Re: [Linux-ima-devel] [RFC PATCH 0/5] ima: namespacing IMA audit messages

[Magalhaes, G. (B. R&D-CL) <gui...@hp...>]

Mehmet,

> As a result, clone() and unshare() with CLONE_NEWNS results in a new 
> mount and a new IMA namespace, while setns() called with the fd of 
> /proc/*/ns/mnt would NOT have the same result. A second setns() 
> call with the fd /proc/*/ns/ima would be required.
If I understood correctly, a given mount namespace is always paired with a given IMA namespace, but processes which setns() to a given mount namespace, would need an additional step to fix the pairing. That means when a process changes to a different mount namespace, the namespaced IMA flags are still the flags 'controlled' by the old mount namespace until the IMA namespace is fixed with a new setns(). It is also possible that a process points to two completely unrelated mount and IMA namespaces. This namespaces relation might confuse the audit log since a given mount namespace id might appear twice for the same file with no file change, or an expected entry may be not logged since the process changed to an IMA namespace where the inode namespaced flag was already IMA_AUDITED.
Probably one side effect from that is in the audit log, which should be fixed replacing 'ns_mnt' with 'ns_ima' on the audit record.

--
Guilherme

-----Original Message-----
From: own...@vg... [mailto:own...@vg...] On Behalf Of Mehmet Kayaalp
Sent: quinta-feira, 20 de julho de 2017 19:50
To: ima-devel <lin...@li...>
Cc: containers <con...@li...>; linux-kernel <lin...@vg...>; linux-security-module <lin...@vg...>; Tycho Andersen <ty...@do...>; Serge E . Hallyn <se...@ha...>; Yuqiong Sun <sun...@gm...>; David Safford <dav...@ge...>; Mehmet Kayaalp <mka...@cs...>; Stefan Berger <st...@li...>; Mehmet Kayaalp <mka...@li...>
Subject: [RFC PATCH 0/5] ima: namespacing IMA audit messages

This patch set implements an IMA namespace data structure that gets created alongside a mount namespace with CLONE_NEWNS, and lays down the foundation for namespacing the different aspects of IMA (eg. IMA-audit, IMA-measurement, IMA-appraisal).

The original PoC patches [1], created a new CLONE_NEWIMA flag to explicitly control when a new IMA namespace should be created. Based on comments, we elected to hang the IMA namepace off of existing namespaces, and the mount namespace made the most sense. However, we actually allocate a new namespace struct in nsproxy, allocate a new inum, and have an ima symlink in /proc/*/ns/, instead of adding a pointer from the mnt_namespace. As a result, clone() and unshare() with CLONE_NEWNS results in a new mount and a new IMA namespace, while setns() called with the fd of /proc/*/ns/mnt would NOT have the same result. A second setns() call with the fd /proc/*/ns/ima would be required.

The first patch creates the ima_namespace data, while the second patch puts the iint->flags in the namespace. The third patch uses these flags for namespacing the IMA-audit messages, enabling the same file to be audited each time it is accessed in a new namespace. Rest of the patches are small fixes and improvements to the audit messages generated by IMA.
Subsequent patch sets will namespace IMA-measurement and IMA-appraisal.

[1] https://sourceforge.net/p/linux-ima/mailman/message/35939754/

Guilherme Magalhaes (1):
  ima: Add ns_mnt, dev, ino fields to IMA audit measurement msgs

Mehmet Kayaalp (2):
  ima: Add ns_status for storing namespaced iint data
  ima: mamespace audit status flags

Mimi Zohar (1):
  ima: differentiate auditing policy rules from "audit" actions

Yuqiong Sun (1):
  ima: extend clone() with IMA namespace support

 fs/proc/namespaces.c                |   3 +
 include/linux/ima.h                 |  40 +++++
 include/linux/nsproxy.h             |   1 +
 include/linux/proc_ns.h             |   2 +
 include/uapi/linux/audit.h          |   3 +-
 init/Kconfig                        |  10 ++
 kernel/nsproxy.c                    |  15 ++
 security/integrity/ima/Makefile     |   1 +
 security/integrity/ima/ima.h        |  49 +++++-
 security/integrity/ima/ima_api.c    |  18 +-
 security/integrity/ima/ima_init.c   |   4 +
 security/integrity/ima/ima_main.c   |  15 +-
 security/integrity/ima/ima_ns.c     | 324 ++++++++++++++++++++++++++++++++++++
 security/integrity/ima/ima_policy.c |   2 +-
 14 files changed, 478 insertions(+), 9 deletions(-)  create mode 100644 security/integrity/ima/ima_ns.c

--
2.9.4

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to maj...@vg... More majordomo info at  http://vger.kernel.org/majordomo-info.html