linux-kernel - Re: [RFC PATCH 00/30] ima: Introduce IMA namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <d405bab0d262b32fd16e85444791b6c49d820aa2.camel@linux.ibm.com>
Date:   Tue, 08 Sep 2020 10:03:24 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Luke Hinds <lhinds@...hat.com>, "Dr. Greg" <greg@...ellic.com>
Cc:     Christian Brauner <christian.brauner@...ntu.com>,
        krzysztof.struczynski@...wei.com, linux-integrity@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        containers@...ts.linux-foundation.org,
        linux-security-module@...r.kernel.org, stefanb@...ux.vnet.ibm.com,
        sunyuqiong1988@...il.com, mkayaalp@...binghamton.edu,
        dmitry.kasatkin@...il.com, "Serge E. Hallyn" <serge@...lyn.com>,
        James Morris <jmorris@...ei.org>, christian@...uner.io,
        silviu.vlasceanu@...wei.com, roberto.sassu@...wei.com,
        ebiederm@...ssion.com, viro@...iv.linux.org.uk,
        torvalds@...ux-foundation.org, luto@...capital.net,
        jannh@...gle.com, nick.dusek@...il.com
Subject: Re: [RFC PATCH 00/30] ima: Introduce IMA namespace

On Mon, 2020-09-07 at 12:50 +0100, Luke Hinds wrote:
> > Candidly, given the politics of security technology being viewed as
> > 'constraining' user rights, I think that a lot of forthcoming security
> > technology may end up being out of tree moving forward.
> > 
> 
> I think it's prudent to look forward and plan diligently, but I would
> not want perfect to be the enemy of good.

Agreed.  This isn't an abstract problem, but one that has already come
up and, hopefully, has been addressed appropriately.

> 
> I approach this more from a user's perspective. We are using IMA in 
> https://keylime.dev to measure a host and would like to measure
> within a container too. It's the most common request we hear from our
> users.
> 
> Perhaps we all collaborate on a proposal extending Stefans work here:
> https://kernsec.org/wiki/index.php/IMA_Namespacing_design_considerati
> ons
> 
> I have seen around 3-4 patches now get submitted, so work has been
> done before, and as above, users are present too. We could then have
> some consensus on how this should look and later patches might have
> more success at landing.
> 
> Would anyone be interested in this and have recommendations on how we
> could approach this?

When Roberto Sassu and Krzysztof Struczynski contacted me about the
status of Stefan Berger's patch set, based on Yuqiong Sun's work, I was
under the impression that they would be rebasing it on the latest
kernel and going forward from there.   Obviously things changed.  I
pointed out to them resolving the "IMA namespacing" issue would be the
first thing that needs to be addressed.  So here we are.

Definitely, let's have this discussion.

Mimi