Re: [dm-devel] [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE)

2020-08-07 Thread Mimi Zohar
On Fri, 2020-08-07 at 13:31 -0400, Mimi Zohar wrote: > On Sat, 2020-08-08 at 02:41 +1000, James Morris wrote: > > On Thu, 6 Aug 2020, Mimi Zohar wrote: > > > > > On Thu, 2020-08-06 at 09:51 +1000, James Morris wrote: > > > > On Wed, 5 Aug 2020, Mimi Zohar wrote: > > > > > > > > > If block layer

Re: [dm-devel] [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE)

2020-08-07 Thread Mimi Zohar
On Sat, 2020-08-08 at 02:41 +1000, James Morris wrote: > On Thu, 6 Aug 2020, Mimi Zohar wrote: > > > On Thu, 2020-08-06 at 09:51 +1000, James Morris wrote: > > > On Wed, 5 Aug 2020, Mimi Zohar wrote: > > > > > > > If block layer integrity was enough, there wouldn't have been a need > > > > for

Re: [dm-devel] [RFC PATCH v5 00/11] Integrity Policy Enforcement LSM (IPE)

2020-08-07 Thread James Morris
On Thu, 6 Aug 2020, Mimi Zohar wrote: > On Thu, 2020-08-06 at 09:51 +1000, James Morris wrote: > > On Wed, 5 Aug 2020, Mimi Zohar wrote: > > > > > If block layer integrity was enough, there wouldn't have been a need > > > for fs-verity. Even fs-verity is limited to read only filesystems, > > >

Re: [PATCH ghak90 V9 11/13] audit: contid check descendancy and nesting

2020-08-07 Thread Richard Guy Briggs
On 2020-07-05 11:11, Paul Moore wrote: > On Sat, Jun 27, 2020 at 9:23 AM Richard Guy Briggs wrote: > > Require the target task to be a descendant of the container > > orchestrator/engine. > > > > You would only change the audit container ID from one set or inherited > > value to another if you