Re: [PATCH] selinux: add FILE__WATCH_MOUNTNS

On Wed, Feb 26, 2025 at 3:19 PM Paul Moore [off-list ref] wrote:

On Feb 24, 2025 Miklos Szeredi [off-list ref] wrote:

quoted

Watching mount namespaces for changes (mount, umount, move mount) was added
by previous patches.

This patch adds the file/watch_mountns permission that can be applied to
nsfs files (/proc/$$/ns/mnt), making it possible to allow or deny watching
a particular namespace for changes.

Suggested-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/all/CAHC9VhTOmCjCSE2H0zwPOmpFopheexVb6jyovz92ZtpKtoVv6A@mail.gmail.com/ (local)
Signed-off-by: Miklos Szeredi <redacted>
---
 security/selinux/hooks.c            | 3 +++
 security/selinux/include/classmap.h | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

Thanks Miklos, this looks good to me.  VFS folks / Christian, can you
merge this into the associated FSNOTIFY_OBJ_TYPE_MNTNS branch you are
targeting for linux-next?

Acked-by: Paul Moore <paul@paul-moore.com>

I'm not objecting to this patch, but just for awareness, this adds the
permission for all file-related classes, including dir(ectory), and we
are almost out of space in the access vector at which point we'll need
to introduce a file2 class or similar (as with process2).