From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1755461AbdERVjp (ORCPT <rfc822;w@1wt.eu>);
        Thu, 18 May 2017 17:39:45 -0400
Received: from mail-io0-f173.google.com ([209.85.223.173]:34880 "EHLO
        mail-io0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752020AbdERVjm (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 18 May 2017 17:39:42 -0400
Date: Thu, 18 May 2017 15:39:39 -0600
From: Tycho Andersen <tycho@docker.com>
To: Guilherme Magalhaes <guilherme.magalhaes@hpe.com>
Cc: dmitry.kasatkin@gmail.com, zohar@linux.vnet.ibm.com,
        viro@zeniv.linux.org.uk, james.l.morris@oracle.com, serge@hallyn.com,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-ima-devel@lists.sourceforge.net,
        linux-ima-user@lists.sourceforge.net,
        linux-security-module@vger.kernel.org, joaquims@hpe.com,
        nigel.edwards@hpe.com
Subject: Re: [RFC 04/11] ima: add support to namespace securityfs file
Message-ID: <20170518213939.mrvuzxf3kdqqnemc@docker>
References: <1494511203-8397-1-git-send-email-guilherme.magalhaes@hpe.com>
 <1494511203-8397-5-git-send-email-guilherme.magalhaes@hpe.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1494511203-8397-5-git-send-email-guilherme.magalhaes@hpe.com>
User-Agent: Mutt/1.6.2-neo (2016-08-21)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Guilherme,

On Thu, May 11, 2017 at 10:59:56AM -0300, Guilherme Magalhaes wrote:
> +static int ima_open_namespaces(struct inode *inode, struct file *filp)
> +{
> +	if (!(filp->f_flags & O_WRONLY))
> +		return -EACCES;
> +
> +	if (!capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
> +	if (test_and_set_bit(IMA_FS_BUSY, &ima_fs_flags))
> +		return -EBUSY;

It probably makes sense to do something like:

if (!(ima_appraise & IMA_APPRAISE_NAMESPACE))
	return -EINVAL;

here.

I'll keep playing around with this patchset and see if I have any
other feedback.

Cheers,

Tycho