[RFC]: IMA Namespace support

[IlyaHanov]

The Linux kernel community is now working on supporting IMA namespaces
and it is almost done. It is a new kernel feature that allows isolation of Platform Configuration Register (PCR) values, Measurement Logs (ML), etc. The related issue is #1163.

Signed-off-by: Ilya Hanov ilya.hanov@huawei-partners.com

Advanced Software Technology Lab
Huawei

[AkihiroSuda]

https://github.com/opencontainers/runtime-spec/blob/main/config-linux.md needs to be updated too

[AkihiroSuda]

Let me mark this as a draft, until the kernel patch gets merged into the upstream

[tianon]

IMO this is a little bit premature -- ideally this functionality would be at least merged into the kernel (if not in an actual released version) before we implement or discuss it in this context. What I would suggest in the future would be a posting to the OCI dev mailing list, OCI #general channel on Slack, etc if your goal is to get folks from the OCI aware of and potentially involved in the upstream kernel discussions.

[DenisSemakin]

IMO this is a little bit premature...

I think it's Yes and No simultaneously... Of course, the IMA namespace feature is not merged in kernel mainline and may be will not for some time.
But the way how to launch (activate) IMA namespace for given user namespace is stable ... more or less. Basically, this is the attempt to use IMA-ns in runC if the feature would be merged in kernel upstream and find out a number of problems and issues with this way.

[IlyaHanov]

IMO this is a little bit premature -- ideally this functionality would be at least merged into the kernel (if not in an actual released version) before we implement or discuss it in this context. What I would suggest in the future would be a posting to the OCI dev mailing list, OCI #general channel on Slack, etc if your goal is to get folks from the OCI aware of and potentially involved in the upstream kernel discussions.

Yes, you're right in a way, IMA namespaces is not in upstream, but there's another interesting problem with runC. This is related to why IMA namespace uses securityFS to create namespaces, but runC doesn't know about namespaces which are created not by using clone/unshare at all. This patchset (one for runC, one for runtime-spec) presented not only IMA namespace creation scheme, but tries to solve this problem as well, because if kernel community decides to invent another namespace, sooner or later this problem will show up.