[PATCH v6 8/8] lsm: Remove security_sb_mount and security_move_mount
From: Song Liu <song@kernel.org>
Date: 2026-07-06 23:51:48
Also in:
linux-fsdevel, selinux
Subsystem:
bpf [general] (safe dynamic programs and tools), bpf [security & lsm] (security audit and enforcement using bpf), security subsystem, the rest · Maintainers:
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi, KP Singh, Matt Bobrowski, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Now that all LSMs have been converted to granular mount hooks and fs/namespace.c calls the new hooks, remove the old hooks: - security_sb_mount(): removed from lsm_hook_defs.h, security.h, security.c. - security_move_mount(): removed from lsm_hook_defs.h, security.h, security.c, and bpf_lsm.c. Code generated with the assistance of Claude, reviewed by human. Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com> Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com> # for selinux only Signed-off-by: Song Liu <song@kernel.org> --- include/linux/lsm_hook_defs.h | 4 ---- include/linux/security.h | 16 --------------- kernel/bpf/bpf_lsm.c | 2 -- security/security.c | 38 ----------------------------------- 4 files changed, 60 deletions(-)
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 06c904cb478e..4015f6b579c3 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h@@ -69,8 +69,6 @@ LSM_HOOK(int, 0, sb_remount, struct super_block *sb, void *mnt_opts) LSM_HOOK(int, 0, sb_kern_mount, const struct super_block *sb) LSM_HOOK(int, 0, sb_show_options, struct seq_file *m, struct super_block *sb) LSM_HOOK(int, 0, sb_statfs, struct dentry *dentry) -LSM_HOOK(int, 0, sb_mount, const char *dev_name, const struct path *path, - const char *type, unsigned long flags, void *data) LSM_HOOK(int, 0, sb_umount, struct vfsmount *mnt, int flags) LSM_HOOK(int, 0, sb_pivotroot, const struct path *old_path, const struct path *new_path)
@@ -79,8 +77,6 @@ LSM_HOOK(int, 0, sb_set_mnt_opts, struct super_block *sb, void *mnt_opts, LSM_HOOK(int, 0, sb_clone_mnt_opts, const struct super_block *oldsb, struct super_block *newsb, unsigned long kern_flags, unsigned long *set_kern_flags) -LSM_HOOK(int, 0, move_mount, const struct path *from_path, - const struct path *to_path) LSM_HOOK(int, 0, mount_bind, const struct path *from, const struct path *to, bool recurse) LSM_HOOK(int, 0, mount_new, struct fs_context *fc, const struct path *mp,
diff --git a/include/linux/security.h b/include/linux/security.h
index 5e207e38c004..ff16831e8064 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h@@ -373,8 +373,6 @@ int security_sb_remount(struct super_block *sb, void *mnt_opts); int security_sb_kern_mount(const struct super_block *sb); int security_sb_show_options(struct seq_file *m, struct super_block *sb); int security_sb_statfs(struct dentry *dentry); -int security_sb_mount(const char *dev_name, const struct path *path, - const char *type, unsigned long flags, void *data); int security_sb_umount(struct vfsmount *mnt, int flags); int security_sb_pivotroot(const struct path *old_path, const struct path *new_path); int security_sb_set_mnt_opts(struct super_block *sb,
@@ -385,7 +383,6 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb, struct super_block *newsb, unsigned long kern_flags, unsigned long *set_kern_flags); -int security_move_mount(const struct path *from_path, const struct path *to_path); int security_mount_bind(const struct path *from, const struct path *to, bool recurse); int security_mount_new(struct fs_context *fc, const struct path *mp,
@@ -826,13 +823,6 @@ static inline int security_sb_statfs(struct dentry *dentry) return 0; } -static inline int security_sb_mount(const char *dev_name, const struct path *path, - const char *type, unsigned long flags, - void *data) -{ - return 0; -} - static inline int security_sb_umount(struct vfsmount *mnt, int flags) { return 0;
@@ -860,12 +850,6 @@ static inline int security_sb_clone_mnt_opts(const struct super_block *oldsb, return 0; } -static inline int security_move_mount(const struct path *from_path, - const struct path *to_path) -{ - return 0; -} - static inline int security_mount_bind(const struct path *from, const struct path *to, bool recurse) {
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 4b1ee9c67d6f..9cece66a0c49 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c@@ -353,7 +353,6 @@ BTF_ID(func, bpf_lsm_release_secctx) BTF_ID(func, bpf_lsm_sb_alloc_security) BTF_ID(func, bpf_lsm_sb_eat_lsm_opts) BTF_ID(func, bpf_lsm_sb_kern_mount) -BTF_ID(func, bpf_lsm_sb_mount) BTF_ID(func, bpf_lsm_sb_remount) BTF_ID(func, bpf_lsm_sb_set_mnt_opts) BTF_ID(func, bpf_lsm_sb_show_options)
@@ -385,7 +384,6 @@ BTF_ID(func, bpf_lsm_task_setscheduler) BTF_ID(func, bpf_lsm_userns_create) BTF_ID(func, bpf_lsm_bdev_alloc_security) BTF_ID(func, bpf_lsm_bdev_setintegrity) -BTF_ID(func, bpf_lsm_move_mount) BTF_ID(func, bpf_lsm_mount_bind) BTF_ID(func, bpf_lsm_mount_new) BTF_ID(func, bpf_lsm_mount_remount)
diff --git a/security/security.c b/security/security.c
index 1ede060db3ca..0456680738f2 100644
--- a/security/security.c
+++ b/security/security.c@@ -1065,29 +1065,6 @@ int security_sb_statfs(struct dentry *dentry) return call_int_hook(sb_statfs, dentry); } -/** - * security_sb_mount() - Check permission for mounting a filesystem - * @dev_name: filesystem backing device - * @path: mount point - * @type: filesystem type - * @flags: mount flags - * @data: filesystem specific data - * - * Check permission before an object specified by @dev_name is mounted on the - * mount point named by @nd. For an ordinary mount, @dev_name identifies a - * device if the file system type requires a device. For a remount - * (@flags & MS_REMOUNT), @dev_name is irrelevant. For a loopback/bind mount - * (@flags & MS_BIND), @dev_name identifies the pathname of the object being - * mounted. - * - * Return: Returns 0 if permission is granted. - */ -int security_sb_mount(const char *dev_name, const struct path *path, - const char *type, unsigned long flags, void *data) -{ - return call_int_hook(sb_mount, dev_name, path, type, flags, data); -} - /** * security_sb_umount() - Check permission for unmounting a filesystem * @mnt: mounted filesystem
@@ -1167,21 +1144,6 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb, } EXPORT_SYMBOL(security_sb_clone_mnt_opts); -/** - * security_move_mount() - Check permissions for moving a mount - * @from_path: source mount point - * @to_path: destination mount point - * - * Check permission before a mount is moved. - * - * Return: Returns 0 if permission is granted. - */ -int security_move_mount(const struct path *from_path, - const struct path *to_path) -{ - return call_int_hook(move_mount, from_path, to_path); -} - /** * security_mount_bind() - Check permissions for a bind mount * @from: source path
--
2.53.0-Meta