[PATCH v3 0/2] lsm: expose mount idmaps to inode hooks

[Christian Brauner]

On Fri, Sep 04, 2026 at 04:48:54PM +0200, Daan De Meyer via B4 Relay wrote:
> OverlayFS performs upper-layer operations through inode-based security
> hooks. Those hooks receive the upper inode and dentry, but not the mount
> idmap used by the VFS operation.
> 
> The security layer cannot distinguish an identity-mapped upper from an
> idmapped one or make the same ownership decision as the VFS. The VFS
> layer already passes the idmap down into all relevant inode operations
> so this just brings the security hooks to parity.
> 
> So pass the mount idmap through the create, link, symlink, mkdir, mknod,
> and permission hooks. Update the in-tree security implementations and
> non-VFS callers accordingly.
> 
> systemd has been shipping systemd-nsresourced for quite a while now. It
> relies on inode and path hooks to perform ownership checks using a bpf lsm.
> To make this actually secure we need to be able to calculate the on-disk
> ownership from the idmap.
> 
> ---

Fine by me. @Paul, even if you change the description or whatever. Keep
my RvB, please.

Reviewed-by: Christian Brauner (Amutable) <brauner at kernel.org>