[PATCH 00/27] fs: port to const struct mnt_idmap
Christian Brauner
brauner at kernel.org
Tue Sep 1 12:14:25 UTC 2026
A mount's idmapping is immutable. The only thing that is allowed to be
modified afterwards is the reference count and that is hidden behind
mnt_idmap_get() and mnt_idmap_put(). Everything else only ever reads
from the idmapping. This is the same model that struct cred uses and the
idmapping is also rather sensitive.
So make the idmap argument const wherever we can. The conversion is done
from the bottom up so callers can continue to pass a non-const pointer
to a const parameter until the conversion is finished.
Signed-off-by: Christian Brauner (Amutable) <brauner at kernel.org>
---
Christian Brauner (27):
userns: pass const uid_gid_map in lookup helpers
fs: port mnt_idmap_{get,put}() to const mnt_idmap
fs: port vfs{g,u}id helpers to const mnt_idmap
fs: port fs{g,u}id helpers to const mnt_idmap
fs: port i_{g,u}id_into_vfs{g,u}id() to const mnt_idmap
fs: port i_{g,u}id_{needs_}update() to const mnt_idmap
quota: port to const mnt_idmap
fs: port privilege checking helpers to const mnt_idmap
fs: port inode_owner_or_capable() to const mnt_idmap
fs: port inode_init_owner() to const mnt_idmap
fs: port acl to const mnt_idmap
fs: port ->permission() to pass const mnt_idmap
fs: port xattr to const mnt_idmap
fs: port ->fileattr_set() to pass const mnt_idmap
fs: port ->set_acl() to pass const mnt_idmap
fs: port ->get_acl() to pass const mnt_idmap
fs: port ->tmpfile() to pass const mnt_idmap
fs: port ->mknod() to pass const mnt_idmap
fs: port ->rename() to pass const mnt_idmap
fs: port ->mkdir() to pass const mnt_idmap
fs: port ->symlink() to pass const mnt_idmap
fs: port ->create() to pass const mnt_idmap
fs: port ->getattr() to pass const mnt_idmap
fs: port ->setattr() to pass const mnt_idmap
fs: port vfs_*() helpers to const mnt_idmap
fs: port mnt_idmap() and file_mnt_idmap() to const mnt_idmap
fs: make nop_mnt_idmap and invalid_mnt_idmap const
Documentation/filesystems/locking.rst | 24 +++----
Documentation/filesystems/porting.rst | 13 ++++
Documentation/filesystems/vfs.rst | 24 +++----
arch/powerpc/platforms/cell/spufs/inode.c | 2 +-
drivers/android/binder/rust_binderfs.c | 2 +-
drivers/android/binderfs.c | 2 +-
fs/9p/acl.c | 4 +-
fs/9p/acl.h | 4 +-
fs/9p/v9fs.h | 2 +-
fs/9p/v9fs_vfs.h | 2 +-
fs/9p/vfs_inode.c | 14 ++--
fs/9p/vfs_inode_dotl.c | 14 ++--
fs/9p/xattr.c | 2 +-
fs/adfs/adfs.h | 2 +-
fs/adfs/inode.c | 2 +-
fs/affs/affs.h | 10 +--
fs/affs/inode.c | 2 +-
fs/affs/namei.c | 8 +--
fs/afs/dir.c | 16 ++---
fs/afs/inode.c | 4 +-
fs/afs/internal.h | 6 +-
fs/afs/security.c | 2 +-
fs/afs/xattr.c | 4 +-
fs/anon_inodes.c | 4 +-
fs/attr.c | 16 ++---
fs/autofs/root.c | 12 ++--
fs/backing-file.c | 2 +-
fs/bad_inode.c | 20 +++---
fs/bfs/dir.c | 4 +-
fs/btrfs/acl.c | 2 +-
fs/btrfs/acl.h | 2 +-
fs/btrfs/btrfs_inode.h | 2 +-
fs/btrfs/inode.c | 24 +++----
fs/btrfs/ioctl.c | 16 ++---
fs/btrfs/ioctl.h | 2 +-
fs/btrfs/xattr.c | 6 +-
fs/ceph/acl.c | 2 +-
fs/ceph/dir.c | 10 +--
fs/ceph/file.c | 2 +-
fs/ceph/inode.c | 10 +--
fs/ceph/mds_client.h | 2 +-
fs/ceph/super.h | 10 +--
fs/ceph/xattr.c | 2 +-
fs/coda/coda_linux.h | 6 +-
fs/coda/dir.c | 10 +--
fs/coda/inode.c | 4 +-
fs/coda/pioctl.c | 4 +-
fs/configfs/configfs_internal.h | 4 +-
fs/configfs/dir.c | 2 +-
fs/configfs/inode.c | 2 +-
fs/configfs/symlink.c | 2 +-
fs/coredump.c | 2 +-
fs/debugfs/inode.c | 2 +-
fs/ecryptfs/inode.c | 26 +++----
fs/efivarfs/inode.c | 6 +-
fs/erofs/inode.c | 2 +-
fs/erofs/internal.h | 2 +-
fs/exec.c | 4 +-
fs/exfat/exfat_fs.h | 4 +-
fs/exfat/file.c | 6 +-
fs/exfat/namei.c | 6 +-
fs/ext2/acl.c | 2 +-
fs/ext2/acl.h | 2 +-
fs/ext2/ext2.h | 6 +-
fs/ext2/inode.c | 4 +-
fs/ext2/ioctl.c | 2 +-
fs/ext2/namei.c | 12 ++--
fs/ext2/xattr_security.c | 2 +-
fs/ext2/xattr_trusted.c | 2 +-
fs/ext2/xattr_user.c | 2 +-
fs/ext4/acl.c | 2 +-
fs/ext4/acl.h | 2 +-
fs/ext4/ext4.h | 10 +--
fs/ext4/ialloc.c | 2 +-
fs/ext4/inode.c | 6 +-
fs/ext4/ioctl.c | 6 +-
fs/ext4/namei.c | 16 ++---
fs/ext4/symlink.c | 2 +-
fs/ext4/xattr_hurd.c | 2 +-
fs/ext4/xattr_security.c | 2 +-
fs/ext4/xattr_trusted.c | 2 +-
fs/ext4/xattr_user.c | 2 +-
fs/f2fs/acl.c | 6 +-
fs/f2fs/acl.h | 2 +-
fs/f2fs/f2fs.h | 8 +--
fs/f2fs/file.c | 14 ++--
fs/f2fs/namei.c | 24 +++----
fs/f2fs/xattr.c | 4 +-
fs/failfs.c | 4 +-
fs/fat/fat.h | 4 +-
fs/fat/file.c | 6 +-
fs/fat/namei_msdos.c | 6 +-
fs/fat/namei_vfat.c | 6 +-
fs/fhandle.c | 2 +-
fs/file_attr.c | 6 +-
fs/fuse/acl.c | 4 +-
fs/fuse/dir.c | 51 +++++++-------
fs/fuse/file.c | 2 +-
fs/fuse/fuse_i.h | 12 ++--
fs/fuse/ioctl.c | 2 +-
fs/fuse/req.c | 8 ++-
fs/fuse/xattr.c | 2 +-
fs/gfs2/acl.c | 2 +-
fs/gfs2/acl.h | 2 +-
fs/gfs2/file.c | 2 +-
fs/gfs2/inode.c | 16 ++---
fs/gfs2/inode.h | 4 +-
fs/gfs2/xattr.c | 2 +-
fs/hfs/attr.c | 2 +-
fs/hfs/dir.c | 6 +-
fs/hfs/hfs_fs.h | 2 +-
fs/hfs/inode.c | 2 +-
fs/hfsplus/dir.c | 10 +--
fs/hfsplus/hfsplus_fs.h | 4 +-
fs/hfsplus/inode.c | 6 +-
fs/hfsplus/xattr.c | 2 +-
fs/hfsplus/xattr_security.c | 2 +-
fs/hfsplus/xattr_trusted.c | 2 +-
fs/hfsplus/xattr_user.c | 2 +-
fs/hostfs/hostfs_kern.c | 14 ++--
fs/hpfs/hpfs_fn.h | 2 +-
fs/hpfs/inode.c | 2 +-
fs/hpfs/namei.c | 10 +--
fs/hugetlbfs/inode.c | 14 ++--
fs/inode.c | 12 ++--
fs/internal.h | 28 ++++----
fs/jffs2/acl.c | 2 +-
fs/jffs2/acl.h | 2 +-
fs/jffs2/dir.c | 20 +++---
fs/jffs2/fs.c | 2 +-
fs/jffs2/os-linux.h | 2 +-
fs/jffs2/security.c | 2 +-
fs/jffs2/xattr_trusted.c | 2 +-
fs/jffs2/xattr_user.c | 2 +-
fs/jfs/acl.c | 2 +-
fs/jfs/file.c | 2 +-
fs/jfs/ioctl.c | 2 +-
fs/jfs/jfs_acl.h | 2 +-
fs/jfs/jfs_inode.h | 4 +-
fs/jfs/namei.c | 10 +--
fs/jfs/xattr.c | 4 +-
fs/kernfs/dir.c | 4 +-
fs/kernfs/inode.c | 10 +--
fs/kernfs/kernfs-internal.h | 6 +-
fs/libfs.c | 8 +--
fs/minix/file.c | 2 +-
fs/minix/inode.c | 2 +-
fs/minix/minix.h | 2 +-
fs/minix/namei.c | 12 ++--
fs/mnt_idmapping.c | 33 +++++----
fs/namei.c | 84 +++++++++++------------
fs/namespace.c | 8 +--
fs/nfs/dir.c | 12 ++--
fs/nfs/inode.c | 4 +-
fs/nfs/internal.h | 10 +--
fs/nfs/namespace.c | 4 +-
fs/nfs/nfs3_fs.h | 2 +-
fs/nfs/nfs3acl.c | 2 +-
fs/nfs/nfs4proc.c | 10 +--
fs/nilfs2/inode.c | 4 +-
fs/nilfs2/ioctl.c | 2 +-
fs/nilfs2/namei.c | 10 +--
fs/nilfs2/nilfs.h | 6 +-
fs/ntfs/ea.c | 10 +--
fs/ntfs/ea.h | 6 +-
fs/ntfs/file.c | 4 +-
fs/ntfs/inode.h | 4 +-
fs/ntfs/namei.c | 12 ++--
fs/ntfs3/file.c | 6 +-
fs/ntfs3/inode.c | 2 +-
fs/ntfs3/namei.c | 10 +--
fs/ntfs3/ntfs_fs.h | 16 ++---
fs/ntfs3/xattr.c | 12 ++--
fs/ocfs2/acl.c | 2 +-
fs/ocfs2/acl.h | 2 +-
fs/ocfs2/dlmfs/dlmfs.c | 6 +-
fs/ocfs2/file.c | 6 +-
fs/ocfs2/file.h | 6 +-
fs/ocfs2/ioctl.c | 2 +-
fs/ocfs2/ioctl.h | 2 +-
fs/ocfs2/namei.c | 10 +--
fs/ocfs2/xattr.c | 6 +-
fs/omfs/dir.c | 6 +-
fs/omfs/file.c | 2 +-
fs/open.c | 6 +-
fs/orangefs/acl.c | 2 +-
fs/orangefs/inode.c | 8 +--
fs/orangefs/namei.c | 8 +--
fs/orangefs/orangefs-kernel.h | 8 +--
fs/orangefs/xattr.c | 2 +-
fs/overlayfs/dir.c | 14 ++--
fs/overlayfs/file.c | 2 +-
fs/overlayfs/inode.c | 16 ++---
fs/overlayfs/overlayfs.h | 14 ++--
fs/overlayfs/ovl_entry.h | 2 +-
fs/overlayfs/util.c | 4 +-
fs/overlayfs/xattrs.c | 4 +-
fs/pidfs.c | 6 +-
fs/posix_acl.c | 26 +++----
fs/proc/base.c | 10 +--
fs/proc/fd.c | 6 +-
fs/proc/fd.h | 2 +-
fs/proc/generic.c | 4 +-
fs/proc/internal.h | 4 +-
fs/proc/proc_net.c | 2 +-
fs/proc/proc_sysctl.c | 6 +-
fs/proc/root.c | 2 +-
fs/quota/dquot.c | 2 +-
fs/ramfs/file-nommu.c | 4 +-
fs/ramfs/inode.c | 10 +--
fs/remap_range.c | 2 +-
fs/smb/client/cifsacl.c | 4 +-
fs/smb/client/cifsfs.c | 2 +-
fs/smb/client/cifsfs.h | 16 ++---
fs/smb/client/cifsproto.h | 4 +-
fs/smb/client/dir.c | 6 +-
fs/smb/client/inode.c | 8 +--
fs/smb/client/link.c | 2 +-
fs/smb/client/xattr.c | 2 +-
fs/smb/server/ndr.c | 2 +-
fs/smb/server/ndr.h | 2 +-
fs/smb/server/oplock.c | 2 +-
fs/smb/server/smb2pdu.c | 22 +++---
fs/smb/server/smb_common.c | 2 +-
fs/smb/server/smbacl.c | 20 +++---
fs/smb/server/smbacl.h | 8 +--
fs/smb/server/vfs.c | 44 ++++++------
fs/smb/server/vfs.h | 28 ++++----
fs/stat.c | 4 +-
fs/tracefs/event_inode.c | 2 +-
fs/tracefs/inode.c | 8 +--
fs/ubifs/dir.c | 14 ++--
fs/ubifs/file.c | 4 +-
fs/ubifs/ioctl.c | 2 +-
fs/ubifs/ubifs.h | 6 +-
fs/ubifs/xattr.c | 2 +-
fs/udf/file.c | 2 +-
fs/udf/namei.c | 12 ++--
fs/udf/symlink.c | 2 +-
fs/ufs/inode.c | 2 +-
fs/ufs/namei.c | 10 +--
fs/ufs/ufs.h | 2 +-
fs/vboxsf/dir.c | 8 +--
fs/vboxsf/utils.c | 4 +-
fs/vboxsf/vfsmod.h | 4 +-
fs/xattr.c | 30 ++++-----
fs/xfs/libxfs/xfs_inode_util.h | 2 +-
fs/xfs/xfs_acl.c | 2 +-
fs/xfs/xfs_acl.h | 2 +-
fs/xfs/xfs_inode.c | 4 +-
fs/xfs/xfs_inode.h | 2 +-
fs/xfs/xfs_ioctl.c | 2 +-
fs/xfs/xfs_ioctl.h | 2 +-
fs/xfs/xfs_iops.c | 24 +++----
fs/xfs/xfs_iops.h | 2 +-
fs/xfs/xfs_itable.c | 2 +-
fs/xfs/xfs_itable.h | 2 +-
fs/xfs/xfs_symlink.c | 2 +-
fs/xfs/xfs_symlink.h | 2 +-
fs/xfs/xfs_xattr.c | 2 +-
fs/zonefs/super.c | 2 +-
include/linux/capability.h | 8 +--
include/linux/fileattr.h | 2 +-
include/linux/fs.h | 108 +++++++++++++++---------------
include/linux/lsm_hook_defs.h | 24 +++----
include/linux/mnt_idmapping.h | 24 +++----
include/linux/mount.h | 4 +-
include/linux/namei.h | 16 ++---
include/linux/nfs_fs.h | 6 +-
include/linux/posix_acl.h | 24 +++----
include/linux/quotaops.h | 6 +-
include/linux/security.h | 54 +++++++--------
include/linux/uidgid.h | 12 ++--
include/linux/xattr.h | 20 +++---
ipc/mqueue.c | 2 +-
kernel/bpf/inode.c | 6 +-
kernel/capability.c | 4 +-
kernel/user_namespace.c | 28 ++++----
mm/secretmem.c | 2 +-
mm/shmem.c | 30 ++++-----
net/socket.c | 6 +-
net/unix/af_unix.c | 2 +-
security/apparmor/apparmorfs.c | 2 +-
security/apparmor/lsm.c | 4 +-
security/commoncap.c | 10 +--
security/integrity/evm/evm_main.c | 26 +++----
security/integrity/ima/ima.h | 10 +--
security/integrity/ima/ima_api.c | 2 +-
security/integrity/ima/ima_appraise.c | 12 ++--
security/integrity/ima/ima_main.c | 6 +-
security/integrity/ima/ima_policy.c | 4 +-
security/security.c | 24 +++----
security/selinux/hooks.c | 14 ++--
security/selinux/selinuxfs.c | 2 +-
security/smack/smack_lsm.c | 14 ++--
virt/kvm/guest_memfd.c | 2 +-
296 files changed, 1156 insertions(+), 1135 deletions(-)
---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260901-work-idmap-const-bafb8e12a7fa
More information about the Linux-security-module-archive
mailing list