Received: by 2002:a05:6a10:7420:0:0:0:0 with SMTP id hk32csp1128335pxb; Wed, 16 Feb 2022 11:38:43 -0800 (PST) X-Google-Smtp-Source: ABdhPJxJBaGJnlu3ojO6HiRnZa2yjQDpaNJEpLRAQYIKAvgRdRT/gHLDJrrTsFMevfh9tfHUcOA8 X-Received: by 2002:a17:90a:f409:b0:1b8:b6fe:5adf with SMTP id ch9-20020a17090af40900b001b8b6fe5adfmr3455972pjb.49.1645040322854; Wed, 16 Feb 2022 11:38:42 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1645040322; cv=none; d=google.com; s=arc-20160816; b=F8/SEYnBoc1n9+VAaWUgS6OKBmPKjNQapy5hk8ZoeWoFlQ7XmtkhWoQ9+EUqKCpHB9 UG1Hd6ZuEXxXka9eyPUZU1+z2gV+ZiWxp4iRt0PBxGsP3J3Mib519LBDchox7l8X534j j0NtXAPOoDiwLjuUD2BJxLDCWQQL2MPsvemwPX7IAsTgwrG9KQC58jAkWmMC+JoZOCUg KQmua1VIn/FsiYoJu5X1ix/DUgpdty3jTUWKNAGJHxCEfr5KFxy/QirVGEhgYblgLY5F rxsY9yu3ITD3b4HrxpOj2A0f0xzQemCfLTYiKFt4WhMyJarKEw7tGgxy9IBwGKGV47Jh LEeg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:date:cc:to:from:subject:message-id :dkim-signature; bh=QFAT4gUY7ssHFMRKnYKL1cpcMiUM8TBsa2LK3fdhHW0=; b=lkpHRJfemWQHqH2+HP/0jze5Y6N0Fb4Y41uzCWLue2cJJP83gskcDe95JeOkCnLcY8 2dTKxH/T9jby6Q+BZBEQ07sYpTZw8eC2DLqfaxujfVRNV4eZFR6J3RYCk2nxVplKsK+X ti8G2/5TxCBYaMOGt8RrmtGvaLxjx8Nebp/S0cliXh8SeIuC39Cr3rwA9j4M8zUJxIQj VhpexZ+fcgmZcTmyge1/LdijWnIHiBB6q6fsS/ia/99T+5ShcKJcVsocbsvnQ4mEk5QN oRcmxUY9rcE51yJQt5OGodT5pQ7FQr78vIlFUszsNigrt4VuBc0ISgTYKHW9AwoN9ytZ YJoQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=CHsh3LQs; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id k15si19119615plg.565.2022.02.16.11.38.25; Wed, 16 Feb 2022 11:38:42 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=CHsh3LQs; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236600AbiBPQk5 (ORCPT + 99 others); Wed, 16 Feb 2022 11:40:57 -0500 Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:42272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236639AbiBPQkU (ORCPT ); Wed, 16 Feb 2022 11:40:20 -0500 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C44725DA68; Wed, 16 Feb 2022 08:40:06 -0800 (PST) Received: from pps.filterd (m0098416.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 21GGGPjU024471; Wed, 16 Feb 2022 16:39:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=message-id : subject : from : to : cc : date : in-reply-to : references : content-type : mime-version : content-transfer-encoding; s=pp1; bh=QFAT4gUY7ssHFMRKnYKL1cpcMiUM8TBsa2LK3fdhHW0=; b=CHsh3LQsQlw+AlPF9ZzINxswwd+y6vEDqWW8ApcopHUcmtHE96zS0EBj/kBQ6vgEgPJe 45LERF2kn+i9i5yxZ9qweO+h/r1W0PCZSAFzNROIADPRPa6PQFz6iilDQLc2HxYK8VOo 5+TUcnWvyHuciBZWBhNoU/Rfz0OtoFUB5qYy9kKB/oEG4lklVA/q6z+OVpaiWCFfM4+f YOlGeZvApqVEjyKl4u7n/44wulVS6MufE1ruR298tspmQc8CEaRJPB/XPRvjpXQLLSxW 43ClWHUdbHD9vwRUZMu4QpozHgDxqU+opANhFcmmhYNI+k1VvA5IgIu5X6k1Cz8fa7v+ RA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 3e94n48j4c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Feb 2022 16:39:48 +0000 Received: from m0098416.ppops.net (m0098416.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 21GGH85m029532; Wed, 16 Feb 2022 16:39:48 GMT Received: from ppma02fra.de.ibm.com (47.49.7a9f.ip4.static.sl-reverse.com [159.122.73.71]) by mx0b-001b2d01.pphosted.com with ESMTP id 3e94n48j3q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Feb 2022 16:39:47 +0000 Received: from pps.filterd (ppma02fra.de.ibm.com [127.0.0.1]) by ppma02fra.de.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 21GGWu3o022678; Wed, 16 Feb 2022 16:39:46 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma02fra.de.ibm.com with ESMTP id 3e64ha0y3b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 16 Feb 2022 16:39:45 +0000 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 21GGdgwK43385098 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 16 Feb 2022 16:39:42 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B9DA111C064; Wed, 16 Feb 2022 16:39:42 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5B39011C052; Wed, 16 Feb 2022 16:39:40 +0000 (GMT) Received: from sig-9-65-87-58.ibm.com (unknown [9.65.87.58]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Wed, 16 Feb 2022 16:39:40 +0000 (GMT) Message-ID: Subject: Re: [PATCH v10 06/27] ima: Move arch_policy_entry into ima_namespace From: Mimi Zohar To: Stefan Berger , linux-integrity@vger.kernel.org Cc: serge@hallyn.com, christian.brauner@ubuntu.com, containers@lists.linux.dev, dmitry.kasatkin@gmail.com, ebiederm@xmission.com, krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com, mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com, puiterwi@redhat.com, jejb@linux.ibm.com, jamjoom@us.ibm.com, linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com, linux-security-module@vger.kernel.org, jmorris@namei.org, Christian Brauner Date: Wed, 16 Feb 2022 11:39:39 -0500 In-Reply-To: <20220201203735.164593-7-stefanb@linux.ibm.com> References: <20220201203735.164593-1-stefanb@linux.ibm.com> <20220201203735.164593-7-stefanb@linux.ibm.com> Content-Type: text/plain; charset="ISO-8859-15" X-Mailer: Evolution 3.28.5 (3.28.5-18.el8) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: _kEptbkdhmHsaVrTiedogSKaxYCKIJe9 X-Proofpoint-GUID: Pv9Dws_nJSQV-4Gm67F5Ftf7QF_YBqX_ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.816,Hydra:6.0.425,FMLib:17.11.62.513 definitions=2022-02-16_07,2022-02-16_01,2021-12-02_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 mlxlogscore=986 suspectscore=0 phishscore=0 clxscore=1015 bulkscore=0 lowpriorityscore=0 priorityscore=1501 impostorscore=0 spamscore=0 adultscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2202160097 X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 2022-02-01 at 15:37 -0500, Stefan Berger wrote Let's update the patch description providing a bit more background info: The archictecture specific policy rules, currently defined for EFI and powerpc, require the kexec kernel image and kernel modules to be validly signed and measured, based on the system's secure boot and/or trusted boot mode and the IMA_ARCH_POLICY Kconfig option being enabled. > Move the arch_policy_entry pointer into ima_namespace. Perhaps include something about namespaces being allowed or not allowed to kexec a new kernel or load kernel modules. thanks, Mimi > > When freeing the memory set the pointer to NULL. > > Signed-off-by: Stefan Berger > Acked-by: Christian Brauner > Reviewed-by: Mimi Zohar