Messages in this thread | | | From | (Eric W. Biederman) | Date | Thu, 26 Apr 2018 19:49:59 -0500 | Subject | Re: [RFC PATCH v3 1/3] ima: extend clone() with IMA namespace support |
| |
Stefan Berger <stefanb@linux.vnet.ibm.com> writes:
> On 04/19/2018 11:35 AM, John Johansen wrote:
>> It sounds like its already decided, with ima and selinux going with an unshare file within their own fs. >> >> AppArmor went a different route already, splitting namespace creation (mkdir in the apparmorfs policy/namespace dir) and the task entering the namespace with a write apparmor's equiv of setexeccon. >> > I am supporting procfs entries for the IMA namespace spawned by writing a > boolean '1' into IMA's securityfs 'unshare' file. It would allow to use > setns(fd, 0), obviously with the 0 parameter. I think this is an important > function to support considering entering a set of namespace. I am just wondering > about the 0 parameter. We don't have a CLONE flag for it, so there's not other > way to support it then. Does it matter ?
That should be fine. We can pick a flag for setns at some point for IMA. The setns function uses the flag field as an enumeration so any of the low 8 bits or a combination with overlapping bit is valid to setns.
Eric
| |