[PATCH] selinux: add FILE__WATCH_MOUNTNS

[Paul Moore]

On Feb 24, 2025 Miklos Szeredi <mszeredi at redhat.com> wrote:
> 
> Watching mount namespaces for changes (mount, umount, move mount) was added
> by previous patches.
> 
> This patch adds the file/watch_mountns permission that can be applied to
> nsfs files (/proc/$$/ns/mnt), making it possible to allow or deny watching
> a particular namespace for changes.
> 
> Suggested-by: Paul Moore <paul at paul-moore.com>
> Link: https://lore.kernel.org/all/CAHC9VhTOmCjCSE2H0zwPOmpFopheexVb6jyovz92ZtpKtoVv6A@mail.gmail.com/
> Signed-off-by: Miklos Szeredi <mszeredi at redhat.com>
> ---
>  security/selinux/hooks.c            | 3 +++
>  security/selinux/include/classmap.h | 2 +-
>  2 files changed, 4 insertions(+), 1 deletion(-)

Thanks Miklos, this looks good to me.  VFS folks / Christian, can you
merge this into the associated FSNOTIFY_OBJ_TYPE_MNTNS branch you are
targeting for linux-next?

Acked-by: Paul Moore <paul at paul-moore.com>

--
paul-moore.com