On Wed, Jan 20, 2016 at 10:56:21PM -0500, Stefan Berger wrote: > The IMA namespace is created as part of clone(). You cannot pass anything via > clone(). So you either have to do it before or immediately after. If after is > too later for whatever reason, you have to do it before.
Follow the pattern of something like the net ns. clone creates an 'empty' IMA namespace. After clone the child waits for the parent to complete its work. The parent creates a new vtpm /dev/tpm1 in it's namespace The parent does a kernel call to make tpm1 visiable in the child's IMA namespace as tpm0. (eg look at the 'ip link set .. netns ..' kind of scheme for inspiration) Hook the tpm core's id to struct tpm_chip code into the IMA namespace so that /dev/tpm0 and all other places actually access tpm1 when used in the child's IMA namespace The parent signals the child to continue to run. The child has a /dev/tpm0 that is actually routed to /dev/tpm1. The child is prevented from accessing other tpms. > > I think what you are missing is that nobody uses mainline containers > > for the kind of strong isolation you are thinking about. Out-of-tree > > patches are used by those people and, as I understand it, they cover > > all these issues. > > ?? Out-of-tree patches? Sorry, I don't recall the names of al lthe involved parties. lxr, and there is a notable company whose name eludes me right now. I had a very interesting discussion on this with James Bottomley at a conference once. Maybe look up device namespaces and look at the threads/etc on that for a clue what the status is? > Basically you suggest to ignore the potential leaking between containers. Just > register with sysfs ? Ignore in the sense that mainline doesn't have the tools to address the issue. If it is important to you then build out general capability in mainline, don't hack it like this :) Another approach would be to try and copy what netns does and link tpm visibility through a IMA namespace (as described above) directly to sysfs visibility - I have never looked at how that is done though :| > > Then just return the fd like I said. > > Any driver that can be used as an example ? The stuff in include/linux/anon_inodes.h is used to do this, eg a sequence of anon_inode_getfile, get_unused_fd_flags, fd_install will create a file descriptor in the calling process associated with a struct file_operations > > auto-delete a master char dev on close is a very strange API, don't do > > that. > > What I called cleanup can be trigger by the vTPM closing /dev/vtpms%d, so the > server-side. What is the master for you? /dev/vtpmx where we run the ioctls > on? Sorry, master/slave is the ptx nomenclature for this scheme. Master would be your server side I think. Jason ------------------------------------------------------------------------------ Site24x7 APM Insight: Get Deep Visibility into Application Performance APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month Monitor end-to-end web transactions and take corrective actions now Troubleshoot faster and improve end-user experience. Signup Now! http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140 _______________________________________________ tpmdd-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tpmdd-devel
