[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0303c534-d54b-d032-88a6-11e1fe13748f@linux.ibm.com>
Date: Wed, 1 Dec 2021 19:02:42 -0500
From: Stefan Berger <stefanb@...ux.ibm.com>
To: jejb@...ux.ibm.com, linux-integrity@...r.kernel.org
Cc: zohar@...ux.ibm.com, serge@...lyn.com,
christian.brauner@...ntu.com, containers@...ts.linux.dev,
dmitry.kasatkin@...il.com, ebiederm@...ssion.com,
krzysztof.struczynski@...wei.com, roberto.sassu@...wei.com,
mpeters@...hat.com, lhinds@...hat.com, lsturman@...hat.com,
puiterwi@...hat.com, jamjoom@...ibm.com,
linux-kernel@...r.kernel.org, paul@...l-moore.com, rgb@...hat.com,
linux-security-module@...r.kernel.org, jmorris@...ei.org
Subject: Re: [RFC 20/20] ima: Setup securityfs_ns for IMA namespace
On 12/1/21 17:19, James Bottomley wrote:
> On Wed, 2021-12-01 at 17:09 -0500, Stefan Berger wrote:
>> On 12/1/21 17:01, James Bottomley wrote:
>>
>>
>>
>>> I don't see this because my setup for everything is triggered off
>>> the first use of the IMA namespace. You'd need to have some type
>>> of lazy setup of the inodes as well to give unshare time to install
>>> the uid/gidmappings.
>> What could trigger that? A callback while mounting - but I am not
>> sure where to hook into then. What is your mechanisms to trigger as
>> the 'first use of the IMA namespace'? What is 'use' here?
> use for me is first event that gets logged in the new namespace.
>
> However, I don't think this is a good trigger, it's just a random thing
> I was playing with. Perhaps trigger on mount is a good one ... that
> could be done from securityfs_ns_init_fs_context?
Yes, this here does the trick now for late init also with runc. The late
uid adjustments are gone.
static int securityfs_ns_init_fs_context(struct fs_context *fc)
{
int rc;
if (fc->user_ns->ima_ns->late_fs_init) {
rc = fc->user_ns->ima_ns->late_fs_init(fc->user_ns);
if (rc)
return rc;
}
fc->ops = &securityfs_ns_context_ops;
return 0;
}
Stefan
>
> James
>
>
>
>
Powered by blists - more mailing lists