linux-kernel - Re: [PATCH v5 14/16] ima: Use mac_admin_ns_capable() to check corresponding capability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e285cfdc3f6380c7ca5f6e22378ba8343bedf622.camel@linux.ibm.com>
Date:   Thu, 09 Dec 2021 08:23:35 -0500
From:   James Bottomley <jejb@...ux.ibm.com>
To:     Denis Semakin <denis.semakin@...wei.com>,
        Stefan Berger <stefanb@...ux.ibm.com>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>
Cc:     "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
        "serge@...lyn.com" <serge@...lyn.com>,
        "christian.brauner@...ntu.com" <christian.brauner@...ntu.com>,
        "containers@...ts.linux.dev" <containers@...ts.linux.dev>,
        "dmitry.kasatkin@...il.com" <dmitry.kasatkin@...il.com>,
        "ebiederm@...ssion.com" <ebiederm@...ssion.com>,
        Krzysztof Struczynski <krzysztof.struczynski@...wei.com>,
        Roberto Sassu <roberto.sassu@...wei.com>,
        "mpeters@...hat.com" <mpeters@...hat.com>,
        "lhinds@...hat.com" <lhinds@...hat.com>,
        "lsturman@...hat.com" <lsturman@...hat.com>,
        "puiterwi@...hat.com" <puiterwi@...hat.com>,
        "jamjoom@...ibm.com" <jamjoom@...ibm.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "paul@...l-moore.com" <paul@...l-moore.com>,
        "rgb@...hat.com" <rgb@...hat.com>,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "jmorris@...ei.org" <jmorris@...ei.org>
Subject: Re: [PATCH v5 14/16] ima: Use mac_admin_ns_capable() to check
 corresponding capability

On Thu, 2021-12-09 at 07:22 +0000, Denis Semakin wrote:
> Hi. 
> My question won't be about capabilities. I'm wondering how IMA-ns
> which is associated with USER-ns and is created during USER-ns
> creation would be used by some namespaces orchestration systems, e.g.
> Kubernetes?

Orchestration systems that don't adopt the user namespace can't really
run containers requiring admin correctly without giving them root minus
some capabilities, which is rather unsafe, so the expectation is that
they'll all figure it out eventually for security reasons.

> .. It seems that it can be run without any user namespaces... 
> Their community just discuss this opportunity to support User
> namespaces. (see https://github.com/kubernetes/enhancements/pull/2101
> ) Looks like currently IMA-ns will not be applicable for Kubernetes.

Well, lets just say it adds one more reason to get kubernetes to
finally run rootless privileged containers correctly ...

James