From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Jarkko Sakkinen <jarkko.sakkinen@iki.fi>,
Stefan Berger <stefanb@linux.ibm.com>,
linux-integrity@vger.kernel.org
Cc: zohar@linux.ibm.com, serge@hallyn.com,
christian.brauner@ubuntu.com, containers@lists.linux.dev,
dmitry.kasatkin@gmail.com, ebiederm@xmission.com,
krzysztof.struczynski@huawei.com, roberto.sassu@huawei.com,
mpeters@redhat.com, lhinds@redhat.com, lsturman@redhat.com,
puiterwi@redhat.com, jamjoom@us.ibm.com,
linux-kernel@vger.kernel.org, paul@paul-moore.com,
rgb@redhat.com, linux-security-module@vger.kernel.org,
jmorris@namei.org
Subject: Re: [PATCH v4 11/16] securityfs: Only use simple_pin_fs/simple_release_fs for init_user_ns
Date: Sat, 11 Dec 2021 09:44:35 -0500 [thread overview]
Message-ID: <a68ead0d882410a4cdf86f677973864fafc590d8.camel@HansenPartnership.com> (raw)
In-Reply-To: <a71b600f34f66d6eca5c50259529b3fc476880f6.camel@iki.fi>
On Sat, 2021-12-11 at 16:16 +0200, Jarkko Sakkinen wrote:
> On Tue, 2021-12-07 at 15:21 -0500, Stefan Berger wrote:
> > To prepare for virtualization of SecurityFS, use simple_pin_fs and
> > simpe_release_fs only when init_user_ns is active.
> >
> > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> > Signed-off-by: James Bottomley <
> > James.Bottomley@HansenPartnership.com>
>
> What do you mean by virtualization, and how does this prepare
> securityfs for it? The commit message should be way more verbose.
Heh, well cart before horse: we're still trying to work out how to do
it correctly, so we can't really document it until we've figured that
bit out.
Once that's all sorted, the output is likely something in
Documentation/ explaining how to namespace a pseudo filesystem (since
we have quite a few of them in the kernel) rather than a commit message
which will get hard to find the next time someone wants to do this.
James
next prev parent reply other threads:[~2021-12-11 14:44 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-07 20:21 [PATCH v4 00/16] ima: Namespace IMA with audit support in IMA-ns Stefan Berger
2021-12-07 20:21 ` [PATCH v4 01/16] ima: Add IMA namespace support Stefan Berger
2021-12-08 11:29 ` Christian Brauner
2021-12-08 11:54 ` Christian Brauner
2021-12-08 14:50 ` Stefan Berger
2021-12-07 20:21 ` [PATCH v4 02/16] ima: Define ns_status for storing namespaced iint data Stefan Berger
2021-12-07 20:21 ` [PATCH v4 03/16] ima: Namespace audit status flags Stefan Berger
2021-12-07 20:21 ` [PATCH v4 04/16] ima: Move delayed work queue and variables into ima_namespace Stefan Berger
2021-12-07 20:21 ` [PATCH v4 05/16] ima: Move IMA's keys queue related " Stefan Berger
2021-12-07 20:21 ` [PATCH v4 06/16] ima: Move policy " Stefan Berger
2021-12-07 20:21 ` [PATCH v4 07/16] ima: Move ima_htable " Stefan Berger
2021-12-07 20:21 ` [PATCH v4 08/16] ima: Move measurement list related variables " Stefan Berger
2021-12-07 20:21 ` [PATCH v4 09/16] ima: Only accept AUDIT rules for IMA non-init_ima_ns namespaces for now Stefan Berger
2021-12-07 20:21 ` [PATCH v4 10/16] ima: Implement hierarchical processing of file accesses Stefan Berger
2021-12-08 12:09 ` Christian Brauner
2021-12-08 12:23 ` Christian Brauner
2021-12-08 16:50 ` Stefan Berger
2021-12-08 18:22 ` Stefan Berger
2021-12-15 23:04 ` Mimi Zohar
2021-12-16 2:55 ` Stefan Berger
2021-12-07 20:21 ` [PATCH v4 11/16] securityfs: Only use simple_pin_fs/simple_release_fs for init_user_ns Stefan Berger
2021-12-08 11:58 ` Christian Brauner
2021-12-08 14:03 ` Stefan Berger
2021-12-08 12:46 ` Christian Brauner
2021-12-11 14:16 ` Jarkko Sakkinen
2021-12-11 14:44 ` James Bottomley [this message]
2021-12-07 20:21 ` [PATCH v4 12/16] securityfs: Extend securityfs with namespacing support Stefan Berger
2021-12-07 20:21 ` [PATCH v4 13/16] ima: Move some IMA policy and filesystem related variables into ima_namespace Stefan Berger
2021-12-07 20:21 ` [PATCH v4 14/16] ima: Use mac_admin_ns_capable() to check corresponding capability Stefan Berger
2021-12-08 12:40 ` Christian Brauner
2021-12-07 20:21 ` [PATCH v4 15/16] ima: Move dentries into ima_namespace Stefan Berger
2021-12-07 20:21 ` [PATCH v4 16/16] ima: Setup securityfs for IMA namespace Stefan Berger
2021-12-08 12:58 ` Christian Brauner
2021-12-08 13:16 ` Christian Brauner
2021-12-08 14:11 ` James Bottomley
2021-12-08 14:46 ` Christian Brauner
2021-12-08 15:04 ` James Bottomley
2021-12-08 15:22 ` Christian Brauner
2021-12-08 15:39 ` Stefan Berger
2021-12-08 15:49 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a68ead0d882410a4cdf86f677973864fafc590d8.camel@HansenPartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=christian.brauner@ubuntu.com \
--cc=containers@lists.linux.dev \
--cc=dmitry.kasatkin@gmail.com \
--cc=ebiederm@xmission.com \
--cc=jamjoom@us.ibm.com \
--cc=jarkko.sakkinen@iki.fi \
--cc=jmorris@namei.org \
--cc=krzysztof.struczynski@huawei.com \
--cc=lhinds@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lsturman@redhat.com \
--cc=mpeters@redhat.com \
--cc=paul@paul-moore.com \
--cc=puiterwi@redhat.com \
--cc=rgb@redhat.com \
--cc=roberto.sassu@huawei.com \
--cc=serge@hallyn.com \
--cc=stefanb@linux.ibm.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®