[PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces
From: Stephen Smalley <stephen.smalley.work@gmail.com>
Date: 2026-09-18 14:32:39
Also in:
selinux
Subsystem:
security subsystem, the rest · Maintainers:
Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
added a security blob to struct ns_common and allocates it from
__ns_common_init(). Most initial namespaces (init_user_ns,
init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
however set up statically via NS_COMMON_INIT() and never pass through
__ns_common_init(), so their ns_security pointer is left NULL for the
lifetime of the system. Any LSM that registers an lbs_ns blob and
dereferences its slice on one of those namespaces (for example from
the namespace_install hook when a task setns()'s back into an initial
namespace) will fault.
Allocate the blob and run the namespace_init hook for each of these
namespaces at the end of security_init(), after all ordered LSMs have
registered their hooks, so every LSM sees the initial namespaces the
same way it sees init_net (which is initialized at runtime via
ns_common_init(&init_net) from net_ns_init() immediately after
security_init()) and does not need to special-case them in its own
->init() callback.
Provide a ns_common_init_security() helper in kernel/nscommon.c so
that the list of statically-defined initial namespaces and their
Kconfig guards live next to the rest of the ns_common
infrastructure. init_net is intentionally excluded: pre-initializing
it here would leak once __ns_common_init() clears ns_security and
re-allocates.
Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
v3 adds a Return: line in the kerneldoc for ns_common_init_security().
include/linux/ns_common.h | 3 +++
kernel/nscommon.c | 49 +++++++++++++++++++++++++++++++++++++++
security/lsm_init.c | 4 ++++
3 files changed, 56 insertions(+)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index c8e227a3f9e2..9321db8b82a1 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h@@ -11,6 +11,9 @@ bool is_current_namespace(struct ns_common *ns); int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_operations *ops, int inum); void __ns_common_free(struct ns_common *ns); +#ifdef CONFIG_SECURITY +int ns_common_init_security(void); +#endif struct ns_common *__must_check ns_owner(struct ns_common *ns); static __always_inline bool is_ns_init_inum(const struct ns_common *ns)
diff --git a/kernel/nscommon.c b/kernel/nscommon.c
index e72426bba29a..57e5074b97e3 100644
--- a/kernel/nscommon.c
+++ b/kernel/nscommon.c@@ -1,11 +1,17 @@ // SPDX-License-Identifier: GPL-2.0-only /* Copyright (c) 2025 Christian Brauner <brauner@kernel.org> */ +#include <linux/cgroup.h> +#include <linux/ipc_namespace.h> +#include <linux/mnt_namespace.h> #include <linux/ns_common.h> #include <linux/nstree.h> +#include <linux/pid_namespace.h> #include <linux/proc_ns.h> #include <linux/security.h> +#include <linux/time_namespace.h> #include <linux/user_namespace.h> +#include <linux/uts_namespace.h> #include <linux/vfsdebug.h> #ifdef CONFIG_DEBUG_VFS
@@ -101,6 +107,49 @@ int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_ope return 0; } +/** + * ns_common_init_security - allocate LSM state for the initial namespaces + * + * The initial namespaces are set up statically via NS_COMMON_INIT() at compile + * time and therefore never pass through __ns_common_init(), so their LSM blob + * is left unallocated. Called from security_init() once all ordered LSMs are + * registered so every LSM's namespace_init hook fires on them the same way it + * does for init_net (which is initialized at runtime via + * ns_common_init(&init_net) from net_ns_init() and is therefore excluded + * here). + * + * Return: the first non-zero return from security_namespace_init(), or 0. + */ +#ifdef CONFIG_SECURITY +int __init ns_common_init_security(void) +{ + struct ns_common *set[] = { + to_ns_common(&init_user_ns), + to_ns_common(&init_uts_ns), + to_ns_common(&init_pid_ns), + from_mnt_ns(&init_mnt_ns), +#if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC) + to_ns_common(&init_ipc_ns), +#endif +#ifdef CONFIG_CGROUPS + to_ns_common(&init_cgroup_ns), +#endif +#ifdef CONFIG_TIME_NS + to_ns_common(&init_time_ns), +#endif + }; + unsigned int i; + int ret; + + for (i = 0; i < ARRAY_SIZE(set); i++) { + ret = security_namespace_init(set[i]); + if (ret) + return ret; + } + return 0; +} +#endif + void __ns_common_free(struct ns_common *ns) { security_namespace_free(ns);
diff --git a/security/lsm_init.c b/security/lsm_init.c
index dbda7771013b..7cc2975b287a 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c@@ -7,6 +7,7 @@ #include <linux/init.h> #include <linux/lsm_hooks.h> +#include <linux/ns_common.h> #include "lsm.h"
@@ -490,6 +491,9 @@ int __init security_init(void) lsm_init_single(*lsm); } + if (ns_common_init_security()) + panic("initial LSM ns alloc failed\n"); + return 0; }
--
2.55.0