[PATCH v3 0/2] lsm: expose mount idmaps to inode hooks

[Paul Moore]

On Fri, Sep 4, 2026 at 10:48 AM Daan De Meyer via B4 Relay
<devnull+daan.amutable.com at kernel.org> wrote:
>
> OverlayFS performs upper-layer operations through inode-based security
> hooks. Those hooks receive the upper inode and dentry, but not the mount
> idmap used by the VFS operation.
>
> The security layer cannot distinguish an identity-mapped upper from an
> idmapped one or make the same ownership decision as the VFS. The VFS
> layer already passes the idmap down into all relevant inode operations
> so this just brings the security hooks to parity.
>
> So pass the mount idmap through the create, link, symlink, mkdir, mknod,
> and permission hooks. Update the in-tree security implementations and
> non-VFS callers accordingly.

The above three paragraphs should replace the commit description for
patch 1/2.  The current commit description for patch 1/2 only
describes what you did, not why.  In this case, it's pretty easy to
see what you did by looking at the code in patch 1/2, but the motive
behind the change isn't quite as obvious.

As long as you are okay with me updating the patch with the change
above (and explicit on-list email would be good), I can swap in the
paragraphs when I merge the patch so you don't need to do another
respin.  However, if you would prefer to do a respin, that's fine too.

> systemd has been shipping systemd-nsresourced for quite a while now. It
> relies on inode and path hooks to perform ownership checks using a bpf lsm.
> To make this actually secure we need to be able to calculate the on-disk
> ownership from the idmap.
>
> ---
> Changes in v3:
> - Restore the two-patch split from v1.
> - Add the missing Signed-off-by trailers to both patches.
> - Link to v2: https://patch.msgid.link/20260901-lsm-mount-idmaps-v2-1-3309b9d1eda2@amutable.com
>
> Changes in v2:
> - Squash the implementation and selftest into a single patch.
> - Add the missing Signed-off-by trailer.
> - Link to v1: https://patch.msgid.link/20260824-lsm-mount-idmaps-v1-0-0414a9641c85@amutable.com
>
> ---
> Daan De Meyer (2):
>       lsm: expose mount idmaps to inode hooks
>       selftests/bpf: verify mount idmaps reach inode hooks
>
>  fs/cachefiles/security.c                          |   4 +-
>  fs/namei.c                                        |  18 +-
>  include/linux/lsm_hook_defs.h                     |  23 +--
>  include/linux/security.h                          |  58 +++---
>  security/security.c                               |  40 ++--
>  security/selinux/hooks.c                          |  19 +-
>  security/smack/smack_lsm.c                        |   9 +-
>  tools/testing/selftests/bpf/prog_tests/test_lsm.c | 231 ++++++++++++++++++++++
>  tools/testing/selftests/bpf/progs/lsm.c           |  79 ++++++++
>  9 files changed, 410 insertions(+), 71 deletions(-)
> ---
> base-commit: 786262be6048deab760f68c8acc2c85607165894
> change-id: 20260824-lsm-mount-idmaps-9d9b994fe1a1
>
> Best regards,
> --
> Daan De Meyer <daan at amutable.com>

-- 
paul-moore.com