Subject: Re: [PATCH v2] xattr: Enable security.capability in user namespaces
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: "Theodore Ts'o" <tytso@mit.edu>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
        Stefan Berger <stefanb@linux.vnet.ibm.com>,
        Mimi Zohar <zohar@us.ibm.com>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        containers@lists.linux-foundation.org, lkp@01.org,
        linux-kernel@vger.kernel.org, tycho@docker.com,
        James.Bottomley@HansenPartnership.com, vgoyal@redhat.com,
        christian.brauner@mailbox.org, amir73il@gmail.com,
        linux-security-module@vger.kernel.org, casey@schaufler-ca.com
Date: Fri, 14 Jul 2017 15:43:46 -0400
In-Reply-To: <20170714192909.zoxnlm32nrxguqao@thunk.org>
References: <87k23cb6os.fsf@xmission.com>
         <847ccb2a-30c0-a94c-df6f-091c8901eaa0@linux.vnet.ibm.com>
         <87bmoo8bxb.fsf@xmission.com>
         <9a3010e5-ca2b-5e7a-656b-fcc14f7bec4e@linux.vnet.ibm.com>
         <87h8yf7szd.fsf@xmission.com>
         <65dbe654-0d99-03fa-c838-5a726b462826@linux.vnet.ibm.com>
         <20170714133437.GA16737@mail.hallyn.com>
         <596f808b-e21d-8296-5fef-23c1ce7ab778@linux.vnet.ibm.com>
         <20170714173556.GA19669@mail.hallyn.com>
         <1500058090.3583.28.camel@linux.vnet.ibm.com>
         <20170714192909.zoxnlm32nrxguqao@thunk.org>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1500061426.3583.65.camel@linux.vnet.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1106
Lines: 22

On Fri, 2017-07-14 at 15:29 -0400, Theodore Ts'o wrote:
> On Fri, Jul 14, 2017 at 02:48:10PM -0400, Mimi Zohar wrote:
> > 
> > If I'm understanding the discussion correctly, this isn't an issue for
> > layered copy on write filesystems, as each fs layer could have it's
> > own set of xattrs.  The underlying and layered xattrs should be able
> > to co-exist.  Use the layered xattr if it exists, but fall back to
> > using the underlying xattr if it doesn't.
> 
> Note that this assumes that it is possible to "copy up" the xattrs
> without necessarily "copying up" all of the data blocks.  This might
> be true for some layers, but I don't believe it is currently true for
> overlayfs, for example.

Ok, so for the use case scneario where the container owner is willing
to use the public key distributed with the files, then only those
files that are new or modified in the overlay would need to be signed
with a key local to the overlay.  In the worst case scenario, where
the container owner is only willing to trust their own public key, I
guess we can live with having to copy up the files.

Mimi