[PATCH v3 1/2] lsm: expose mount idmaps to inode hooks

[Paul Moore]

On Fri, Sep 4, 2026 at 10:48 AM Daan De Meyer via B4 Relay
<devnull+daan.amutable.com at kernel.org> wrote:
>
> From: Daan De Meyer <daan at amutable.com>
>
> Pass the mount idmap through the create, link, symlink, mkdir, mknod,
> and permission hooks. Update the in-tree security implementations and
> non-VFS callers accordingly.
>
> Signed-off-by: Daan De Meyer <daan at amutable.com>
> ---
>  fs/cachefiles/security.c      |  4 +--
>  fs/namei.c                    | 18 +++++++-------
>  include/linux/lsm_hook_defs.h | 23 +++++++++--------
>  include/linux/security.h      | 58 +++++++++++++++++++++++++------------------
>  security/security.c           | 40 +++++++++++++++++------------
>  security/selinux/hooks.c      | 19 +++++++++-----
>  security/smack/smack_lsm.c    |  9 ++++---
>  7 files changed, 100 insertions(+), 71 deletions(-)

Casey, are you okay with the Smack changes (below)?

> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 8e88ac65fd7f..a45819d13c0d 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>
>  /**
>   * smack_inode_link - Smack check on link
> + * @idmap: idmap of the mount
>   * @old_dentry: the existing object
>   * @dir: unused
>   * @new_dentry: the new object
>   *
>   * Returns 0 if access is permitted, an error code otherwise
>   */
> -static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
> -                           struct dentry *new_dentry)
> +static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
> +                           struct inode *dir, struct dentry *new_dentry)
>  {
>         struct smack_known *isp;
>         struct smk_audit_info ad;
> @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,
>
>  /**
>   * smack_inode_permission - Smack version of permission()
> + * @idmap: idmap of the mount
>   * @inode: the inode in question
>   * @mask: the access requested
>   *
> @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,
>   *
>   * Returns 0 if access is permitted, an error code otherwise
>   */
> -static int smack_inode_permission(struct inode *inode, int mask)
> +static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
> +                                 int mask)
>  {
>         struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
>         struct smk_audit_info ad;
>
> --
> 2.54.0

-- 
paul-moore.com