Message-ID: <b285b0d4-e615-bea4-f22f-09d83f8f8edb@linux.ibm.com>
Date:   Fri, 3 Dec 2021 19:33:39 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [RFC v2 19/19] ima: Setup securityfs for IMA namespace
Content-Language: en-US
From:   Stefan Berger <stefanb@linux.ibm.com>
To:     jejb@linux.ibm.com, linux-integrity@vger.kernel.org
Cc:     zohar@linux.ibm.com, serge@hallyn.com,
        christian.brauner@ubuntu.com, containers@lists.linux.dev,
        dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
        krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
        mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
        puiterwi@redhat.com, jamjoom@us.ibm.com,
        linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com,
        linux-security-module@vger.kernel.org, jmorris@namei.org
References: <20211203023118.1447229-1-stefanb@linux.ibm.com>
 <20211203023118.1447229-20-stefanb@linux.ibm.com>
 <df433bc52ca1e0408d48bbace4c34a573991f5ba.camel@linux.ibm.com>
 <6306b4e5-f26d-1704-6344-354eb5387abf@linux.ibm.com>
 <11b557b58de74828b1c16334a5fb52c4d3f6ad0f.camel@linux.ibm.com>
 <cd05433a-3630-e7f5-e144-ff766d7792fa@linux.ibm.com>
In-Reply-To: <cd05433a-3630-e7f5-e144-ff766d7792fa@linux.ibm.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Precedence: bulk


On 12/3/21 14:11, Stefan Berger wrote:
>
> On 12/3/21 13:50, James Bottomley wrote:
>
>
>>
>>> Where would the vfsmount pointer reside? For now it's in
>>> ima_namespace, but it sounds like it should be in a more centralized
>>> place? Should it also be  connected to the user_namespace so we can
>>> pick it up using get_user_ns()?
>> exactly.  I think struct user_namespace should have two elements gated
>> by a #ifdef CONFIG_SECURITYFS which are the vfsmount and the
>> mount_count for passing into simple_pin_fs.
>
> Also that we can do for as long as it flies beyond the conversation 
> here... :-) Anyone else have an opinion ?

I moved it now and this greatly reduced the amount of changes. The 
dentries are now all in the ima_namespace and it works with one API. Thanks!

I wonder whether to move the integrity dir also into the ima_namespace. 
It's generated in integrity/iint.c, so not in the IMA territory... For 
the IMA namespacing case I need to create it as well, though.

https://elixir.bootlin.com/linux/latest/source/security/integrity/iint.c#L218

    Stefan