[PATCH v3 1/2] lsm: expose mount idmaps to inode hooks

[Daan De Meyer]

> As long as you are okay with me updating the patch with the change
> above (and explicit on-list email would be good), I can swap in the
> paragraphs when I merge the patch so you don't need to do another
> respin.  However, if you would prefer to do a respin, that's fine too.

I'd be grateful if you could swap in the paragraphs, thank you!

Cheers,

Daan

On Wed, Sep 9, 2026 at 12:05 AM Paul Moore <paul at paul-moore.com> wrote:
>
> On Fri, Sep 4, 2026 at 10:48 AM Daan De Meyer via B4 Relay
> <devnull+daan.amutable.com at kernel.org> wrote:
> >
> > From: Daan De Meyer <daan at amutable.com>
> >
> > Pass the mount idmap through the create, link, symlink, mkdir, mknod,
> > and permission hooks. Update the in-tree security implementations and
> > non-VFS callers accordingly.
> >
> > Signed-off-by: Daan De Meyer <daan at amutable.com>
> > ---
> >  fs/cachefiles/security.c      |  4 +--
> >  fs/namei.c                    | 18 +++++++-------
> >  include/linux/lsm_hook_defs.h | 23 +++++++++--------
> >  include/linux/security.h      | 58 +++++++++++++++++++++++++------------------
> >  security/security.c           | 40 +++++++++++++++++------------
> >  security/selinux/hooks.c      | 19 +++++++++-----
> >  security/smack/smack_lsm.c    |  9 ++++---
> >  7 files changed, 100 insertions(+), 71 deletions(-)
>
> Casey, are you okay with the Smack changes (below)?
>
> > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> > index 8e88ac65fd7f..a45819d13c0d 100644
> > --- a/security/smack/smack_lsm.c
> > +++ b/security/smack/smack_lsm.c
> > @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
> >
> >  /**
> >   * smack_inode_link - Smack check on link
> > + * @idmap: idmap of the mount
> >   * @old_dentry: the existing object
> >   * @dir: unused
> >   * @new_dentry: the new object
> >   *
> >   * Returns 0 if access is permitted, an error code otherwise
> >   */
> > -static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
> > -                           struct dentry *new_dentry)
> > +static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
> > +                           struct inode *dir, struct dentry *new_dentry)
> >  {
> >         struct smack_known *isp;
> >         struct smk_audit_info ad;
> > @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,
> >
> >  /**
> >   * smack_inode_permission - Smack version of permission()
> > + * @idmap: idmap of the mount
> >   * @inode: the inode in question
> >   * @mask: the access requested
> >   *
> > @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,
> >   *
> >   * Returns 0 if access is permitted, an error code otherwise
> >   */
> > -static int smack_inode_permission(struct inode *inode, int mask)
> > +static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
> > +                                 int mask)
> >  {
> >         struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
> >         struct smk_audit_info ad;
> >
> > --
> > 2.54.0
>
> --
> paul-moore.com