Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread Jann Horn
On Fri, Sep 28, 2018 at 1:43 AM James Morris wrote: > On Thu, 27 Sep 2018, Schaufler, Casey wrote: > > > > On 9/27/2018 2:45 PM, James Morris wrote: > > > > > On Wed, 26 Sep 2018, Casey Schaufler wrote: > > > > > > > > > >> + /* > > > > >> + * Namespace checks. Considered safe if: > >

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread Jann Horn
On Fri, Sep 28, 2018 at 1:43 AM James Morris wrote: > On Thu, 27 Sep 2018, Schaufler, Casey wrote: > > > > On 9/27/2018 2:45 PM, James Morris wrote: > > > > > On Wed, 26 Sep 2018, Casey Schaufler wrote: > > > > > > > > > >> + /* > > > > >> + * Namespace checks. Considered safe if: > >

RE: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread James Morris
On Thu, 27 Sep 2018, Schaufler, Casey wrote: > > > On 9/27/2018 2:45 PM, James Morris wrote: > > > > On Wed, 26 Sep 2018, Casey Schaufler wrote: > > > > > > > >> + /* > > > >> + * Namespace checks. Considered safe if: > > > >> + * cgroup namespace is the same > > > >> +

RE: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread James Morris
On Thu, 27 Sep 2018, Schaufler, Casey wrote: > > > On 9/27/2018 2:45 PM, James Morris wrote: > > > > On Wed, 26 Sep 2018, Casey Schaufler wrote: > > > > > > > >> + /* > > > >> + * Namespace checks. Considered safe if: > > > >> + * cgroup namespace is the same > > > >> +

RE: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread Schaufler, Casey
nel.org; Hansen, Dave > ; linux-security-mod...@vger.kernel.org; > seli...@tycho.nsa.gov; ar...@linux.intel.com > Subject: Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel > > On Thu, 27 Sep 2018, Casey Schaufler wrote: > > > On 9/27/2018 2:45 PM, James M

RE: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread Schaufler, Casey
nel.org; Hansen, Dave > ; linux-security-mod...@vger.kernel.org; > seli...@tycho.nsa.gov; ar...@linux.intel.com > Subject: Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel > > On Thu, 27 Sep 2018, Casey Schaufler wrote: > > > On 9/27/2018 2:45 PM, James M

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread James Morris
On Thu, 27 Sep 2018, Casey Schaufler wrote: > On 9/27/2018 2:45 PM, James Morris wrote: > > On Wed, 26 Sep 2018, Casey Schaufler wrote: > > > >> + /* > >> + * Namespace checks. Considered safe if: > >> + * cgroup namespace is the same > >> + * User namespace is the same > >> +

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread James Morris
On Thu, 27 Sep 2018, Casey Schaufler wrote: > On 9/27/2018 2:45 PM, James Morris wrote: > > On Wed, 26 Sep 2018, Casey Schaufler wrote: > > > >> + /* > >> + * Namespace checks. Considered safe if: > >> + * cgroup namespace is the same > >> + * User namespace is the same > >> +

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread Casey Schaufler
On 9/27/2018 2:45 PM, James Morris wrote: > On Wed, 26 Sep 2018, Casey Schaufler wrote: > >> +/* >> + * Namespace checks. Considered safe if: >> + * cgroup namespace is the same >> + * User namespace is the same >> + * PID namespace is the same >> + */ >> +

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread Casey Schaufler
On 9/27/2018 2:45 PM, James Morris wrote: > On Wed, 26 Sep 2018, Casey Schaufler wrote: > >> +/* >> + * Namespace checks. Considered safe if: >> + * cgroup namespace is the same >> + * User namespace is the same >> + * PID namespace is the same >> + */ >> +

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread James Morris
On Wed, 26 Sep 2018, Casey Schaufler wrote: > + /* > + * Namespace checks. Considered safe if: > + * cgroup namespace is the same > + * User namespace is the same > + * PID namespace is the same > + */ > + if (current->nsproxy) > + ccgn

Re: [PATCH v5 5/5] sidechannel: Linux Security Module for sidechannel

2018-09-27 Thread James Morris
On Wed, 26 Sep 2018, Casey Schaufler wrote: > + /* > + * Namespace checks. Considered safe if: > + * cgroup namespace is the same > + * User namespace is the same > + * PID namespace is the same > + */ > + if (current->nsproxy) > + ccgn