Message-ID: <0c95df54-cac0-6fb6-a3f0-94583d886a76@linux.ibm.com>
Date:   Sat, 11 Dec 2021 17:33:42 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.0
Subject: Re: [PATCH v6 14/17] ima: Tie opened SecurityFS files to the IMA
 namespace it belongs to
Content-Language: en-US
To:     Christian Brauner <christian.brauner@ubuntu.com>
Cc:     linux-integrity@vger.kernel.org, zohar@linux.ibm.com,
        serge@hallyn.com, containers@lists.linux.dev,
        dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
        krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
        mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
        puiterwi@redhat.com, jejb@linux.ibm.com, jamjoom@us.ibm.com,
        linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com,
        linux-security-module@vger.kernel.org, jmorris@namei.org
References: <20211210194736.1538863-1-stefanb@linux.ibm.com>
 <20211210194736.1538863-15-stefanb@linux.ibm.com>
 <20211211110038.dbshu23uvlhv65vn@wittgenstein>
From:   Stefan Berger <stefanb@linux.ibm.com>
In-Reply-To: <20211211110038.dbshu23uvlhv65vn@wittgenstein>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk


On 12/11/21 06:00, Christian Brauner wrote:
> On Fri, Dec 10, 2021 at 02:47:33PM -0500, Stefan Berger wrote:
>> Tie IMA's files in SecurityFS to the IMA namespace they belong to so that
>> also file descriptor that were passed or inherited to other user/IMA
>> namespaces will always access the data of the IMA namespace they originally
>> belonged to.
>>
>> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
>> ---
>>   security/integrity/ima/ima_fs.c     | 74 ++++++++++++++++++++++++-----
>>   security/integrity/ima/ima_policy.c |  4 +-
>>   2 files changed, 63 insertions(+), 15 deletions(-)
>>
>> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
>> index 0e582ceecc7f..a136d14f29ec 100644
>> --- a/security/integrity/ima/ima_fs.c
>> +++ b/security/integrity/ima/ima_fs.c
>> @@ -35,6 +35,20 @@ static int __init default_canonical_fmt_setup(char *str)
>>   }
>>   __setup("ima_canonical_fmt", default_canonical_fmt_setup);
>>   
>> +static inline struct user_namespace *ima_user_ns_from_file(struct file *filp)
>> +{
>> +	return filp->f_path.mnt->mnt_sb->s_user_ns;
>> +}
> I'd probably rewrite this as:
>
> static inline struct user_namespace *ima_user_ns_from_file(const struct file *filp)
> {
> 	return file_inode(filp)->i_sb->s_user_ns;
> }
>
> as it spares you some pointer chasing and also looks cleaner.

Ok. This patch is being absorbed by all the functions currently using 
get_current_ns() and should access it via the file instead.

    Stefan