[RFC PATCH v3 1/3] ima: extend clone() with IMA namespace support
Eric W. Biederman
ebiederm at xmission.com
Fri Apr 27 00:49:59 UTC 2018
Stefan Berger <stefanb at linux.vnet.ibm.com> writes:
> On 04/19/2018 11:35 AM, John Johansen wrote:
>> It sounds like its already decided, with ima and selinux going with an unshare file within their own fs.
>> AppArmor went a different route already, splitting namespace creation (mkdir in the apparmorfs policy/namespace dir) and the task entering the namespace with a write apparmor's equiv of setexeccon.
> I am supporting procfs entries for the IMA namespace spawned by writing a
> boolean '1' into IMA's securityfs 'unshare' file. It would allow to use
> setns(fd, 0), obviously with the 0 parameter. I think this is an important
> function to support considering entering a set of namespace. I am just wondering
> about the 0 parameter. We don't have a CLONE flag for it, so there's not other
> way to support it then. Does it matter ?
That should be fine. We can pick a flag for setns at some point for
IMA. The setns function uses the flag field as an enumeration so any of
the low 8 bits or a combination with overlapping bit is valid to setns.
More information about the Containers