Re: [PATCH v3 3/12] security: Add LSM_AUDIT_DATA_NS for namespace audit records

[Paul Moore]

On Jul 26, 2026 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@xxxxxxxxxxx> wrote:
> 
> Add a new LSM audit data type LSM_AUDIT_DATA_NS that logs namespace
> information in audit records.  Two fields are provided:
> 
> - ns_type: the CLONE_NEW* flag identifying the namespace type, logged
>   in hexadecimal.
> 
> - ns_id: the unique 64-bit namespace identifier, retrievable from
>   userspace via NS_GET_ID or listns(2).  Unlike the proc inode number
>   (inum), ns_id is never recycled.  For namespace creation denials,
>   ns_id is 0 because the namespace does not exist yet.

Based on the code in this patch, "ns_type" should be "namespace_type"
and a similar change needs to be done for "ns_id".  Regardless, the
first three patches look fine to me (I can fixup the above during a
merge).

As mentioned previously, I want to merge at least the first three
patches via the LSM tree since we have multiple LSMs which depend on
these new hooks.  I'm happy to also merge the remaining Landlock
patches in this patchset via the LSM tree, or you can manage those
separately; let me know how you would like to proceed with that.

Since we are at -rc7, this is obviously something for after the
upcoming merge window so I'm going to merge the first three patches
into the lsm/dev-staging branch now with the understanding that they
will move over to the lsm/dev branch after the upcoming merge window
is finished.  If you want me to merge the Landlock patches too, just
let me know.

> A new audit data type is needed because no existing LSM_AUDIT_DATA_*
> type carries namespace information.  The closest alternatives (e.g.
> LSM_AUDIT_DATA_TASK or LSM_AUDIT_DATA_NONE with custom strings) would
> either lose the namespace type or require ad-hoc formatting that
> bypasses the structured audit data union.
> 
> Cc: Günther Noack <gnoack@xxxxxxxxxx>
> Cc: Paul Moore <paul@xxxxxxxxxxxxxx>
> Reviewed-by: Christian Brauner <brauner@xxxxxxxxxx>
> Reviewed-by: Günther Noack <gnoack@xxxxxxxxxx>
> Signed-off-by: Mickaël Salaün <mic@xxxxxxxxxxx>
> ---
> Changes since v1:
> https://patch.msgid.link/20260312100444.2609563-3-mic@xxxxxxxxxxx
> - Replace inum with ns_id in the audit record: ns_id is the stable
>   64-bit namespace identifier (never recycled), accessible to
>   userspace via NS_GET_ID and listns(2) (suggested by Christian
>   Brauner).
> - Add Reviewed-by: Christian Brauner.
> - Add Reviewed-by: Günther Noack.
> ---
>  include/linux/lsm_audit.h | 5 +++++
>  security/lsm_audit.c      | 4 ++++
>  2 files changed, 9 insertions(+)

--
paul-moore.com