[PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[Stephen Smalley]

On Tue, Sep 29, 2026 at 9:59 PM Paul Moore <paul at paul-moore.com> wrote:
>
> On Fri, Sep 25, 2026 at 9:58 AM Christian Brauner <brauner at kernel.org> wrote:
> > On Fri, Sep 18, 2026 at 10:31:43AM -0400, Stephen Smalley wrote:
> > > Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > > added a security blob to struct ns_common and allocates it from
> > > __ns_common_init(). Most initial namespaces (init_user_ns,
> > > init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
> > > configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
> > > however set up statically via NS_COMMON_INIT() and never pass through
> > > __ns_common_init(), so their ns_security pointer is left NULL for the
> > > lifetime of the system. Any LSM that registers an lbs_ns blob and
> > > dereferences its slice on one of those namespaces (for example from
> > > the namespace_install hook when a task setns()'s back into an initial
> > > namespace) will fault.
> > >
> > > Allocate the blob and run the namespace_init hook for each of these
> > > namespaces at the end of security_init(), after all ordered LSMs have
> > > registered their hooks, so every LSM sees the initial namespaces the
> > > same way it sees init_net (which is initialized at runtime via
> > > ns_common_init(&init_net) from net_ns_init() immediately after
> > > security_init()) and does not need to special-case them in its own
> > > ->init() callback.
> > >
> > > Provide a ns_common_init_security() helper in kernel/nscommon.c so
> > > that the list of statically-defined initial namespaces and their
> > > Kconfig guards live next to the rest of the ns_common
> > > infrastructure. init_net is intentionally excluded: pre-initializing
> > > it here would leak once __ns_common_init() clears ns_security and
> > > re-allocates.
> > >
> > > Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > > Signed-off-by: Stephen Smalley <stephen.smalley.work at gmail.com>
> > > ---
> >
> > Seems good to me,
> > Reviewed-by: Christian Brauner (Amutable) <brauner at kernel.org>
> >
> > I'm waiting for Paul and then I would pick this into namespace-7.4.misc.
>
> Since we already have the other LSM/namespace patches in lsm/dev I'd
> prefer to merge this patch into lsm/dev so it is we have the core
> LSM/namespace patches rooted in one branch.  Going forward we can
> stick with the topic branch approach.
>
> Are we all okay with that for this patch?

That's fine with me.