Message-ID: <0303c534-d54b-d032-88a6-11e1fe13748f@linux.ibm.com>
Date:   Wed, 1 Dec 2021 19:02:42 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [RFC 20/20] ima: Setup securityfs_ns for IMA namespace
Content-Language: en-US
To:     jejb@linux.ibm.com, linux-integrity@vger.kernel.org
Cc:     zohar@linux.ibm.com, serge@hallyn.com,
        christian.brauner@ubuntu.com, containers@lists.linux.dev,
        dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
        krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
        mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
        puiterwi@redhat.com, jamjoom@us.ibm.com,
        linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com,
        linux-security-module@vger.kernel.org, jmorris@namei.org
References: <20211130160654.1418231-1-stefanb@linux.ibm.com>
 <20211130160654.1418231-21-stefanb@linux.ibm.com>
 <6599ac61289e3316bff53602a0bc5970133251aa.camel@linux.ibm.com>
 <f2113d60-49d3-2e2d-7dbe-b831035f96a1@linux.ibm.com>
 <f5e3101e8dee2aa0064e7b68992afe0143e22058.camel@linux.ibm.com>
 <9631d4b3-15f6-46f1-6441-98c1192be6b4@linux.ibm.com>
 <c6d7b9363991b80b2f55bbdb7e44c18ea45489da.camel@linux.ibm.com>
 <8d7b6d47-9001-1f47-bce8-e7fae28fafcf@linux.ibm.com>
 <38458eee904713824b85a2dcef248e752634f67c.camel@linux.ibm.com>
 <b8c21064-05f3-91a9-d23c-0417f046f4cc@linux.ibm.com>
 <29770c86261bbc7f6380c7c355ecb6a1c9f40980.camel@linux.ibm.com>
From:   Stefan Berger <stefanb@linux.ibm.com>
In-Reply-To: <29770c86261bbc7f6380c7c355ecb6a1c9f40980.camel@linux.ibm.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk


On 12/1/21 17:19, James Bottomley wrote:
> On Wed, 2021-12-01 at 17:09 -0500, Stefan Berger wrote:
>> On 12/1/21 17:01, James Bottomley wrote:
>>
>>
>>
>>> I don't see this because my setup for everything is triggered off
>>> the first use of the IMA namespace.  You'd need to have some type
>>> of lazy setup of the inodes as well to give unshare time to install
>>> the uid/gidmappings.
>> What could trigger that? A callback while mounting - but I am not
>> sure where to hook into then. What is your mechanisms to trigger as
>> the 'first use of the IMA namespace'? What is 'use' here?
> use for me is first event that gets logged in the new namespace.
>
> However, I don't think this is a good trigger, it's just a random thing
> I was playing with.  Perhaps trigger on mount is a good one ... that
> could be done from securityfs_ns_init_fs_context?

Yes, this here does the trick now for late init also with runc. The late 
uid adjustments are gone.

static int securityfs_ns_init_fs_context(struct fs_context *fc)
{
         int rc;

         if (fc->user_ns->ima_ns->late_fs_init) {
                 rc = fc->user_ns->ima_ns->late_fs_init(fc->user_ns);
                 if (rc)
                         return rc;
         }
         fc->ops = &securityfs_ns_context_ops;
         return 0;
}


    Stefan


>
> James
>
>
>
>