[PATCH] selinux: add FILE__WATCH_MOUNTNS

[Stephen Smalley]

On Wed, Feb 26, 2025 at 3:19 PM Paul Moore <paul at paul-moore.com> wrote:
>
> On Feb 24, 2025 Miklos Szeredi <mszeredi at redhat.com> wrote:
> >
> > Watching mount namespaces for changes (mount, umount, move mount) was added
> > by previous patches.
> >
> > This patch adds the file/watch_mountns permission that can be applied to
> > nsfs files (/proc/$$/ns/mnt), making it possible to allow or deny watching
> > a particular namespace for changes.
> >
> > Suggested-by: Paul Moore <paul at paul-moore.com>
> > Link: https://lore.kernel.org/all/CAHC9VhTOmCjCSE2H0zwPOmpFopheexVb6jyovz92ZtpKtoVv6A@mail.gmail.com/
> > Signed-off-by: Miklos Szeredi <mszeredi at redhat.com>
> > ---
> >  security/selinux/hooks.c            | 3 +++
> >  security/selinux/include/classmap.h | 2 +-
> >  2 files changed, 4 insertions(+), 1 deletion(-)
>
> Thanks Miklos, this looks good to me.  VFS folks / Christian, can you
> merge this into the associated FSNOTIFY_OBJ_TYPE_MNTNS branch you are
> targeting for linux-next?
>
> Acked-by: Paul Moore <paul at paul-moore.com>

I'm not objecting to this patch, but just for awareness, this adds the
permission for all file-related classes, including dir(ectory), and we
are almost out of space in the access vector at which point we'll need
to introduce a file2 class or similar (as with process2).