[PATCH v6 0/8] lsm: Replace security_sb_mount with granular mount hooks

[Song Liu]

Hi Christian and folks,

Could you please help review this set? Does this set address
concerns from earlier versions?

Thanks,
Song

On Mon, Jul 6, 2026 at 4:51 PM Song Liu <song at kernel.org> wrote:
>
> This series replaces the monolithic security_sb_mount() hook with
> per-operation mount hooks, addressing two main issues:
>
> 1. TOCTOU: security_sb_mount() receives dev_name as a string, which
>    LSMs like AppArmor and Tomoyo re-resolve via kern_path(). The new
>    hooks pass pre-resolved struct path pointers where possible (bind
>    mount, move mount), eliminating the double-resolution.
>
> 2. Conflation: security_sb_mount() handles bind, new mount, remount,
>    move, propagation changes, and mount reconfiguration through a
>    single hook, requiring LSMs to dispatch on flags internally. The
>    new hooks are called at the operation level with appropriate
>    context.
>
> The new hooks are:
>   mount_bind        - bind mount (pre-resolved source path)
>   mount_new         - new filesystem mount (with fs_context)
>   mount_remount     - filesystem remount (with fs_context)
>   mount_reconfigure - mount flag reconfiguration (MS_REMOUNT|MS_BIND)
>   mount_move        - move mount (pre-resolved paths)
>   mount_change_type - propagation type changes