Messages in this thread | | | Date | Thu, 16 Dec 2021 16:38:02 -0500 | Subject | Re: [PATCH v7 14/14] ima: Setup securityfs for IMA namespace | From | Stefan Berger <> |
| |
On 12/16/21 08:51, Christian Brauner wrote: > >> +int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root) >> { >> struct ima_namespace *ns = user_ns->ima_ns; >> - struct dentry *ima_dir; >> + struct dentry *int_dir; >> + struct dentry *ima_dir = NULL; >> struct dentry *ima_symlink = NULL; >> struct dentry *binary_runtime_measurements = NULL; >> struct dentry *ascii_runtime_measurements = NULL; >> struct dentry *runtime_measurements_count = NULL; >> struct dentry *violations = NULL; >> >> - ima_dir = securityfs_create_dir("ima", integrity_dir); >> + /* FIXME: update when evm and integrity are namespaced */ >> + if (user_ns != &init_user_ns) { >> + int_dir = >> + securityfs_create_dir("integrity", root); >> + if (IS_ERR(int_dir)) >> + return -1; > That should probably be return PTR_ERR(int_dir)
That's actually from current usptream ( https://elixir.bootlin.com/linux/latest/source/security/integrity/ima/ima_fs.c#L457 ) The question is then whether at the end it should also return something else than what it currently returns:
out: securityfs_remove(violations);
[...]
securityfs_remove(ima_policy); return -1;
| |