Re: [PATCH v10 13/27] ima: Only accept AUDIT rules for non-init_ima_ns... | linux-security-module

[PATCH v10 00/27] ima: Namespace IMA with audit support in IMA-ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
[PATCH v10 03/27] ima: Return error code obtained from securityfs functions · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 03/27] ima: Return error code obtained from securityfs functions · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-10
Re: [PATCH v10 03/27] ima: Return error code obtained from securityfs functions · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-15
[PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 26/27] ima: Limit number of policy rules in non-init_ima_ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
[PATCH v10 21/27] ima: Remove unused iints from the integrity_iint_cache · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
[PATCH v10 18/27] integrity/ima: Define ns_status for storing namespaced iint data · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 18/27] integrity/ima: Define ns_status for storing namespaced iint data · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 18/27] integrity/ima: Define ns_status for storing namespaced iint data · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-24
Re: [PATCH v10 18/27] integrity/ima: Define ns_status for storing namespaced iint data · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-24
[PATCH v10 01/27] ima: Remove ima_policy file before directory · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 01/27] ima: Remove ima_policy file before directory · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-10
[PATCH v10 11/27] ima: Move ima_lsm_policy_notifier into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 11/27] ima: Move ima_lsm_policy_notifier into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-17
Re: [PATCH v10 11/27] ima: Move ima_lsm_policy_notifier into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-17
Re: [PATCH v10 11/27] ima: Move ima_lsm_policy_notifier into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-17
[PATCH v10 23/27] ima: Setup securityfs for IMA namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 23/27] ima: Setup securityfs for IMA namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
[PATCH v10 06/27] ima: Move arch_policy_entry into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 06/27] ima: Move arch_policy_entry into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-16
Re: [PATCH v10 06/27] ima: Move arch_policy_entry into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-16
Re: [PATCH v10 06/27] ima: Move arch_policy_entry into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-16
Re: [PATCH v10 06/27] ima: Move arch_policy_entry into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-16
[PATCH v10 07/27] ima: Move ima_htable into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 07/27] ima: Move ima_htable into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-16
[PATCH v10 19/27] integrity: Add optional callback function to integrity_inode_free() · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
[PATCH v10 13/27] ima: Only accept AUDIT rules for non-init_ima_ns namespaces for now · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 13/27] ima: Only accept AUDIT rules for non-init_ima_ns namespaces for now · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-17
[PATCH v10 12/27] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 12/27] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() · "Serge E. Hallyn" <serge@hallyn.com> · 2022-02-05
Re: [PATCH v10 12/27] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-06
Re: [PATCH v10 12/27] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-07
Re: [PATCH v10 12/27] ima: Define mac_admin_ns_capable() as a wrapper for ns_capable() · "Serge E. Hallyn" <serge@hallyn.com> · 2022-02-23
[PATCH v10 22/27] securityfs: Extend securityfs with namespacing support · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 22/27] securityfs: Extend securityfs with namespacing support · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 22/27] securityfs: Extend securityfs with namespacing support · Christian Brauner <brauner@kernel.org> · 2022-02-23
Re: [PATCH v10 22/27] securityfs: Extend securityfs with namespacing support · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
[PATCH v10 20/27] ima: Namespace audit status flags · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
[PATCH v10 27/27] ima: Enable IMA namespaces · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 27/27] ima: Enable IMA namespaces · "Serge E. Hallyn" <serge@hallyn.com> · 2022-02-23
Re: [PATCH v10 27/27] ima: Enable IMA namespaces · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
[PATCH v10 17/27] ima: Add functions for creating and freeing of an ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 17/27] ima: Add functions for creating and freeing of an ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-18
[PATCH v10 10/27] ima: Move IMA securityfs files into ima_namespace or onto stack · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 10/27] ima: Move IMA securityfs files into ima_namespace or onto stack · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-17
[PATCH v10 24/27] ima: Introduce securityfs file to activate an IMA namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 24/27] ima: Introduce securityfs file to activate an IMA namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 24/27] ima: Introduce securityfs file to activate an IMA namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 24/27] ima: Introduce securityfs file to activate an IMA namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
Re: [PATCH v10 24/27] ima: Introduce securityfs file to activate an IMA namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-23
[PATCH v10 15/27] ima: Implement hierarchical processing of file accesses · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 15/27] ima: Implement hierarchical processing of file accesses · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-18
[PATCH v10 05/27] ima: Define ima_namespace struct and start moving variables into it · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 05/27] ima: Define ima_namespace struct and start moving variables into it · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-16
Re: [PATCH v10 05/27] ima: Define ima_namespace struct and start moving variables into it · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-16
[PATCH v10 08/27] ima: Move measurement list related variables into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 08/27] ima: Move measurement list related variables into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-17
[PATCH v10 16/27] ima: Implement ima_free_policy_rules() for freeing of an ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 16/27] ima: Implement ima_free_policy_rules() for freeing of an ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-18
Re: [PATCH v10 16/27] ima: Implement ima_free_policy_rules() for freeing of an ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-18
Re: [PATCH v10 16/27] ima: Implement ima_free_policy_rules() for freeing of an ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-18
[PATCH v10 09/27] ima: Move some IMA policy and filesystem related variables into ima_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 09/27] ima: Move some IMA policy and filesystem related variables into ima_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-17
[PATCH v10 14/27] userns: Add pointer to ima_namespace to user_namespace · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 14/27] userns: Add pointer to ima_namespace to user_namespace · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-18
[PATCH v10 25/27] ima: Show owning user namespace's uid and gid when displaying policy · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 25/27] ima: Show owning user namespace's uid and gid when displaying policy · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-23
[PATCH v10 04/27] securityfs: rework dentry creation · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 04/27] securityfs: rework dentry creation · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-10
[PATCH v10 02/27] ima: Do not print policy rule with inactive LSM labels · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-01
Re: [PATCH v10 02/27] ima: Do not print policy rule with inactive LSM labels · Christian Brauner <brauner@kernel.org> · 2022-02-02
Re: [PATCH v10 00/27] ima: Namespace IMA with audit support in IMA-ns · Christian Brauner <brauner@kernel.org> · 2022-02-02
Re: [PATCH v10 00/27] ima: Namespace IMA with audit support in IMA-ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-02
Re: [PATCH v10 00/27] ima: Namespace IMA with audit support in IMA-ns · Mimi Zohar <zohar@linux.ibm.com> · 2022-02-02
Re: [PATCH v10 00/27] ima: Namespace IMA with audit support in IMA-ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-02
Re: [PATCH v10 00/27] ima: Namespace IMA with audit support in IMA-ns · Stefan Berger <stefanb@linux.ibm.com> · 2022-02-02

Re: [PATCH v10 13/27] ima: Only accept AUDIT rules for non-init_ima_ns namespaces for now

From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2022-02-17 21:34:32
Also in: linux-integrity, lkml

On Tue, 2022-02-01 at 15:37 -0500, Stefan Berger wrote:

Only accept AUDIT rules for non-init_ima_ns namespaces rejecting all rules
that require support for measuring, appraisal, and hashing.

It's probably obvious, but adding the words "for now" somewhere in the
above line makes it clear this is temporary.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Acked-by: Christian Brauner <brauner@kernel.org>

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>

-- 
thanks,

Mimi

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help