From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6B73C43467 for ; Mon, 19 Oct 2020 09:30:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7E07C22200 for ; Mon, 19 Oct 2020 09:30:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730322AbgJSJab convert rfc822-to-8bit (ORCPT ); Mon, 19 Oct 2020 05:30:31 -0400 Received: from lhrrgout.huawei.com ([185.176.76.210]:2985 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726015AbgJSJab (ORCPT ); Mon, 19 Oct 2020 05:30:31 -0400 Received: from lhreml717-chm.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 4877FC634ACB4260299F; Mon, 19 Oct 2020 10:30:29 +0100 (IST) Received: from fraeml703-chm.china.huawei.com (10.206.15.52) by lhreml717-chm.china.huawei.com (10.201.108.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1913.5; Mon, 19 Oct 2020 10:30:29 +0100 Received: from lhreml722-chm.china.huawei.com (10.201.108.73) by fraeml703-chm.china.huawei.com (10.206.15.52) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1913.5; Mon, 19 Oct 2020 11:30:28 +0200 Received: from lhreml722-chm.china.huawei.com ([10.201.108.73]) by lhreml722-chm.china.huawei.com ([10.201.108.73]) with mapi id 15.01.1913.007; Mon, 19 Oct 2020 10:30:27 +0100 From: Krzysztof Struczynski To: Mimi Zohar CC: Christian Brauner , "linux-integrity@vger.kernel.org" , "Linux Kernel Mailing List" , "containers@lists.linux-foundation.org" , "linux-security-module@vger.kernel.org" , "stefanb@linux.vnet.ibm.com" , "sunyuqiong1988@gmail.com" , "mkayaalp@cs.binghamton.edu" , "dmitry.kasatkin@gmail.com" , "Serge E. Hallyn" , "James Morris" , "christian@brauner.io" , Silviu Vlasceanu , Roberto Sassu , "ebiederm@xmission.com" , "viro@zeniv.linux.org.uk" , "torvalds@linux-foundation.org" , "luto@amacapital.net" , "jannh@google.com" , "nick.dusek@gmail.com" , "Dr. Greg" , Luke Hinds Subject: RE: [RFC PATCH 00/30] ima: Introduce IMA namespace Thread-Topic: [RFC PATCH 00/30] ima: Introduce IMA namespace Thread-Index: AQHWdXPBkpeRDLdh20+fyp1BiEOjYak+A3mAgBfGuwCABhxpgIABN8iAgAG3kgCACVyMsIA21JGg Date: Mon, 19 Oct 2020 09:30:27 +0000 Message-ID: References: <20200818152037.11869-1-krzysztof.struczynski@huawei.com> <20200818164943.va3um7toztazcfud@wittgenstein> <20200906171413.GA8305@wind.enjellic.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.48.222.63] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 X-CFilter-Loop: Reflected Precedence: bulk List-ID: > From: Krzysztof Struczynski > Sent: Monday, September 14, 2020 2:08 PM > > When Roberto Sassu and Krzysztof Struczynski contacted me about the > > status of Stefan Berger's patch set, based on Yuqiong Sun's work, I was > > under the impression that they would be rebasing it on the latest > > kernel and going forward from there. Obviously things changed. I > > pointed out to them resolving the "IMA namespacing" issue would be the > > first thing that needs to be addressed. So here we are. > > > > The concept of the IMA namespace as a separate namespace, not attached to > the user or mount namespace, remains the same as in the last set of > Stefan's patches. The creation and configuration mechanism changed, > partially because of the changes in the upstream kernel like extension of > the CLONE_ flags, that facilitated other solutions. The main inspiration > in this regard was the new time namespace. > > The implemented mechanism is intended to make the configuration of the > IMA > namespace as similar as possible to the upstream IMA implementation and > allows to configure the new IMA namespace before any process enters that > namespace, so the very first actions can be measured/appraised/audited. > > In this implementation many design points formulated by Stefan still stand. > The significant difference in the presented design is the threat model. > The actions of the host's root and any other user within the container are > measured/appraised/audited according to the container's policy. However, > every action that affects objects in the root namespace, is detected when > processes from the root namespace access them. Do you think that the above proposal addresses the aforementioned "IMA namespacing" issue? If it doesn't, would you please clarify what are the main, outstanding problems? > > Definitely, let's have this discussion. Shall we continue the discussion here, or in addition use a format similar to the Stefan's "drawing board": https://kernsec.org/wiki/index.php/IMA_Namespacing_design_considerations Best regards, Krzysztof Struczynski