Re: [PATCH v5 13/16] ima: Move some IMA policy and filesystem related variables into ima_namespace

 From 1f03dc427c583d5e9ebc9ebe9de77c3c535bbebe Mon Sep 17 00:00:00 2001
From: Christian Brauner <redacted>
Date: Thu, 9 Dec 2021 20:07:02 +0100
Subject: [PATCH] !!!! HERE BE DRAGONS - UNTESTED !!!!

---
  security/integrity/ima/ima_fs.c | 43 +++++++++++++++++++++++++++++----
  1 file changed, 38 insertions(+), 5 deletions(-)

diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 583462b29cb5..d5b302b925b8 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c

@@ -317,10 +317,14 @@ static ssize_t ima_read_policy(char *path)
  static ssize_t ima_write_policy(struct file *file, const char __user *buf,
  				size_t datalen, loff_t *ppos)
  {
-	struct ima_namespace *ns = get_current_ns();
+	struct ima_namespace *ns;
+	struct user_namespace *user_ns;
  	char *data;
  	ssize_t result;
  
+	user_ns = ima_filp_private(filp);
+	ns = user_ns->ima_ns
+
  	if (datalen >= PAGE_SIZE)
  		datalen = PAGE_SIZE - 1;
  

@@ -373,26 +377,51 @@ static const struct seq_operations ima_policy_seqops = {
  };
  #endif
  
+static struct user_namespace *ima_filp_private(struct file *filp)
+{
+	if (!(filp->f_flags & O_WRONLY)) {
+#ifdef CONFIG_IMA_READ_POLICY
+		struct seq_file *seq;
+
+		seq = filp->private_data;
+		return seq->private;
+#endif
+	}
+	return filp->private_data;
+}
+
  /*
   * ima_open_policy: sequentialize access to the policy file
   */
  static int ima_open_policy(struct inode *inode, struct file *filp)
  {
-	struct ima_namespace *ns = get_current_ns();
+	struct user_namespace *user_ns = current_user_ns();