[PATCH v3 1/2] lsm: expose mount idmaps to inode hooks

[Casey Schaufler]

On 9/8/2026 3:05 PM, Paul Moore wrote:
> On Fri, Sep 4, 2026 at 10:48 AM Daan De Meyer via B4 Relay
> <devnull+daan.amutable.com at kernel.org> wrote:
>> From: Daan De Meyer <daan at amutable.com>
>>
>> Pass the mount idmap through the create, link, symlink, mkdir, mknod,
>> and permission hooks. Update the in-tree security implementations and
>> non-VFS callers accordingly.
>>
>> Signed-off-by: Daan De Meyer <daan at amutable.com>
>> ---
>>  fs/cachefiles/security.c      |  4 +--
>>  fs/namei.c                    | 18 +++++++-------
>>  include/linux/lsm_hook_defs.h | 23 +++++++++--------
>>  include/linux/security.h      | 58 +++++++++++++++++++++++++------------------
>>  security/security.c           | 40 +++++++++++++++++------------
>>  security/selinux/hooks.c      | 19 +++++++++-----
>>  security/smack/smack_lsm.c    |  9 ++++---
>>  7 files changed, 100 insertions(+), 71 deletions(-)
> Casey, are you okay with the Smack changes (below)?

Yes, assuming the 80 character limit is adhered to.

>
>> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
>> index 8e88ac65fd7f..a45819d13c0d 100644
>> --- a/security/smack/smack_lsm.c
>> +++ b/security/smack/smack_lsm.c
>> @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
>>
>>  /**
>>   * smack_inode_link - Smack check on link
>> + * @idmap: idmap of the mount
>>   * @old_dentry: the existing object
>>   * @dir: unused
>>   * @new_dentry: the new object
>>   *
>>   * Returns 0 if access is permitted, an error code otherwise
>>   */
>> -static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
>> -                           struct dentry *new_dentry)
>> +static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
>> +                           struct inode *dir, struct dentry *new_dentry)
>>  {
>>         struct smack_known *isp;
>>         struct smk_audit_info ad;
>> @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,
>>
>>  /**
>>   * smack_inode_permission - Smack version of permission()
>> + * @idmap: idmap of the mount
>>   * @inode: the inode in question
>>   * @mask: the access requested
>>   *
>> @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,
>>   *
>>   * Returns 0 if access is permitted, an error code otherwise
>>   */
>> -static int smack_inode_permission(struct inode *inode, int mask)
>> +static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
>> +                                 int mask)
>>  {
>>         struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
>>         struct smk_audit_info ad;
>>
>> --
>> 2.54.0