Namespacing the Linux Integrity Measurement Architecture
summary
Work produces a prototype and >100 patches that add per-container IMA: it piggybacks on user namespace by creating a mountable, per-namespace securityfs that yields per-namespace securityfs and keyrings, a per-namespace IMA log, and hierarchical policy evaluation so child activity is evaluated and re-logged up to the root. Implementation uses rb-tree + linked lists with group locking, a runC prototype, a test suite (unshare, nsenter, BusyBox, keyctl) that runs hundreds of containers concurrently, and supports virtual TPM attached per namespace. Measured overhead is small (~1% baseline) but double-measurement cases still slow builds.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:07IMA Namespacing - Motivation
- 5:49IMA Namespacing - Background • 8 namespaces: Cgroup, IPC, Network, Mount, PID, Time, User, UTS
- 9:05IMA Namespaces - Creating an IMA-ns
- 17:12IMA Namespacing - Challenges
- 29:16IMA Namespacing - Organization of iint's
- 30:55IMA Namespacing - Mesh Problem
- 32:32IMA Namespacing -- Performance
- 37:15IMA Namespacing - Test Suite
- 39:30IMA Namespacing - Upstreaming
- 42:24IMA Namespacing - Userspace
- 43:58IMA Namespacing - Summary
related talks
29mIMA Namespaces for Containers
32mSecurity Namespace: Making Linux Security Frameworks Available to Containers
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
35mIntegrity Measurements and the Cruel World
08mIn Containers We Trust? Building Trust in Containerized Environments
36mOverview and Recent Developments: Linux Integrity
19mNFS Support for the Linux Integrity Measurement Architecture
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...