Re: [RFC v2 19/19] ima: Setup securityfs for IMA namespace

[Stefan Berger]

On 12/3/21 14:11, Stefan Berger wrote:
> On 12/3/21 13:50, James Bottomley wrote:
>
>
> > > Where would the vfsmount pointer reside? For now it's in
> > > ima_namespace, but it sounds like it should be in a more centralized
> > > place? Should it also be  connected to the user_namespace so we can
> > > pick it up using get_user_ns()?
> > exactly.  I think struct user_namespace should have two elements gated
> > by a #ifdef CONFIG_SECURITYFS which are the vfsmount and the
> > mount_count for passing into simple_pin_fs.
>
> Also that we can do for as long as it flies beyond the conversation 
> here... :-) Anyone else have an opinion ?

I moved it now and this greatly reduced the amount of changes. The 
dentries are now all in the ima_namespace and it works with one API. Thanks!

I wonder whether to move the integrity dir also into the ima_namespace. 
It's generated in integrity/iint.c, so not in the IMA territory... For 
the IMA namespacing case I need to create it as well, though.

https://elixir.bootlin.com/linux/latest/source/security/integrity/iint.c#L218

   Stefan