[PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[Paul Moore]

On Fri, Sep 25, 2026 at 9:58 AM Christian Brauner <brauner at kernel.org> wrote:
> On Fri, Sep 18, 2026 at 10:31:43AM -0400, Stephen Smalley wrote:
> > Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > added a security blob to struct ns_common and allocates it from
> > __ns_common_init(). Most initial namespaces (init_user_ns,
> > init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
> > configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
> > however set up statically via NS_COMMON_INIT() and never pass through
> > __ns_common_init(), so their ns_security pointer is left NULL for the
> > lifetime of the system. Any LSM that registers an lbs_ns blob and
> > dereferences its slice on one of those namespaces (for example from
> > the namespace_install hook when a task setns()'s back into an initial
> > namespace) will fault.
> >
> > Allocate the blob and run the namespace_init hook for each of these
> > namespaces at the end of security_init(), after all ordered LSMs have
> > registered their hooks, so every LSM sees the initial namespaces the
> > same way it sees init_net (which is initialized at runtime via
> > ns_common_init(&init_net) from net_ns_init() immediately after
> > security_init()) and does not need to special-case them in its own
> > ->init() callback.
> >
> > Provide a ns_common_init_security() helper in kernel/nscommon.c so
> > that the list of statically-defined initial namespaces and their
> > Kconfig guards live next to the rest of the ns_common
> > infrastructure. init_net is intentionally excluded: pre-initializing
> > it here would leak once __ns_common_init() clears ns_security and
> > re-allocates.
> >
> > Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > Signed-off-by: Stephen Smalley <stephen.smalley.work at gmail.com>
> > ---
>
> Seems good to me,
> Reviewed-by: Christian Brauner (Amutable) <brauner at kernel.org>
>
> I'm waiting for Paul and then I would pick this into namespace-7.4.misc.

Since we already have the other LSM/namespace patches in lsm/dev I'd
prefer to merge this patch into lsm/dev so it is we have the core
LSM/namespace patches rooted in one branch.  Going forward we can
stick with the topic branch approach.

Are we all okay with that for this patch?

-- 
paul-moore.com