[PATCH 4/8] landlock: pass the namespace id to log to check_ns_type()

[Christian Brauner]

Landlock logs the namespace id when it denies the use of a namespace.
check_ns_type() takes it from the namespace itself. When it is called
from the namespace_init hook the id is always zero as it is only
allocated after the hook has run.

A follow-up patch will allocate the id before the namespace_init hook is
called. But a namespace whose creation is denied never becomes visible
and the Landlock documentation says that namespace_id is zero for
namespace creation (cf. Documentation/admin-guide/LSM/landlock.rst and
Documentation/trace/events-landlock.rst). So pass the id to log to
check_ns_type() and keep passing zero from hook_namespace_init().

No functional changes.

Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Cc: <stable at kernel.org> # mainline only
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
---
 security/landlock/ns.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/security/landlock/ns.c b/security/landlock/ns.c
index cd44c927f83a..39795c4e1404 100644
--- a/security/landlock/ns.c
+++ b/security/landlock/ns.c
@@ -90,15 +90,16 @@ static const struct access_masks ns_permission = {
  * check_ns_type - Check namespace use permission
  *
  * @ns: The namespace being allocated or installed.
+ * @ns_id: The namespace id to log.
  *
  * Shared check for namespace_init (creation via clone(2), unshare(2),
  * open_tree(2), or fsmount(2)) and namespace_install (use via setns(2)): denies
  * when the namespace type is not in the domain's allowed set.  At allocation
- * time @ns->ns_id is still zero and is logged as such.
+ * time the namespace isn't visible yet so @ns_id is zero.
  *
  * Return: 0 if allowed, -EPERM if denied.
  */
-static int check_ns_type(struct ns_common *const ns)
+static int check_ns_type(struct ns_common *const ns, const u64 ns_id)
 {
 	const struct landlock_cred_security *subject;
 	size_t denied_layer;
@@ -121,7 +122,7 @@ static int check_ns_type(struct ns_common *const ns)
 				    .permission =
 					    LANDLOCK_PERMISSION_NAMESPACE_USE,
 				    .audit.u.ns.ns_type = ns->ns_type,
-				    .audit.u.ns.ns_id = ns->ns_id,
+				    .audit.u.ns.ns_id = ns_id,
 				    .layer_plus_one = denied_layer,
 			    });
 	return -EPERM;
@@ -129,13 +130,13 @@ static int check_ns_type(struct ns_common *const ns)
 
 static int hook_namespace_init(struct ns_common *const ns)
 {
-	return check_ns_type(ns);
+	return check_ns_type(ns, 0);
 }
 
 static int hook_namespace_install(const struct nsset *const nsset,
 				  struct ns_common *const ns)
 {
-	return check_ns_type(ns);
+	return check_ns_type(ns, ns->ns_id);
 }
 
 static struct security_hook_list landlock_hooks[] __ro_after_init = {

-- 
2.53.0