[PATCH v2] lsm: expose mount idmaps to inode hooks

[Christian Brauner]

On Tue, Sep 01, 2026 at 02:50:23PM +0200, Daan De Meyer via B4 Relay wrote:
> From: Daan De Meyer <daan at amutable.com>
> 
> OverlayFS performs upper-layer operations through inode-based security
> hooks. Those hooks receive the upper inode and dentry, but not the mount
> idmap used by the VFS operation. An LSM therefore cannot distinguish an
> identity-mapped upper from an idmapped one or make the same ownership
> decision as the VFS.
> 
> Pass the mount idmap through the create, link, symlink, mkdir, mknod, and
> permission hooks. Update the in-tree LSM implementations and non-VFS
> callers accordingly.
> 
> Extend the BPF LSM selftest to verify that both the identity idmap and an
> idmapped mount idmap reach each hook.
> 
> Signed-off-by: Daan De Meyer <daan at amutable.com>
> ---
> OverlayFS performs upper-layer operations through inode-based security
> hooks. Those hooks receive the upper inode and dentry, but not the mount
> idmap used by the VFS operation.
> 
> The security layer cannot distinguish an identity-mapped upper from an
> idmapped one or make the same ownership decision as the VFS. The VFS
> layer already passes the idmap down into all relevant inode operations
> so this just brings the security hooks to parity.
> 
> So pass the mount idmap through the create, link, symlink, mkdir, mknod,
> and permission hooks. Update the in-tree security implementations and
> non-VFS callers accordingly.
> 
> systemd has been shipping systemd-nsresourced for quite a while now. It
> relies on inode and path hooks to perform ownership checks using a bpf lsm.
> To make this actually secure we need to be able to calculate the on-disk
> ownership from the idmap.
> ---
> Changes in v2:
> - Squash the implementation and selftest into a single patch.
> - Add the missing Signed-off-by trailer.
> - Link to v1: https://patch.msgid.link/20260824-lsm-mount-idmaps-v1-0-0414a9641c85@amutable.com
> ---
>  fs/cachefiles/security.c                          |   4 +-
>  fs/namei.c                                        |  18 +-
>  include/linux/lsm_hook_defs.h                     |  23 +--
>  include/linux/security.h                          |  58 +++---
>  security/security.c                               |  40 ++--
>  security/selinux/hooks.c                          |  19 +-
>  security/smack/smack_lsm.c                        |   9 +-
>  tools/testing/selftests/bpf/prog_tests/test_lsm.c | 231 ++++++++++++++++++++++
>  tools/testing/selftests/bpf/progs/lsm.c           |  79 ++++++++
>  9 files changed, 410 insertions(+), 71 deletions(-)

Oh, what happened to the earlier series? The first series did split
tests and so on correctly into a separate patch. This lumps test and
semantic changes together. We generally don't do this in the kernel. So
please do resend.