Re: [PATCH v7 14/14] ima: Setup securityfs for IMA namespace

[Stefan Berger]

On 12/16/21 08:51, Christian Brauner wrote:
> > +int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
> >   {
> >   	struct ima_namespace *ns = user_ns->ima_ns;
> > -	struct dentry *ima_dir;
> > +	struct dentry *int_dir;
> > +	struct dentry *ima_dir = NULL;
> >   	struct dentry *ima_symlink = NULL;
> >   	struct dentry *binary_runtime_measurements = NULL;
> >   	struct dentry *ascii_runtime_measurements = NULL;
> >   	struct dentry *runtime_measurements_count = NULL;
> >   	struct dentry *violations = NULL;
> >   
> > -	ima_dir = securityfs_create_dir("ima", integrity_dir);
> > +	/* FIXME: update when evm and integrity are namespaced */
> > +	if (user_ns != &init_user_ns) {
> > +		int_dir =
> > +			securityfs_create_dir("integrity", root);
> > +		if (IS_ERR(int_dir))
> > +			return -1;
> That should probably be return PTR_ERR(int_dir)

That's actually from current usptream ( 
https://elixir.bootlin.com/linux/latest/source/security/integrity/ima/ima_fs.c#L457 
) The question is then whether at the end it should also return 
something else than what it currently returns:

out:
    securityfs_remove(violations);

    [...]

    securityfs_remove(ima_policy);
    return -1;