linux-kernel - Re: [Linux-ima-devel] [RFC PATCH 1/5] ima: extend clone() with IMA namespace support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Jul 2017 07:31:58 -0400
From:   Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:     "Magalhaes, Guilherme (Brazil R&D-CL)" <guilherme.magalhaes@....com>,
        "Serge E. Hallyn" <serge@...lyn.com>
Cc:     Mehmet Kayaalp <mkayaalp@...binghamton.edu>,
        Yuqiong Sun <sunyuqiong1988@...il.com>,
        containers <containers@...ts.linux-foundation.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        David Safford <david.safford@...com>,
        James Bottomley <James.Bottomley@...senPartnership.com>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        ima-devel <linux-ima-devel@...ts.sourceforge.net>,
        Yuqiong Sun <suny@...ibm.com>
Subject: Re: [Linux-ima-devel] [RFC PATCH 1/5] ima: extend clone() with IMA
 namespace support

On Fri, 2017-07-28 at 14:19 +0000, Magalhaes, Guilherme (Brazil R&D-
CL) wrote:
> > > Each measurement entry in the list could have new fields to identify
> > > the namespace. Since the namespaces can be reused, a timestamp or
> > > others fields could be added to uniquely identify the namespace id.
> > 
> > The more fields included in the measurement list, the more
> > measurements will be added to the measurement list.  Wouldn't it be
> > enough to know that a certain file has been accessed/executed on the
> > system and base any analytics/forensics on the IMA-audit data.
> 
> With the recursive application of policy through the namespace hierarchy,
> a measurement added to the parent namespace could be misleading since 
> the file pathname makes sense in the current namespace but possibly not
> for the parent namespace.

Fair enough.

> This is the reason why I believe some new field
> might be needed in the IMA template format to indicate or uniquely 
> identify the namespace.

I would probably include information to uniquely identify the file
(eg. UUID, mountpoint), not the namespace.
 
Mimi