lkml.org 
[lkml]   [2017]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[RFC PATCH 0/5] ima: namespacing IMA audit messages
    Date
    This patch set implements an IMA namespace data structure that gets
    created alongside a mount namespace with CLONE_NEWNS, and lays down the
    foundation for namespacing the different aspects of IMA (eg. IMA-audit,
    IMA-measurement, IMA-appraisal).

    The original PoC patches [1], created a new CLONE_NEWIMA flag to
    explicitly control when a new IMA namespace should be created. Based on
    comments, we elected to hang the IMA namepace off of existing namespaces,
    and the mount namespace made the most sense. However, we actually
    allocate a new namespace struct in nsproxy, allocate a new inum, and have
    an ima symlink in /proc/*/ns/, instead of adding a pointer from the
    mnt_namespace. As a result, clone() and unshare() with CLONE_NEWNS
    results in a new mount and a new IMA namespace, while setns() called with
    the fd of /proc/*/ns/mnt would NOT have the same result. A second setns()
    call with the fd /proc/*/ns/ima would be required.

    The first patch creates the ima_namespace data, while the second patch
    puts the iint->flags in the namespace. The third patch uses these flags
    for namespacing the IMA-audit messages, enabling the same file to be
    audited each time it is accessed in a new namespace. Rest of the patches
    are small fixes and improvements to the audit messages generated by IMA.
    Subsequent patch sets will namespace IMA-measurement and IMA-appraisal.

    [1] https://sourceforge.net/p/linux-ima/mailman/message/35939754/

    Guilherme Magalhaes (1):
    ima: Add ns_mnt, dev, ino fields to IMA audit measurement msgs

    Mehmet Kayaalp (2):
    ima: Add ns_status for storing namespaced iint data
    ima: mamespace audit status flags

    Mimi Zohar (1):
    ima: differentiate auditing policy rules from "audit" actions

    Yuqiong Sun (1):
    ima: extend clone() with IMA namespace support

    fs/proc/namespaces.c | 3 +
    include/linux/ima.h | 40 +++++
    include/linux/nsproxy.h | 1 +
    include/linux/proc_ns.h | 2 +
    include/uapi/linux/audit.h | 3 +-
    init/Kconfig | 10 ++
    kernel/nsproxy.c | 15 ++
    security/integrity/ima/Makefile | 1 +
    security/integrity/ima/ima.h | 49 +++++-
    security/integrity/ima/ima_api.c | 18 +-
    security/integrity/ima/ima_init.c | 4 +
    security/integrity/ima/ima_main.c | 15 +-
    security/integrity/ima/ima_ns.c | 324 ++++++++++++++++++++++++++++++++++++
    security/integrity/ima/ima_policy.c | 2 +-
    14 files changed, 478 insertions(+), 9 deletions(-)
    create mode 100644 security/integrity/ima/ima_ns.c

    --
    2.9.4

    \
     
     \ /
      Last update: 2017-07-21 00:54    [W:4.182 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site