Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751827AbdGYRxO (ORCPT ); Tue, 25 Jul 2017 13:53:14 -0400 Received: from h2.hallyn.com ([78.46.35.8]:53598 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751776AbdGYRxL (ORCPT ); Tue, 25 Jul 2017 13:53:11 -0400 Date: Tue, 25 Jul 2017 12:53:17 -0500 From: "Serge E. Hallyn" To: Mehmet Kayaalp Cc: ima-devel , containers , linux-kernel , linux-security-module , Tycho Andersen , "Serge E . Hallyn" , Yuqiong Sun , David Safford , Mehmet Kayaalp , Stefan Berger , Yuqiong Sun Subject: Re: [RFC PATCH 1/5] ima: extend clone() with IMA namespace support Message-ID: <20170725175317.GA727@mail.hallyn.com> References: <20170720225033.21298-1-mkayaalp@linux.vnet.ibm.com> <20170720225033.21298-2-mkayaalp@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170720225033.21298-2-mkayaalp@linux.vnet.ibm.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 754 Lines: 19 On Thu, Jul 20, 2017 at 06:50:29PM -0400, Mehmet Kayaalp wrote: > From: Yuqiong Sun > > Add new CONFIG_IMA_NS config option. Let clone() create a new IMA > namespace upon CLONE_NEWNS flag. Add ima_ns data structure in nsproxy. > ima_ns is allocated and freed upon IMA namespace creation and exit. > Currently, the ima_ns contains no useful IMA data but only a dummy > interface. This patch creates the framework for namespacing the different > aspects of IMA (eg. IMA-audit, IMA-measurement, IMA-appraisal). > > Signed-off-by: Yuqiong Sun > > Changelog: > * Use CLONE_NEWNS instead of a new CLONE_NEWIMA flag Hi, So this means that every mount namespace clone will clone a new IMA namespace. Is that really ok?