30] ima: Introduce IMA namespace

From: Mimi Zohar <zohar@linux.ibm.com>
To: Luke Hinds <lhinds@redhat.com>, "Dr. Greg" <greg@enjellic.com>
Cc: mkayaalp@cs.binghamton.edu, nick.dusek@gmail.com,
	sunyuqiong1988@gmail.com, containers@lists.linux-foundation.org,
	jannh@google.com, roberto.sassu@huawei.com,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	viro@zeniv.linux.org.uk, krzysztof.struczynski@huawei.com,
	linux-security-module@vger.kernel.org,
	silviu.vlasceanu@huawei.com, ebiederm@xmission.com,
	dmitry.kasatkin@gmail.com, luto@amacapital.net,
	Christian Brauner <christian.brauner@ubuntu.com>,
	torvalds@linux-foundation.org, linux-integrity@vger.kernel.org
Subject: Re: [RFC PATCH 00/30] ima: Introduce IMA namespace
Date: Tue, 08 Sep 2020 10:03:24 -0400	[thread overview]
Message-ID: <d405bab0d262b32fd16e85444791b6c49d820aa2.camel@linux.ibm.com> (raw)
In-Reply-To: <CAKrSGQR3Pw=Rad2RgUuCHqr0r2Nc6x2nLoo2cVAkD+_8Vbmd7A@mail.gmail.com>

On Mon, 2020-09-07 at 12:50 +0100, Luke Hinds wrote:
> > Candidly, given the politics of security technology being viewed as
> > 'constraining' user rights, I think that a lot of forthcoming security
> > technology may end up being out of tree moving forward.
> > 
> 
> I think it's prudent to look forward and plan diligently, but I would
> not want perfect to be the enemy of good.

Agreed.  This isn't an abstract problem, but one that has already come
up and, hopefully, has been addressed appropriately.

> 
> I approach this more from a user's perspective. We are using IMA in 
> https://keylime.dev to measure a host and would like to measure
> within a container too. It's the most common request we hear from our
> users.
> 
> Perhaps we all collaborate on a proposal extending Stefans work here:
> https://kernsec.org/wiki/index.php/IMA_Namespacing_design_considerati
> ons
> 
> I have seen around 3-4 patches now get submitted, so work has been
> done before, and as above, users are present too. We could then have
> some consensus on how this should look and later patches might have
> more success at landing.
> 
> Would anyone be interested in this and have recommendations on how we
> could approach this?

When Roberto Sassu and Krzysztof Struczynski contacted me about the
status of Stefan Berger's patch set, based on Yuqiong Sun's work, I was
under the impression that they would be rebasing it on the latest
kernel and going forward from there.   Obviously things changed.  I
pointed out to them resolving the "IMA namespacing" issue would be the
first thing that needs to be addressed.  So here we are.

Definitely, let's have this discussion.

Mimi

_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers