diff mbox series

[v7,14/14] ima: Setup securityfs for IMA namespace

Message ID 20211216054323.1707384-15-stefanb@linux.vnet.ibm.com (mailing list archive)
State New, archived
Headers show
Series ima: Namespace IMA with audit support in IMA-ns | expand

Commit Message

Stefan Berger Dec. 16, 2021, 5:43 a.m. UTC 
From: Stefan Berger <stefanb@linux.ibm.com>

Setup securityfs with symlinks, directories, and files for IMA
namespacing support. The same directory structure that IMA uses on the
host is also created for the namespacing case.

The securityfs file and directory ownerships cannot be set when the
IMA namespace is initialized. Therefore, delay the setup of the file
system to a later point when securityfs is in securityfs_fill_super.

This filesystem can now be mounted as follows:

mount -t securityfs /sys/kernel/security/ /sys/kernel/security/

The following directories, symlinks, and files are then available.

$ ls -l sys/kernel/security/
total 0
lr--r--r--. 1 root root 0 Dec  2 00:18 ima -> integrity/ima
drwxr-xr-x. 3 root root 0 Dec  2 00:18 integrity

$ ls -l sys/kernel/security/ima/
total 0
-r--r-----. 1 root root 0 Dec  2 00:18 ascii_runtime_measurements
-r--r-----. 1 root root 0 Dec  2 00:18 binary_runtime_measurements
-rw-------. 1 root root 0 Dec  2 00:18 policy
-r--r-----. 1 root root 0 Dec  2 00:18 runtime_measurements_count
-r--r-----. 1 root root 0 Dec  2 00:18 violations

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
---
 include/linux/ima.h             | 14 ++++++++++++
 security/inode.c                |  6 ++++-
 security/integrity/ima/ima.h    |  1 +
 security/integrity/ima/ima_fs.c | 40 ++++++++++++++++++++++++---------
 4 files changed, 49 insertions(+), 12 deletions(-)

Comments

kernel test robot Dec. 16, 2021, 10:59 a.m. UTC | #1 
Hi Stefan,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on zohar-integrity/next-integrity]
[also build test WARNING on linux/master linus/master v5.16-rc5]
[cannot apply to jmorris-security/next-testing next-20211215]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Stefan-Berger/ima-Namespace-IMA-with-audit-support-in-IMA-ns/20211216-134611
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
config: sh-allmodconfig (https://download.01.org/0day-ci/archive/20211216/202112161827.mbpxbf1k-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/bc2f1f683efbf2ad7b955fd4afc78861609eff4b
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Stefan-Berger/ima-Namespace-IMA-with-audit-support-in-IMA-ns/20211216-134611
        git checkout bc2f1f683efbf2ad7b955fd4afc78861609eff4b
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=sh SHELL=/bin/bash security/integrity/ima/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

>> security/integrity/ima/ima_fs.c:451:5: warning: no previous prototype for 'ima_fs_ns_init' [-Wmissing-prototypes]
     451 | int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
         |     ^~~~~~~~~~~~~~


vim +/ima_fs_ns_init +451 security/integrity/ima/ima_fs.c

   450	
 > 451	int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
   452	{
   453		struct ima_namespace *ns = user_ns->ima_ns;
   454		struct dentry *int_dir;
   455		struct dentry *ima_dir = NULL;
   456		struct dentry *ima_symlink = NULL;
   457		struct dentry *binary_runtime_measurements = NULL;
   458		struct dentry *ascii_runtime_measurements = NULL;
   459		struct dentry *runtime_measurements_count = NULL;
   460		struct dentry *violations = NULL;
   461	
   462		/* FIXME: update when evm and integrity are namespaced */
   463		if (user_ns != &init_user_ns) {
   464			int_dir =
   465				securityfs_create_dir("integrity", root);
   466			if (IS_ERR(int_dir))
   467				return -1;
   468		} else
   469			int_dir = integrity_dir;
   470	
   471		ima_dir = securityfs_create_dir("ima", int_dir);
   472		if (IS_ERR(ima_dir))
   473			goto out;
   474	
   475		ima_symlink = securityfs_create_symlink("ima", root, "integrity/ima",
   476							NULL);
   477		if (IS_ERR(ima_symlink))
   478			goto out;
   479	
   480		binary_runtime_measurements =
   481		    securityfs_create_file("binary_runtime_measurements",
   482					   S_IRUSR | S_IRGRP, ima_dir, NULL,
   483					   &ima_measurements_ops);
   484		if (IS_ERR(binary_runtime_measurements))
   485			goto out;
   486	
   487		ascii_runtime_measurements =
   488		    securityfs_create_file("ascii_runtime_measurements",
   489					   S_IRUSR | S_IRGRP, ima_dir, NULL,
   490					   &ima_ascii_measurements_ops);
   491		if (IS_ERR(ascii_runtime_measurements))
   492			goto out;
   493	
   494		runtime_measurements_count =
   495		    securityfs_create_file("runtime_measurements_count",
   496					   S_IRUSR | S_IRGRP, ima_dir, NULL,
   497					   &ima_measurements_count_ops);
   498		if (IS_ERR(runtime_measurements_count))
   499			goto out;
   500	
   501		violations =
   502		    securityfs_create_file("violations", S_IRUSR | S_IRGRP,
   503					   ima_dir, NULL, &ima_htable_violations_ops);
   504		if (IS_ERR(violations))
   505			goto out;
   506	
   507	
   508		if (!ns->policy_dentry_removed) {
   509			ns->policy_dentry =
   510			    securityfs_create_file("policy", POLICY_FILE_FLAGS,
   511						   ima_dir, NULL,
   512						   &ima_measure_policy_ops);
   513			if (IS_ERR(ns->policy_dentry))
   514				goto out;
   515		}
   516	
   517		return 0;
   518	out:
   519		securityfs_remove(ns->policy_dentry);
   520		securityfs_remove(violations);
   521		securityfs_remove(runtime_measurements_count);
   522		securityfs_remove(ascii_runtime_measurements);
   523		securityfs_remove(binary_runtime_measurements);
   524		securityfs_remove(ima_symlink);
   525		securityfs_remove(ima_dir);
   526		if (user_ns != &init_user_ns)
   527			securityfs_remove(integrity_dir);
   528	
   529		return -1;
   530	}
   531	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
kernel test robot Dec. 16, 2021, 12:02 p.m. UTC | #2 
Hi Stefan,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on zohar-integrity/next-integrity]
[also build test WARNING on linux/master linus/master v5.16-rc5]
[cannot apply to jmorris-security/next-testing next-20211215]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Stefan-Berger/ima-Namespace-IMA-with-audit-support-in-IMA-ns/20211216-134611
base:   https://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next-integrity
config: mips-buildonly-randconfig-r006-20211216 (https://download.01.org/0day-ci/archive/20211216/202112161948.NK58RGVT-lkp@intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project dd245bab9fbb364faa1581e4f92ba3119a872fba)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install mips cross compiling tool for clang build
        # apt-get install binutils-mips-linux-gnu
        # https://github.com/0day-ci/linux/commit/bc2f1f683efbf2ad7b955fd4afc78861609eff4b
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Stefan-Berger/ima-Namespace-IMA-with-audit-support-in-IMA-ns/20211216-134611
        git checkout bc2f1f683efbf2ad7b955fd4afc78861609eff4b
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=mips SHELL=/bin/bash security/integrity/ima/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

>> security/integrity/ima/ima_fs.c:451:5: warning: no previous prototype for function 'ima_fs_ns_init' [-Wmissing-prototypes]
   int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
       ^
   security/integrity/ima/ima_fs.c:451:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
   int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
   ^
   static 
   1 warning generated.


vim +/ima_fs_ns_init +451 security/integrity/ima/ima_fs.c

   450	
 > 451	int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
   452	{
   453		struct ima_namespace *ns = user_ns->ima_ns;
   454		struct dentry *int_dir;
   455		struct dentry *ima_dir = NULL;
   456		struct dentry *ima_symlink = NULL;
   457		struct dentry *binary_runtime_measurements = NULL;
   458		struct dentry *ascii_runtime_measurements = NULL;
   459		struct dentry *runtime_measurements_count = NULL;
   460		struct dentry *violations = NULL;
   461	
   462		/* FIXME: update when evm and integrity are namespaced */
   463		if (user_ns != &init_user_ns) {
   464			int_dir =
   465				securityfs_create_dir("integrity", root);
   466			if (IS_ERR(int_dir))
   467				return -1;
   468		} else
   469			int_dir = integrity_dir;
   470	
   471		ima_dir = securityfs_create_dir("ima", int_dir);
   472		if (IS_ERR(ima_dir))
   473			goto out;
   474	
   475		ima_symlink = securityfs_create_symlink("ima", root, "integrity/ima",
   476							NULL);
   477		if (IS_ERR(ima_symlink))
   478			goto out;
   479	
   480		binary_runtime_measurements =
   481		    securityfs_create_file("binary_runtime_measurements",
   482					   S_IRUSR | S_IRGRP, ima_dir, NULL,
   483					   &ima_measurements_ops);
   484		if (IS_ERR(binary_runtime_measurements))
   485			goto out;
   486	
   487		ascii_runtime_measurements =
   488		    securityfs_create_file("ascii_runtime_measurements",
   489					   S_IRUSR | S_IRGRP, ima_dir, NULL,
   490					   &ima_ascii_measurements_ops);
   491		if (IS_ERR(ascii_runtime_measurements))
   492			goto out;
   493	
   494		runtime_measurements_count =
   495		    securityfs_create_file("runtime_measurements_count",
   496					   S_IRUSR | S_IRGRP, ima_dir, NULL,
   497					   &ima_measurements_count_ops);
   498		if (IS_ERR(runtime_measurements_count))
   499			goto out;
   500	
   501		violations =
   502		    securityfs_create_file("violations", S_IRUSR | S_IRGRP,
   503					   ima_dir, NULL, &ima_htable_violations_ops);
   504		if (IS_ERR(violations))
   505			goto out;
   506	
   507	
   508		if (!ns->policy_dentry_removed) {
   509			ns->policy_dentry =
   510			    securityfs_create_file("policy", POLICY_FILE_FLAGS,
   511						   ima_dir, NULL,
   512						   &ima_measure_policy_ops);
   513			if (IS_ERR(ns->policy_dentry))
   514				goto out;
   515		}
   516	
   517		return 0;
   518	out:
   519		securityfs_remove(ns->policy_dentry);
   520		securityfs_remove(violations);
   521		securityfs_remove(runtime_measurements_count);
   522		securityfs_remove(ascii_runtime_measurements);
   523		securityfs_remove(binary_runtime_measurements);
   524		securityfs_remove(ima_symlink);
   525		securityfs_remove(ima_dir);
   526		if (user_ns != &init_user_ns)
   527			securityfs_remove(integrity_dir);
   528	
   529		return -1;
   530	}
   531	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Christian Brauner Dec. 16, 2021, 1:51 p.m. UTC | #3 
On Thu, Dec 16, 2021 at 12:43:23AM -0500, Stefan Berger wrote:
> From: Stefan Berger <stefanb@linux.ibm.com>
> 
> Setup securityfs with symlinks, directories, and files for IMA
> namespacing support. The same directory structure that IMA uses on the
> host is also created for the namespacing case.
> 
> The securityfs file and directory ownerships cannot be set when the
> IMA namespace is initialized. Therefore, delay the setup of the file
> system to a later point when securityfs is in securityfs_fill_super.
> 
> This filesystem can now be mounted as follows:
> 
> mount -t securityfs /sys/kernel/security/ /sys/kernel/security/
> 
> The following directories, symlinks, and files are then available.
> 
> $ ls -l sys/kernel/security/
> total 0
> lr--r--r--. 1 root root 0 Dec  2 00:18 ima -> integrity/ima
> drwxr-xr-x. 3 root root 0 Dec  2 00:18 integrity
> 
> $ ls -l sys/kernel/security/ima/
> total 0
> -r--r-----. 1 root root 0 Dec  2 00:18 ascii_runtime_measurements
> -r--r-----. 1 root root 0 Dec  2 00:18 binary_runtime_measurements
> -rw-------. 1 root root 0 Dec  2 00:18 policy
> -r--r-----. 1 root root 0 Dec  2 00:18 runtime_measurements_count
> -r--r-----. 1 root root 0 Dec  2 00:18 violations
> 
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
> ---
>  include/linux/ima.h             | 14 ++++++++++++
>  security/inode.c                |  6 ++++-
>  security/integrity/ima/ima.h    |  1 +
>  security/integrity/ima/ima_fs.c | 40 ++++++++++++++++++++++++---------
>  4 files changed, 49 insertions(+), 12 deletions(-)
> 
> diff --git a/include/linux/ima.h b/include/linux/ima.h
> index f9e592bb9560..a2705aa5242a 100644
> --- a/include/linux/ima.h
> +++ b/include/linux/ima.h
> @@ -40,6 +40,7 @@ extern int ima_measure_critical_data(const char *event_label,
>  				     const char *event_name,
>  				     const void *buf, size_t buf_len,
>  				     bool hash, u8 *digest, size_t digest_len);
> +extern int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root);
>  
>  #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
>  extern void ima_appraise_parse_cmdline(void);
> @@ -232,6 +233,12 @@ static inline struct ima_namespace *get_current_ns(void)
>  	return current_user_ns()->ima_ns;
>  }
>  
> +static inline int ima_securityfs_init(struct user_namespace *user_ns,
> +				      struct dentry *root)
> +{
> +	return ima_fs_ns_init(user_ns, root);
> +}
> +
>  #else
>  
>  static inline void free_ima_ns(struct user_namespace *user_ns)
> @@ -250,6 +257,13 @@ static inline struct ima_namespace *get_current_ns(void)
>  {
>  	return &init_ima_ns;
>  }
> +
> +static inline int ima_securityfs_init(struct user_namespace *ns,
> +				      struct dentry *root)
> +{
> +	return 0;
> +}
> +
>  #endif /* CONFIG_IMA_NS */
>  
>  #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
> diff --git a/security/inode.c b/security/inode.c
> index a0d9f086e3d5..ad9395d121f2 100644
> --- a/security/inode.c
> +++ b/security/inode.c
> @@ -16,6 +16,7 @@
>  #include <linux/fs_context.h>
>  #include <linux/mount.h>
>  #include <linux/pagemap.h>
> +#include <linux/ima.h>
>  #include <linux/init.h>
>  #include <linux/namei.h>
>  #include <linux/security.h>
> @@ -77,7 +78,10 @@ static int securityfs_fill_super(struct super_block *sb, struct fs_context *fc)
>  	sb->s_op = &securityfs_super_operations;
>  	sb->s_root->d_inode->i_op = &securityfs_dir_inode_operations;
>  
> -	return 0;
> +	if (ns != &init_user_ns)
> +		error = ima_securityfs_init(ns, sb->s_root);
> +
> +	return error;
>  }
>  
>  static int securityfs_get_tree(struct fs_context *fc)
> diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
> index d51703290e25..9b0f6a3763f9 100644
> --- a/security/integrity/ima/ima.h
> +++ b/security/integrity/ima/ima.h
> @@ -148,6 +148,7 @@ struct ima_namespace {
>  	int valid_policy;
>  
>  	struct dentry *policy_dentry;
> +	bool policy_dentry_removed;
>  } __randomize_layout;
>  
>  extern const int read_idmap[];
> diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
> index 7c5a721f4f3d..3b8001ba62e3 100644
> --- a/security/integrity/ima/ima_fs.c
> +++ b/security/integrity/ima/ima_fs.c
> @@ -431,6 +431,7 @@ static int ima_release_policy(struct inode *inode, struct file *file)
>  #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
>  	securityfs_remove(ns->policy_dentry);
>  	ns->policy_dentry = NULL;
> +	ns->policy_dentry_removed = true;
>  #elif defined(CONFIG_IMA_WRITE_POLICY)
>  	clear_bit(IMA_FS_BUSY, &ns->ima_fs_flags);
>  #elif defined(CONFIG_IMA_READ_POLICY)
> @@ -447,21 +448,31 @@ static const struct file_operations ima_measure_policy_ops = {
>  	.llseek = generic_file_llseek,
>  };
>  
> -static int __init ima_fs_ns_init(struct user_namespace *user_ns)
> +int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
>  {
>  	struct ima_namespace *ns = user_ns->ima_ns;
> -	struct dentry *ima_dir;
> +	struct dentry *int_dir;
> +	struct dentry *ima_dir = NULL;
>  	struct dentry *ima_symlink = NULL;
>  	struct dentry *binary_runtime_measurements = NULL;
>  	struct dentry *ascii_runtime_measurements = NULL;
>  	struct dentry *runtime_measurements_count = NULL;
>  	struct dentry *violations = NULL;
>  
> -	ima_dir = securityfs_create_dir("ima", integrity_dir);
> +	/* FIXME: update when evm and integrity are namespaced */
> +	if (user_ns != &init_user_ns) {
> +		int_dir =
> +			securityfs_create_dir("integrity", root);
> +		if (IS_ERR(int_dir))
> +			return -1;

That should probably be return PTR_ERR(int_dir)
Stefan Berger Dec. 16, 2021, 9:38 p.m. UTC | #4 
On 12/16/21 08:51, Christian Brauner wrote:
>
>> +int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
>>   {
>>   	struct ima_namespace *ns = user_ns->ima_ns;
>> -	struct dentry *ima_dir;
>> +	struct dentry *int_dir;
>> +	struct dentry *ima_dir = NULL;
>>   	struct dentry *ima_symlink = NULL;
>>   	struct dentry *binary_runtime_measurements = NULL;
>>   	struct dentry *ascii_runtime_measurements = NULL;
>>   	struct dentry *runtime_measurements_count = NULL;
>>   	struct dentry *violations = NULL;
>>   
>> -	ima_dir = securityfs_create_dir("ima", integrity_dir);
>> +	/* FIXME: update when evm and integrity are namespaced */
>> +	if (user_ns != &init_user_ns) {
>> +		int_dir =
>> +			securityfs_create_dir("integrity", root);
>> +		if (IS_ERR(int_dir))
>> +			return -1;
> That should probably be return PTR_ERR(int_dir)

That's actually from current usptream ( 
https://elixir.bootlin.com/linux/latest/source/security/integrity/ima/ima_fs.c#L457 
) The question is then whether at the end it should also return 
something else than what it currently returns:

out:
     securityfs_remove(violations);

     [...]

     securityfs_remove(ima_policy);
     return -1;
diff mbox series

Patch

diff --git a/include/linux/ima.h b/include/linux/ima.h
index f9e592bb9560..a2705aa5242a 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -40,6 +40,7 @@  extern int ima_measure_critical_data(const char *event_label,
 				     const char *event_name,
 				     const void *buf, size_t buf_len,
 				     bool hash, u8 *digest, size_t digest_len);
+extern int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root);
 
 #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
 extern void ima_appraise_parse_cmdline(void);
@@ -232,6 +233,12 @@  static inline struct ima_namespace *get_current_ns(void)
 	return current_user_ns()->ima_ns;
 }
 
+static inline int ima_securityfs_init(struct user_namespace *user_ns,
+				      struct dentry *root)
+{
+	return ima_fs_ns_init(user_ns, root);
+}
+
 #else
 
 static inline void free_ima_ns(struct user_namespace *user_ns)
@@ -250,6 +257,13 @@  static inline struct ima_namespace *get_current_ns(void)
 {
 	return &init_ima_ns;
 }
+
+static inline int ima_securityfs_init(struct user_namespace *ns,
+				      struct dentry *root)
+{
+	return 0;
+}
+
 #endif /* CONFIG_IMA_NS */
 
 #if defined(CONFIG_IMA_APPRAISE) && defined(CONFIG_INTEGRITY_TRUSTED_KEYRING)
diff --git a/security/inode.c b/security/inode.c
index a0d9f086e3d5..ad9395d121f2 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -16,6 +16,7 @@ 
 #include <linux/fs_context.h>
 #include <linux/mount.h>
 #include <linux/pagemap.h>
+#include <linux/ima.h>
 #include <linux/init.h>
 #include <linux/namei.h>
 #include <linux/security.h>
@@ -77,7 +78,10 @@  static int securityfs_fill_super(struct super_block *sb, struct fs_context *fc)
 	sb->s_op = &securityfs_super_operations;
 	sb->s_root->d_inode->i_op = &securityfs_dir_inode_operations;
 
-	return 0;
+	if (ns != &init_user_ns)
+		error = ima_securityfs_init(ns, sb->s_root);
+
+	return error;
 }
 
 static int securityfs_get_tree(struct fs_context *fc)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index d51703290e25..9b0f6a3763f9 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -148,6 +148,7 @@  struct ima_namespace {
 	int valid_policy;
 
 	struct dentry *policy_dentry;
+	bool policy_dentry_removed;
 } __randomize_layout;
 
 extern const int read_idmap[];
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index 7c5a721f4f3d..3b8001ba62e3 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -431,6 +431,7 @@  static int ima_release_policy(struct inode *inode, struct file *file)
 #if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
 	securityfs_remove(ns->policy_dentry);
 	ns->policy_dentry = NULL;
+	ns->policy_dentry_removed = true;
 #elif defined(CONFIG_IMA_WRITE_POLICY)
 	clear_bit(IMA_FS_BUSY, &ns->ima_fs_flags);
 #elif defined(CONFIG_IMA_READ_POLICY)
@@ -447,21 +448,31 @@  static const struct file_operations ima_measure_policy_ops = {
 	.llseek = generic_file_llseek,
 };
 
-static int __init ima_fs_ns_init(struct user_namespace *user_ns)
+int ima_fs_ns_init(struct user_namespace *user_ns, struct dentry *root)
 {
 	struct ima_namespace *ns = user_ns->ima_ns;
-	struct dentry *ima_dir;
+	struct dentry *int_dir;
+	struct dentry *ima_dir = NULL;
 	struct dentry *ima_symlink = NULL;
 	struct dentry *binary_runtime_measurements = NULL;
 	struct dentry *ascii_runtime_measurements = NULL;
 	struct dentry *runtime_measurements_count = NULL;
 	struct dentry *violations = NULL;
 
-	ima_dir = securityfs_create_dir("ima", integrity_dir);
+	/* FIXME: update when evm and integrity are namespaced */
+	if (user_ns != &init_user_ns) {
+		int_dir =
+			securityfs_create_dir("integrity", root);
+		if (IS_ERR(int_dir))
+			return -1;
+	} else
+		int_dir = integrity_dir;
+
+	ima_dir = securityfs_create_dir("ima", int_dir);
 	if (IS_ERR(ima_dir))
-		return -1;
+		goto out;
 
-	ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima",
+	ima_symlink = securityfs_create_symlink("ima", root, "integrity/ima",
 						NULL);
 	if (IS_ERR(ima_symlink))
 		goto out;
@@ -493,11 +504,15 @@  static int __init ima_fs_ns_init(struct user_namespace *user_ns)
 	if (IS_ERR(violations))
 		goto out;
 
-	ns->policy_dentry = securityfs_create_file("policy", POLICY_FILE_FLAGS,
-					    ima_dir, NULL,
-					    &ima_measure_policy_ops);
-	if (IS_ERR(ns->policy_dentry))
-		goto out;
+
+	if (!ns->policy_dentry_removed) {
+		ns->policy_dentry =
+		    securityfs_create_file("policy", POLICY_FILE_FLAGS,
+					   ima_dir, NULL,
+					   &ima_measure_policy_ops);
+		if (IS_ERR(ns->policy_dentry))
+			goto out;
+	}
 
 	return 0;
 out:
@@ -508,10 +523,13 @@  static int __init ima_fs_ns_init(struct user_namespace *user_ns)
 	securityfs_remove(binary_runtime_measurements);
 	securityfs_remove(ima_symlink);
 	securityfs_remove(ima_dir);
+	if (user_ns != &init_user_ns)
+		securityfs_remove(integrity_dir);
+
 	return -1;
 }
 
 int __init ima_fs_init(void)
 {
-	return ima_fs_ns_init(&init_user_ns);
+	return ima_fs_ns_init(&init_user_ns, NULL);
 }