Re: [PATCH v3 3/12] security: Add LSM_AUDIT_DATA_NS for namespace audit records

[Paul Moore]

On Tue, Aug 11, 2026 at 4:16 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> On Jul 26, 2026 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@xxxxxxxxxxx> wrote:
> >
> > Add a new LSM audit data type LSM_AUDIT_DATA_NS that logs namespace
> > information in audit records.  Two fields are provided:
> >
> > - ns_type: the CLONE_NEW* flag identifying the namespace type, logged
> >   in hexadecimal.
> >
> > - ns_id: the unique 64-bit namespace identifier, retrievable from
> >   userspace via NS_GET_ID or listns(2).  Unlike the proc inode number
> >   (inum), ns_id is never recycled.  For namespace creation denials,
> >   ns_id is 0 because the namespace does not exist yet.
>
> Based on the code in this patch, "ns_type" should be "namespace_type"
> and a similar change needs to be done for "ns_id".  Regardless, the
> first three patches look fine to me (I can fixup the above during a
> merge).
>
> As mentioned previously, I want to merge at least the first three
> patches via the LSM tree since we have multiple LSMs which depend on
> these new hooks.  I'm happy to also merge the remaining Landlock
> patches in this patchset via the LSM tree, or you can manage those
> separately; let me know how you would like to proceed with that.
>
> Since we are at -rc7, this is obviously something for after the
> upcoming merge window so I'm going to merge the first three patches
> into the lsm/dev-staging branch now with the understanding that they
> will move over to the lsm/dev branch after the upcoming merge window
> is finished.  If you want me to merge the Landlock patches too, just
> let me know.

The first three patches are now in lsm/dev, thanks everyone.

Mickaël, if you would like me to merge the remaining patches in this
patchset into the lsm/dev branch just let me know.

-- 
paul-moore.com