IMA Namespace support

[IlyaHanov]

The Linux kernel community is now working on supporting IMA namespaces
and it is almost done. It is a new kernel feature that allows isolation of Platform Configuration Register (PCR) values, Measurement Logs (ML), etc. As this need to add a new flag for json configuration the related issue opened for runtime-spec.

Signed-off-by: Ilya Hanov [email protected]

Advanced Software Technology Lab
Huawei

[h-vetinari]

The Linux kernel community is now working on supporting IMA namespaces and it is almost done.

Link to the most recent v14 (almost 2 months ago); still not in mainline

[IlyaHanov]

AFAIK, this is the last version, IMA namespaces are being ready for testing, so it will be in mainline, may be not now, but it will. The goal of this patchset is to discuss the architecture of runC to understand the pros and cons in advance, because IMA-ns has different interface for creating namespaces and runC is not aware of such ns types (of course, this is the first time, when the Linux Kernel Community decided to choose such a solution)