Message-ID: <1500058362.2853.28.camel@HansenPartnership.com>
Subject: Re: [PATCH v2] xattr: Enable security.capability in user namespaces
From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Stefan Berger <stefanb@linux.vnet.ibm.com>,
        Mimi Zohar <zohar@us.ibm.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
        "Theodore Ts'o" <tytso@mit.edu>, containers@lists.linux-foundation.org,
        lkp@01.org, linux-kernel@vger.kernel.org, tycho@docker.com,
        vgoyal@redhat.com, christian.brauner@mailbox.org, amir73il@gmail.com,
        linux-security-module@vger.kernel.org, casey@schaufler-ca.com
Date: Fri, 14 Jul 2017 11:52:42 -0700
In-Reply-To: <1500058090.3583.28.camel@linux.vnet.ibm.com>
References: <87y3rscz9j.fsf@xmission.com>
         <20170713164012.brj2flnkaaks2oci@thunk.org> <87k23cb6os.fsf@xmission.com>
         <847ccb2a-30c0-a94c-df6f-091c8901eaa0@linux.vnet.ibm.com>
         <87bmoo8bxb.fsf@xmission.com>
         <9a3010e5-ca2b-5e7a-656b-fcc14f7bec4e@linux.vnet.ibm.com>
         <87h8yf7szd.fsf@xmission.com>
         <65dbe654-0d99-03fa-c838-5a726b462826@linux.vnet.ibm.com>
         <20170714133437.GA16737@mail.hallyn.com>
         <596f808b-e21d-8296-5fef-23c1ce7ab778@linux.vnet.ibm.com>
         <20170714173556.GA19669@mail.hallyn.com>
         <1500058090.3583.28.camel@linux.vnet.ibm.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1070
Lines: 19

On Fri, 2017-07-14 at 14:48 -0400, Mimi Zohar wrote:
> The concern is with a shared filesystems.  In that case, for IMA it
> would make sense to support a native and a namespace xattr.  If due
> to xattr space limitations we have to limit the number of xattrs,
> then we should limit it to two - a native and a namespace version,
> with a "uid=" tag - first namespace gets permission to write the
> namespace xattr.  Again, like in the layered case, if the namespace
> xattr doesn't exist, fall back to using the native xattr.

Just on this point: if we're really concerned about the need on shared
filesystems to have multiple IMA signatures per file, might it not make
sense simply to support multiple signatures within the security.ima
xattr? The rules for writing signature updates within user namespaces
would be somewhat complex (say only able to replace a signature for
which you demonstrate you possess the key) but it would lead to an
implementation which would work for traditional shared filesystems
(like NFS) as well as containerised bind mounts.

James