From: Mimi Zohar <zohar@linux.ibm.com>
To: Christian Brauner <brauner@kernel.org>,
Stefan Berger <stefanb@linux.vnet.ibm.com>
Cc: linux-integrity@vger.kernel.org, serge@hallyn.com,
christian.brauner@ubuntu.com, containers@lists.linux.dev,
dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
puiterwi@redhat.com, jejb@linux.ibm.com, jamjoom@us.ibm.com,
linux-kernel@vger.kernel.org, paul@paul-moore.com,
rgb@redhat.com, linux-security-module@vger.kernel.org,
jmorris@namei.org, Stefan Berger <stefanb@linux.ibm.com>
Subject: Re: [PATCH v9 06/23] ima: Move arch_policy_entry into ima_namespace
Date: Thu, 27 Jan 2022 14:42:14 -0500 [thread overview]
Message-ID: <38a2c2b2d1829e9949bd984958e880e54ae7cf5c.camel@linux.ibm.com> (raw)
In-Reply-To: <20220126091104.jbedxrewojcmvy3u@wittgenstein>
On Wed, 2022-01-26 at 10:11 +0100, Christian Brauner wrote:
> On Tue, Jan 25, 2022 at 05:46:28PM -0500, Stefan Berger wrote:
> > From: Stefan Berger <stefanb@linux.ibm.com>
> >
> > Move the arch_policy_entry pointer into ima_namespace.
> >
> > When freeing the memory set the pointer to NULL.
> >
> > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> > ---
>
> Only relevant for the initial imans (for now) since it is derived from a
> boot parameter. Maybe mention this in the commit message.
Enabling architecture specific policy rules is based on
CONFIG_IMA_ARCH_POLICY. As the name implies, each architecture is free
to define their own policy rules. For example on x86, based on the
secure boot mode both measurement and signature verification rules are
defined for the kexec kernel image and kernel modules. Similarly on
powerpc, different measurement and signature verification rules for the
kexec kernel image and kernel modules are defined based on whether
trusted boot, secure boot, or both are enabled [2].
As neither kexec nor loading kernel modules are applicable, the
architecture policy rules are limited to initial imans.
[1] security/integrity/ima/ima_efi.c
[2] arch/powerpc/kernel/ima_arch.c
>
> Move into struct ima_namespace looks good,
> Acked-by: Christian Brauner <brauner@kernel.org>
Thanks, Christian.
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
next prev parent reply other threads:[~2022-01-27 19:42 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-25 22:46 [PATCH v9 00/23] ima: Namespace IMA with audit support in IMA-ns Stefan Berger
2022-01-25 22:46 ` [PATCH v9 01/23] ima: Remove ima_policy file before directory Stefan Berger
2022-01-26 8:30 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 02/23] ima: Do not print policy rule with inactive LSM labels Stefan Berger
2022-01-26 8:38 ` Christian Brauner
2022-01-27 14:12 ` Mimi Zohar
2022-01-25 22:46 ` [PATCH v9 03/23] securityfs: rework dentry creation Stefan Berger
2022-01-25 22:46 ` [PATCH v9 04/23] securityfs: Extend securityfs with namespacing support Stefan Berger
2022-01-27 16:53 ` Mimi Zohar
2022-01-31 22:28 ` Stefan Berger
2022-01-31 23:43 ` Mimi Zohar
2022-01-25 22:46 ` [PATCH v9 05/23] ima: Define ima_namespace struct and start moving variables into it Stefan Berger
2022-01-26 8:47 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 06/23] ima: Move arch_policy_entry into ima_namespace Stefan Berger
2022-01-26 9:11 ` Christian Brauner
2022-01-27 19:42 ` Mimi Zohar [this message]
2022-01-25 22:46 ` [PATCH v9 07/23] ima: Move ima_htable " Stefan Berger
2022-01-26 9:16 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 08/23] ima: Move measurement list related variables " Stefan Berger
2022-01-26 9:21 ` Christian Brauner
2022-01-26 22:23 ` Stefan Berger
2022-01-27 21:48 ` Mimi Zohar
2022-01-28 14:06 ` Stefan Berger
2022-01-25 22:46 ` [PATCH v9 09/23] ima: Move some IMA policy and filesystem " Stefan Berger
2022-01-26 9:23 ` Christian Brauner
2022-01-27 22:30 ` Mimi Zohar
2022-01-28 15:44 ` Stefan Berger
2022-01-28 16:03 ` Mimi Zohar
2022-01-25 22:46 ` [PATCH v9 10/23] ima: Move IMA securityfs files into ima_namespace or onto stack Stefan Berger
2022-01-26 9:40 ` Christian Brauner
2022-01-27 17:02 ` Stefan Berger
2022-01-28 3:13 ` Mimi Zohar
2022-01-25 22:46 ` [PATCH v9 11/23] ima: Move ima_lsm_policy_notifier into ima_namespace Stefan Berger
2022-01-26 13:05 ` Christian Brauner
2022-01-26 21:54 ` Stefan Berger
2022-01-25 22:46 ` [PATCH v9 12/23] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() Stefan Berger
2022-01-26 13:43 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 13/23] ima: Only accept AUDIT rules for non-init_ima_ns namespaces for now Stefan Berger
2022-01-26 13:44 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 14/23] userns: Add pointer to ima_namespace to user_namespace Stefan Berger
2022-01-26 14:46 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 15/23] ima: Implement hierarchical processing of file accesses Stefan Berger
2022-01-26 12:39 ` Christian Brauner
2022-01-26 22:05 ` Stefan Berger
2022-01-25 22:46 ` [PATCH v9 16/23] ima: Implement ima_free_policy_rules() for freeing of an ima_namespace Stefan Berger
2022-01-28 14:02 ` Mimi Zohar
2022-01-31 18:56 ` Stefan Berger
2022-01-25 22:46 ` [PATCH v9 17/23] ima: Add functions for creating and " Stefan Berger
2022-01-26 13:56 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 18/23] integrity/ima: Define ns_status for storing namespaced iint data Stefan Berger
2022-01-25 22:46 ` [PATCH v9 19/23] ima: Namespace audit status flags Stefan Berger
2022-01-25 22:46 ` [PATCH v9 20/23] ima: Setup securityfs for IMA namespace Stefan Berger
2022-01-26 14:03 ` Christian Brauner
2022-01-25 22:46 ` [PATCH v9 21/23] ima: Introduce securityfs file to activate an " Stefan Berger
2022-01-26 14:31 ` Christian Brauner
2022-01-27 15:24 ` Stefan Berger
2022-01-25 22:46 ` [PATCH v9 22/23] ima: Show owning user namespace's uid and gid when displaying policy Stefan Berger
2022-01-26 14:43 ` Christian Brauner
2022-01-26 14:43 ` Christian Brauner
2022-01-26 23:13 ` Stefan Berger
2022-01-25 22:46 ` [PATCH v9 23/23] ima: Enable IMA namespaces Stefan Berger
2022-01-26 14:57 ` Christian Brauner
2022-01-26 13:19 ` [PATCH v9 00/23] ima: Namespace IMA with audit support in IMA-ns Christian Brauner
2022-01-28 18:34 ` Stefan Berger
2022-01-26 16:52 ` Stefan Berger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=38a2c2b2d1829e9949bd984958e880e54ae7cf5c.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=brauner@kernel.org \
--cc=christian.brauner@ubuntu.com \
--cc=containers@lists.linux.dev \
--cc=dmitry.kasatkin@gmail.com \
--cc=ebiederm@xmission.com \
--cc=jamjoom@us.ibm.com \
--cc=jejb@linux.ibm.com \
--cc=jmorris@namei.org \
--cc=krzysztof.struczynski@huawei.com \
--cc=lhinds@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lsturman@redhat.com \
--cc=mpeters@redhat.com \
--cc=paul@paul-moore.com \
--cc=puiterwi@redhat.com \
--cc=rgb@redhat.com \
--cc=roberto.sassu@huawei.com \
--cc=serge@hallyn.com \
--cc=stefanb@linux.ibm.com \
--cc=stefanb@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.