lkml.org 
[lkml]   [2022]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH v9 00/23] ima: Namespace IMA with audit support in IMA-ns
    From

    On 1/25/22 17:46, Stefan Berger wrote:
    > From: Stefan Berger <stefanb@linux.ibm.com>
    >
    > The goal of this series of patches is to start with the namespacing of
    > IMA and support auditing within an IMA namespace (IMA-ns) as the first
    > step.
    [...]
    >
    >
    > My tree with these patches is here:
    >
    > git fetch https://github.com/stefanberger/linux-ima-namespaces v5.16+imans.v9.posted

    Thanks a lot for the first round of Ack's, Christian. I haven't looked
    through all the comments, yet, though.

    If one pulls this branch one will see that there's a directory STAGE3.
    This is where I have been storing patches that explore how deep the can
    is that we are opening here. So yeah, it's pretty deep... In my latest
    branch I now have 40 patches beyond what we have here that add IMA
    -measurement support, inheritance of hash algo and IMA template from
    parent to child, and IMA-appraisal to the IMA namespaces but it doesn't
    tackle yet all of the issues. At some point it pulls in integrity and
    EVM for namespacing as well... All 'dimensions of this problem' look
    good but the patches there are not as clean as we have them here right
    now. So considering the depth of the problem this may take a while...

    I also have a test suite just for IMA namespacing that tests IMA-audit
    in IMA-ns and these upcoming aspects and try to test a lot of things
    with running many namespace in parallel to test the locking. I run
    certain tests with up to 1920 namespaces concurrently and so far it's
    been good, especially with the lock groups from v9 18/23. So don't shake
    that tree there too hard.

    https://github.com/stefanberger/ima-namespaces-tests

    The test suite should be able to skip any tests for which there's no
    support in Linux. So with this series applied the audit related tests
    should all work.

    You can check out the test suite but you may need to move along with my
    Linux patch branches as I update the test suite. The problem is of
    course that design changes in Linux patches affect the test suite. So
    this may cause hiccups. And I have been using forced-updates to solve
    this issue... The tests have been working on Fedora 34 x86 and ppc64.
    The unshare tool on Ubuntu 20.04 seems to be too old to run certain
    tests correctly.

    Cheers!

       Stefan


    \
     
     \ /
      Last update: 2022-01-26 17:53    [W:4.525 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site