Re: [PATCH v3 1/2] lsm: expose mount idmaps to inode hooks

As long as you are okay with me updating the patch with the change
above (and explicit on-list email would be good), I can swap in the
paragraphs when I merge the patch so you don't need to do another
respin.  However, if you would prefer to do a respin, that's fine too.

I'd be grateful if you could swap in the paragraphs, thank you!

Cheers,

Daan

On Wed, Sep 9, 2026 at 12:05 AM Paul Moore [off-list ref] wrote:

On Fri, Sep 4, 2026 at 10:48 AM Daan De Meyer via B4 Relay
[off-list ref] wrote:

quoted

From: Daan De Meyer <redacted>

Pass the mount idmap through the create, link, symlink, mkdir, mknod,
and permission hooks. Update the in-tree security implementations and
non-VFS callers accordingly.

Signed-off-by: Daan De Meyer <redacted>
---
 fs/cachefiles/security.c      |  4 +--
 fs/namei.c                    | 18 +++++++-------
 include/linux/lsm_hook_defs.h | 23 +++++++++--------
 include/linux/security.h      | 58 +++++++++++++++++++++++++------------------
 security/security.c           | 40 +++++++++++++++++------------
 security/selinux/hooks.c      | 19 +++++++++-----
 security/smack/smack_lsm.c    |  9 ++++---
 7 files changed, 100 insertions(+), 71 deletions(-)

Casey, are you okay with the Smack changes (below)?

quoted

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 8e88ac65fd7f..a45819d13c0d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c

@@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,

 /**
  * smack_inode_link - Smack check on link
+ * @idmap: idmap of the mount
  * @old_dentry: the existing object
  * @dir: unused
  * @new_dentry: the new object
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
-                           struct dentry *new_dentry)
+static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+                           struct inode *dir, struct dentry *new_dentry)
 {
        struct smack_known *isp;
        struct smk_audit_info ad;

@@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,

 /**
  * smack_inode_permission - Smack version of permission()
+ * @idmap: idmap of the mount
  * @inode: the inode in question
  * @mask: the access requested
  *

@@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_permission(struct inode *inode, int mask)
+static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+                                 int mask)
 {
        struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
        struct smk_audit_info ad;

--

2.54.0

--
paul-moore.com