From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E941F1FD3 for ; Thu, 17 Feb 2022 20:31:25 +0000 (UTC) Received: from pps.filterd (m0098414.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 21HKCC0D002979; Thu, 17 Feb 2022 20:31:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=message-id : subject : from : to : cc : date : in-reply-to : references : content-type : mime-version : content-transfer-encoding; s=pp1; bh=1cNKu373K9QrDP5uFf81HeBMrMVHHj3RvBwV8CXX4eI=; b=mm+ILmZEHhlc3KPaZxEtVAF3B8LCJ/Ezwi7qCvkB9MRhZcs+qd8fMRqLo2dkG9ITsgLQ L0YHEDZ8lntrawxnfGu91JcntALWtiL5NHCZEmjGXRKJbGlZEMuONymnLb31FHnLwDvf 5HNNhzCXoNk8VM9tM42zNnRtJzZm++m+b1LjLhVyi5pnL6PvjB2B3KNOMYW1n6anP5hj wmGgmM56UYDOjx4w2r//ZH8Q04zQJm85d60iHyRXHgHeYWGmFLVKgjMV7PXHfr3+TMAn Pf49GcWIswpuIKAwzest2x0VMdtjKLB10WY8AyjVFF8/ej3Wza1W30PmngAl08hEs29d mQ== Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 3e9w6cgea5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Feb 2022 20:31:02 +0000 Received: from m0098414.ppops.net (m0098414.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 21HKNZeF019907; Thu, 17 Feb 2022 20:31:02 GMT Received: from ppma06ams.nl.ibm.com (66.31.33a9.ip4.static.sl-reverse.com [169.51.49.102]) by mx0b-001b2d01.pphosted.com with ESMTP id 3e9w6cge9a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Feb 2022 20:31:02 +0000 Received: from pps.filterd (ppma06ams.nl.ibm.com [127.0.0.1]) by ppma06ams.nl.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 21HKNl9R012114; Thu, 17 Feb 2022 20:31:00 GMT Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by ppma06ams.nl.ibm.com with ESMTP id 3e645kdnjc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Feb 2022 20:31:00 +0000 Received: from d06av22.portsmouth.uk.ibm.com (d06av22.portsmouth.uk.ibm.com [9.149.105.58]) by b06cxnps4074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 21HKUti643647294 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 17 Feb 2022 20:30:56 GMT Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D320E4C040; Thu, 17 Feb 2022 20:30:55 +0000 (GMT) Received: from d06av22.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8AE7B4C04E; Thu, 17 Feb 2022 20:30:53 +0000 (GMT) Received: from sig-9-65-72-122.ibm.com (unknown [9.65.72.122]) by d06av22.portsmouth.uk.ibm.com (Postfix) with ESMTP; Thu, 17 Feb 2022 20:30:53 +0000 (GMT) Message-ID: <62f946ec160296b6b20bee98986b2bafb8427718.camel@linux.ibm.com> Subject: Re: [PATCH v10 11/27] ima: Move ima_lsm_policy_notifier into ima_namespace From: Mimi Zohar To: Stefan Berger , linux-integrity@vger.kernel.org Cc: serge@hallyn.com, christian.brauner@ubuntu.com, containers@lists.linux.dev, dmitry.kasatkin@gmail.com, ebiederm@xmission.com, krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com, mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com, puiterwi@redhat.com, jejb@linux.ibm.com, jamjoom@us.ibm.com, linux-kernel@vger.kernel.org, paul@paul-moore.com, rgb@redhat.com, linux-security-module@vger.kernel.org, jmorris@namei.org Date: Thu, 17 Feb 2022 15:30:53 -0500 In-Reply-To: <20220201203735.164593-12-stefanb@linux.ibm.com> References: <20220201203735.164593-1-stefanb@linux.ibm.com> <20220201203735.164593-12-stefanb@linux.ibm.com> Content-Type: text/plain; charset="ISO-8859-15" X-Mailer: Evolution 3.28.5 (3.28.5-18.el8) Precedence: bulk X-Mailing-List: containers@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Proofpoint-GUID: hYURi_08e0k4PCpSSqaxX4XO40MB33V0 X-Proofpoint-ORIG-GUID: gFJlp_3Q_y27hH9Ws4Oqaip2-C-C4dgF X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.816,Hydra:6.0.425,FMLib:17.11.62.513 definitions=2022-02-17_07,2022-02-17_01,2021-12-02_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 mlxlogscore=999 spamscore=0 priorityscore=1501 mlxscore=0 adultscore=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2202170093 On Tue, 2022-02-01 at 15:37 -0500, Stefan Berger wrote: The builtin IMA policy rules are broad and may be constrained by loading a custom policy, which could be defined in terms of LSM labels. When an LSM policy is loaded, existing LSM labels might be affected or even removed. In either case, IMA policy rules based on LSM labels, need to reflect these changes. If an LSM label is removed, instead of deleting the IMA policy rule based on the LSM label, the IMA policy rule is made inactive. > Move the ima_lsm_policy_notifier into the ima_namespace. Each IMA > namespace can now register its own LSM policy change notifier callback. > The policy change notifier for the init_ima_ns still remains in init_ima() > and therefore handle the registration of the callback for all other > namespaces in init_ima_namespace(). > > Suppress the kernel warning 'rule for LSM