[PATCH 2/8] bpf: don't mark namespace_init and namespace_free arguments as trusted

[sashiko-bot at kernel.org]

> The bpf LSM marks the arguments of all hooks as trusted unless the hook
> is listed in untrusted_lsm_hooks. That list was added in commit
> c0c852dd1876 ("bpf: Do not mark certain LSM hook arguments as trusted")
> for hooks that are called on objects that are only partially set up or
> that are already on their way out. The namespace_init and namespace_free
> hooks are exactly that but they aren't listed.
> 
> namespace_init is called from __ns_common_init() before the namespace
> has been set up. It isn't in the namespace trees yet and for all types
> but network namespaces even the owning user namespace isn't set yet. If
> any LSM rejects the namespace or if anything after ns_common_init()
> fails the namespace is freed right away without looking at its reference
> count.
> 
> namespace_free is called from __ns_common_free() when the namespace is
> torn down or when its initialization failed.
> 
> Currently there's no kfunc that takes a namespace. But once there is
> one, e.g., for namespace local storage, a program could take a reference
> to or create storage on a namespace that is about to be freed. So don't
> mark the arguments of these hooks as trusted. namespace_install is
> called with a reference to a fully set up namespace and stays trusted.
> 
> Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> Cc: <stable at kernel.org> # mainline only
> Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026-work-security-namespace_free-v1-0-ffa3ebbf71bd@kernel.org?part=2