On Thu, Jan 13, 2022 at 03:26:51PM -0500, Mimi Zohar wrote: > Hi Stefan, > > On Tue, 2022-01-04 at 12:04 -0500, Stefan Berger wrote: > > From: Stefan Berger <stefanb@xxxxxxxxxxxxx> > > > > Move variables related to the IMA policy into the ima_namespace. This way > > the IMA policy of an IMA namespace can be set and displayed using a > > front-end like SecurityFS. > > > > Implement ima_ns_from_file() to get the IMA namespace via the user > > namespace of the SecurityFS superblock that a file belongs to. > > > > To get the current ima_namespace use get_current_ns() when a function > > that is related to a policy rule is called. In other cases where functions > > are called due file attribute modifications, use init_ima_ns, since these > > functions are related to IMA appraisal and changes to file attributes are > > only relevant to the init_ima_ns until IMA namespaces also support IMA > > appraisal. In ima_file_free() use init_ima_ns since in this case flags > > related to file measurements may be affected, which is not supported in > > IMA namespaces, yet. > > > > Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx> > > Please split this patch into "ima: pass through ima namespace", or some > other name, and "ima: Move policy related variables into > ima_namespace". The other option is to combine the "pass through ima > namespace" with the 2nd patch, like Christian's example. I was just about to comment something similar on 02/19. I would also not introduce get_current_ns(). It's simply more honest and if &init_ima_ns is used everywhere until multiple namespaces can actually exists.
