linux-kernel - Re: [RFC PATCH] ima: differentiate overlay, pivot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6213c2f886637f824b14c67de7f9534349417b49.camel@linux.ibm.com>
Date:   Wed, 10 Nov 2021 12:39:28 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Michael Peters <michael00peters@...il.com>
Cc:     amir73il@...il.com, linux-fsdevel@...r.kernel.org,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-unionfs@...r.kernel.org, miklos@...redi.hu
Subject: Re: [RFC PATCH] ima: differentiate overlay, pivot_root, and other
 pathnames

On Wed, 2021-11-10 at 10:28 -0500, Michael Peters wrote:

> This looks good, but would be even better if the flag that controlled
> this was settable in the ima_policy. That's much easier to work with
> in a lot of DevOps toolchains and pipelines and is similar to how the
> other ima configuration is done.

Thanks, Michael.  Agreed, which is one of the reasons for posting this
patch as an RFC.  The other reason is that it is an incomplete
solution, since it doesn't address mount namespaces.  Any suggestions
for addressing mount namespaces would be appreciated. Assuming there is
a benefit for a partial solution, I'll add the per policy rule support.

thanks,

Mimi