On 12/16/21 08:51, Christian Brauner wrote:

quoted

+int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
  {
  	struct ima_namespace *ns = user_ns->ima_ns;
-	struct dentry *ima_dir;
+	struct dentry *int_dir;
+	struct dentry *ima_dir = NULL;
  	struct dentry *ima_symlink = NULL;
  	struct dentry *binary_runtime_measurements = NULL;
  	struct dentry *ascii_runtime_measurements = NULL;
  	struct dentry *runtime_measurements_count = NULL;
  	struct dentry *violations = NULL;
  
-	ima_dir = securityfs_create_dir("ima", integrity_dir);
+	/* FIXME: update when evm and integrity are namespaced */
+	if (user_ns != &init_user_ns) {
+		int_dir =
+			securityfs_create_dir("integrity", root);
+		if (IS_ERR(int_dir))
+			return -1;

That should probably be return PTR_ERR(int_dir)

That's actually from current usptream ( 
https://elixir.bootlin.com/linux/latest/source/security/integrity/ima/ima_fs.c#L457 
) The question is then whether at the end it should also return 
something else than what it currently returns:

out:
     securityfs_remove(violations);

     [...]

     securityfs_remove(ima_policy);
     return -1;