On Thu, Jul 20, 2017 at 06:50:29PM -0400, Mehmet Kayaalp wrote: > From: Yuqiong Sun <suny@xxxxxxxxxx> > > Add new CONFIG_IMA_NS config option. Let clone() create a new IMA > namespace upon CLONE_NEWNS flag. Add ima_ns data structure in nsproxy. > ima_ns is allocated and freed upon IMA namespace creation and exit. > Currently, the ima_ns contains no useful IMA data but only a dummy > interface. This patch creates the framework for namespacing the different > aspects of IMA (eg. IMA-audit, IMA-measurement, IMA-appraisal). > > Signed-off-by: Yuqiong Sun <suny@xxxxxxxxxx> > > Changelog: > * Use CLONE_NEWNS instead of a new CLONE_NEWIMA flag Hi, So this means that every mount namespace clone will clone a new IMA namespace. Is that really ok? _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
