Messages in this thread | | | Date | Fri, 3 Dec 2021 19:33:39 -0500 | Subject | Re: [RFC v2 19/19] ima: Setup securityfs for IMA namespace | From | Stefan Berger <> |
| |
On 12/3/21 14:11, Stefan Berger wrote: > > On 12/3/21 13:50, James Bottomley wrote: > > >> >>> Where would the vfsmount pointer reside? For now it's in >>> ima_namespace, but it sounds like it should be in a more centralized >>> place? Should it also be connected to the user_namespace so we can >>> pick it up using get_user_ns()? >> exactly. I think struct user_namespace should have two elements gated >> by a #ifdef CONFIG_SECURITYFS which are the vfsmount and the >> mount_count for passing into simple_pin_fs. > > Also that we can do for as long as it flies beyond the conversation > here... :-) Anyone else have an opinion ?
I moved it now and this greatly reduced the amount of changes. The dentries are now all in the ima_namespace and it works with one API. Thanks!
I wonder whether to move the integrity dir also into the ima_namespace. It's generated in integrity/iint.c, so not in the IMA territory... For the IMA namespacing case I need to create it as well, though.
https://elixir.bootlin.com/linux/latest/source/security/integrity/iint.c#L218
Stefan
| |