Commit a804c5742bff for kernel
commit a804c5742bff224d4cb4d25dd383554d598be32b
Merge: 331eadd85f14 436485132d23
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue Oct 20 20:04:07 2026 -1000
Merge tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm updates from Paul Moore:
- Add LSM hooks, object blobs, and audit records for namespaces
Add the necessary bits to enable LSMs to enforce access controls on
the management of various kernel namespaces. While this pull request
does not contain any in-tree users of these hooks, the Landlock pull
request for Linux v7.4 will include Landlock support and the next
merge window will likely include SELinux support as well. Considering
the development behind these hooks, I expect that BPF LSM developers
will also be making use of the namespace hooks, if they haven't
already.
- Update the inode LSM hooks to include mount idmaps
This allows LSMs to incorporate the mount ID mapping into their
access control decisions. While there are no current in-tree users of
this, it was requested by those developing BPF LSM programs and this
pull request includes a BPF LSM selftest.
- Preserve the full 32-bit ioctl command in LSM audit records
Previously only the low 16 bits were logged, ignoring the direction
and size information in the upper 16 bits. The pull request also
includes a Landlock based selftest to verify the full 32-bit ioctl
value.
- Ensure we don't call security_backing_file_free() multiple times
Thankfully we don't have a problem with the current code base, but we
want to fix this behavior now before it becomes a problem.
- Clarify that only the current task may access current->cred
The current code is a bit misleading around safely accessing the cred
field in a task struct. Through comment and code corrections, this
pull request clarifies that only the task itself may access its cred
field.
- Add SLAB_NO_MERGE to the credential object cache
Harden the credential cache by ensuring credential objects live on
dedicated slab pages.
- Make use of safe memory zero'ing in the LSM Rust bindings
- Update the docs for the current behavior of /sys/kernel/security/lsm
- Update the docs for CONFIG_LSM and the "lsm=" command line option
- Remove unnecessary code
* tag 'lsm-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
lsm: remove redundant NULL check in security_init()
selftests/landlock: Check full ioctl commands in audit records
lsm: Preserve full ioctl commands in audit records
doc: fix LSM ordering description for /sys/kernel/security/lsm
doc: describe CONFIG_LSM and lsm= as the selection mechanism
selftests/bpf: verify mount idmaps reach inode hooks
lsm: expose mount idmaps to inode hooks
rust: lsm: replace `core::mem::zeroed` with `pin_init::zeroed`
cred: prevent slab cache merging for cred_jar
lsm: don't call security_backing_file_free() multiple times
lsm: delete duplicate assignment in lsm_prepare()
lsm: update the BUILD_BUG_ON() in audit_log_lsm_data()
lsm: add LSM_AUDIT_DATA_NS for namespace audit records
lsm: add LSM blob and hooks for namespaces
ns: Free anonymous mount namespaces via ns_common_free()
cred: clarify that task_struct::cred is only for the current task
diff --cc fs/namespace.c
index 280ad18f1949,a36ea2cc733d..9f6ec35c7b9c
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@@ -4362,11 -4193,8 +4362,10 @@@ static void dec_mnt_namespaces(struct u
static void free_mnt_ns(struct mnt_namespace *ns)
{
- if (!is_anon_ns(ns))
- ns_common_free(ns);
+ ns_common_free(ns);
dec_mnt_namespaces(ns->ucounts);
+ /* the last active reference is gone, no mark can show up anymore */
+ fsnotify_mntns_delete(ns);
mnt_ns_tree_remove(ns);
}
diff --cc include/linux/lsm_hook_defs.h
index 194084f60746,af9624c30f99..87d9d06710cb
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@@ -120,29 -120,30 +120,30 @@@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_s
int *xattr_count)
LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
const struct qstr *name, const struct inode *context_inode)
- LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
- umode_t mode)
-LSM_HOOK(int, 0, inode_create, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_create, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
-LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
+LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, const struct mnt_idmap *idmap,
struct inode *inode)
- LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry)
-LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap,
++LSM_HOOK(int, 0, inode_link, const struct mnt_idmap *idmap,
+ struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
- LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,
- const char *old_name)
- LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,
- umode_t mode)
-LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_symlink, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *old_name)
-LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_mkdir, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)
- LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,
- umode_t mode, dev_t dev)
-LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_mknod, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev)
LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)
LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
bool rcu)
- LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
-LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,
++LSM_HOOK(int, 0, inode_permission, const struct mnt_idmap *idmap,
+ struct inode *inode, int mask)
-LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,
+LSM_HOOK(int, 0, inode_setattr, const struct mnt_idmap *idmap, struct dentry *dentry,
struct iattr *attr)
-LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
+LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, const struct mnt_idmap *idmap,
struct dentry *dentry, int ia_valid)
LSM_HOOK(int, 0, inode_getattr, const struct path *path)
LSM_HOOK(int, 0, inode_xattr_skipcap, const char *name)
diff --cc include/linux/security.h
index c7691feb8f8e,7bb073f734f6..40831fab5470
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@@ -404,33 -406,37 +406,37 @@@ int security_inode_init_security(struc
int security_inode_init_security_anon(struct inode *inode,
const struct qstr *name,
const struct inode *context_inode);
- int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
-int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_create(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode);
-void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
+void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap,
struct inode *inode);
- int security_inode_link(struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry);
-int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
++int security_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry);
int security_inode_unlink(struct inode *dir, struct dentry *dentry);
- int security_inode_symlink(struct inode *dir, struct dentry *dentry,
- const char *old_name);
- int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
-int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *old_name);
-int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode);
int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
- int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
-int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev);
int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry,
unsigned int flags);
int security_inode_readlink(struct dentry *dentry);
int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
bool rcu);
- int security_inode_permission(struct inode *inode, int mask);
-int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
- int mask);
-int security_inode_setattr(struct mnt_idmap *idmap,
++int security_inode_permission(const struct mnt_idmap *idmap,
++ struct inode *inode, int mask);
+int security_inode_setattr(const struct mnt_idmap *idmap,
struct dentry *dentry, struct iattr *attr);
-void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+void security_inode_post_setattr(const struct mnt_idmap *idmap, struct dentry *dentry,
int ia_valid);
int security_inode_getattr(const struct path *path);
-int security_inode_setxattr(struct mnt_idmap *idmap,
+int security_inode_setxattr(const struct mnt_idmap *idmap,
struct dentry *dentry, const char *name,
const void *value, size_t size, int flags);
-int security_inode_set_acl(struct mnt_idmap *idmap,
+int security_inode_set_acl(const struct mnt_idmap *idmap,
struct dentry *dentry, const char *acl_name,
struct posix_acl *kacl);
void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
@@@ -902,20 -911,22 +911,22 @@@ static inline int security_inode_init_s
return 0;
}
- static inline int security_inode_create(struct inode *dir,
- struct dentry *dentry,
- umode_t mode)
-static inline int security_inode_create(struct mnt_idmap *idmap,
++static inline int security_inode_create(const struct mnt_idmap *idmap,
+ struct inode *dir,
+ struct dentry *dentry,
+ umode_t mode)
{
return 0;
}
static inline void
-security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
+security_inode_post_create_tmpfile(const struct mnt_idmap *idmap, struct inode *inode)
{ }
- static inline int security_inode_link(struct dentry *old_dentry,
- struct inode *dir,
- struct dentry *new_dentry)
-static inline int security_inode_link(struct mnt_idmap *idmap,
++static inline int security_inode_link(const struct mnt_idmap *idmap,
+ struct dentry *old_dentry,
+ struct inode *dir,
+ struct dentry *new_dentry)
{
return 0;
}
@@@ -926,16 -937,18 +937,18 @@@ static inline int security_inode_unlink
return 0;
}
- static inline int security_inode_symlink(struct inode *dir,
- struct dentry *dentry,
- const char *old_name)
-static inline int security_inode_symlink(struct mnt_idmap *idmap,
++static inline int security_inode_symlink(const struct mnt_idmap *idmap,
+ struct inode *dir,
+ struct dentry *dentry,
+ const char *old_name)
{
return 0;
}
- static inline int security_inode_mkdir(struct inode *dir,
- struct dentry *dentry,
- int mode)
-static inline int security_inode_mkdir(struct mnt_idmap *idmap,
++static inline int security_inode_mkdir(const struct mnt_idmap *idmap,
+ struct inode *dir,
+ struct dentry *dentry,
+ int mode)
{
return 0;
}
@@@ -946,9 -959,10 +959,10 @@@ static inline int security_inode_rmdir(
return 0;
}
- static inline int security_inode_mknod(struct inode *dir,
- struct dentry *dentry,
- int mode, dev_t dev)
-static inline int security_inode_mknod(struct mnt_idmap *idmap,
++static inline int security_inode_mknod(const struct mnt_idmap *idmap,
+ struct inode *dir,
+ struct dentry *dentry,
+ int mode, dev_t dev)
{
return 0;
}
@@@ -974,7 -988,8 +988,8 @@@ static inline int security_inode_follow
return 0;
}
- static inline int security_inode_permission(struct inode *inode, int mask)
-static inline int security_inode_permission(struct mnt_idmap *idmap,
++static inline int security_inode_permission(const struct mnt_idmap *idmap,
+ struct inode *inode, int mask)
{
return 0;
}
diff --cc security/security.c
index 304048f26d03,7fa52d39a255..f6583d507395
--- a/security/security.c
+++ b/security/security.c
@@@ -1622,8 -1637,8 +1637,8 @@@ int security_path_chroot(const struct p
*
* Return: Returns 0 if permission is granted.
*/
- int security_inode_create(struct inode *dir, struct dentry *dentry,
- umode_t mode)
-int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_create(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
{
if (unlikely(IS_PRIVATE(dir)))
return 0;
@@@ -1656,8 -1672,8 +1672,8 @@@ void security_inode_post_create_tmpfile
*
* Return: Returns 0 if permission is granted.
*/
- int security_inode_link(struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry)
-int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
++int security_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry)
{
if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
return 0;
@@@ -1690,8 -1707,8 +1707,8 @@@ int security_inode_unlink(struct inode
*
* Return: Returns 0 if permission is granted.
*/
- int security_inode_symlink(struct inode *dir, struct dentry *dentry,
- const char *old_name)
-int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *old_name)
{
if (unlikely(IS_PRIVATE(dir)))
return 0;
@@@ -1709,7 -1727,8 +1727,8 @@@
*
* Return: Returns 0 if permission is granted.
*/
- int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
-int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
{
if (unlikely(IS_PRIVATE(dir)))
return 0;
@@@ -1747,8 -1767,8 +1767,8 @@@ int security_inode_rmdir(struct inode *
*
* Return: Returns 0 if permission is granted.
*/
- int security_inode_mknod(struct inode *dir, struct dentry *dentry,
- umode_t mode, dev_t dev)
-int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev)
{
if (unlikely(IS_PRIVATE(dir)))
return 0;
@@@ -1835,7 -1856,8 +1856,8 @@@ int security_inode_follow_link(struct d
*
* Return: Returns 0 if permission is granted.
*/
- int security_inode_permission(struct inode *inode, int mask)
-int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
- int mask)
++int security_inode_permission(const struct mnt_idmap *idmap,
++ struct inode *inode, int mask)
{
if (unlikely(IS_PRIVATE(inode)))
return 0;
diff --cc security/selinux/hooks.c
index 550aec9094b3,dd85351cbfc7..6168dd5f91c2
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@@ -3087,12 -3074,14 +3087,14 @@@ static int selinux_inode_init_security_
&ad);
}
- static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
-static int selinux_inode_create(struct mnt_idmap *idmap, struct inode *dir,
++static int selinux_inode_create(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
{
return may_create(dir, dentry, SECCLASS_FILE);
}
- static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
-static int selinux_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
++static int selinux_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry)
{
return may_link(dir, old_dentry, MAY_LINK);
}
@@@ -3102,12 -3091,14 +3104,14 @@@ static int selinux_inode_unlink(struct
return may_link(dir, dentry, MAY_UNLINK);
}
- static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
-static int selinux_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
++static int selinux_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *name)
{
return may_create(dir, dentry, SECCLASS_LNK_FILE);
}
- static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
-static int selinux_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
++static int selinux_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mask)
{
return may_create(dir, dentry, SECCLASS_DIR);
}
@@@ -3117,7 -3108,8 +3121,8 @@@ static int selinux_inode_rmdir(struct i
return may_link(dir, dentry, MAY_RMDIR);
}
- static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
-static int selinux_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
++static int selinux_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev)
{
return may_create(dir, dentry, inode_mode_to_security_class(mode));
}
@@@ -3255,7 -3248,8 +3261,8 @@@ static inline void task_avdcache_update
* Check if the current task is allowed to access @inode according to
* @requested. Returns 0 if allowed, negative values otherwise.
*/
- static int selinux_inode_permission(struct inode *inode, int requested)
-static int selinux_inode_permission(struct mnt_idmap *idmap,
++static int selinux_inode_permission(const struct mnt_idmap *idmap,
+ struct inode *inode, int requested)
{
int mask;
u32 perms;
diff --cc security/smack/smack_lsm.c
index bb78569b3d5b,a45819d13c0d..28a8e12603ce
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@@ -1095,8 -1096,8 +1096,8 @@@ instant_inode
*
* Returns 0 if access is permitted, an error code otherwise
*/
- static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry)
-static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
++static int smack_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry)
{
struct smack_known *isp;
struct smk_audit_info ad;
@@@ -1233,7 -1235,8 +1235,8 @@@ static int smack_inode_rename(struct in
*
* Returns 0 if access is permitted, an error code otherwise
*/
- static int smack_inode_permission(struct inode *inode, int mask)
-static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
++static int smack_inode_permission(const struct mnt_idmap *idmap, struct inode *inode,
+ int mask)
{
struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
struct smk_audit_info ad;