Re: [PATCH 0/8] userns: per-namespace capability bounding set and opt-in netns loopback

[Christian Brauner]

On Tue, Nov 03, 2026 at 06:37:46AM -0600, Serge E. Hallyn wrote:
> Kees whipped up a proof of concept BPF lsm that implemented this.  A copy
> from his email (and let's call it GPLv2 unless he wants to change it to
> something like MIT) follows:

There's no need to special-case user namespaces for this anymore.
I've added generic namespace LSM hooks for v7.4-rc1:

* namespace_init()
* namespace_install() (setns())
* namespace_free()

called from the common namespace code I added and for every namespace type.

So a policy like this can cover creation and setns() of all namespaces
and follow a namespace by its id until it's gone.

The catch is that what got merged doesn't work with the bpf LSM right
now.

namespace_free() is never called unless an LSM allocated a namespace
blob, namespace_init() sees a namespace id of zero because
the id is allocated after the hook has run, and the bpf LSM marks the
namespace arguments of both hooks as trusted although the namespace can
be freed right after.

I sent fixes for all of that (cf. [1], [2]) (cf. [3]).

[1]: https://lore.kernel.org/all/20261026-work-security-namespace_free-v1-0-ffa3ebbf71bd@xxxxxxxxxx
[2]: https://lore.kernel.org/all/20261029-work-security-namespace_free-v2-0-65591dbba7b3@xxxxxxxxxx
[3]: https://lore.kernel.org/all/CAHC9VhRwD1c1qKK4=Uc8cbMy27iF722C0DZeXy4WGtH-kOBOcQ@xxxxxxxxxxxxxx

--