Re: [PATCH v5] security: Expand task_setscheduler LSM hook

[Aaron Tomlin]

On Fri, Nov 06, 2026 at 01:21:34PM -0600, Serge E. Hallyn wrote:
> > This change updates all in-tree security modules (capabilities, SELinux,
> > and Smack) to accommodate the new parameters mechanically, while
> > providing LSMs with the necessary context to enforce strict scheduling
> > and affinity policies.
> > 
> > Reviewed-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
> 
> This seems misleading - Casey explicitly said "for the smack bits".  This
> makes it seem like he reviewed and approved of the whole set.

Hi Serge,

Apologies for that, it was not my intention to misrepresent the scope of
Casey's review. The qualifier line was dropped when collecting the trailer.
I will update the tag in the next revision to explicitly scope it:

    Reviewed-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> # Smack

> I see no issues with the commoncap.c and security.c changes, but as
> Paul said two versions ago in
> https://lore.kernel.org/lkml/CAHC9VhSROg6RGUN4_ZVBoEwYjRnKvyjnkbx2D88c09KiTgY3KQ@xxxxxxxxxxxxxx/
> nothing appaers to be using these.  Where is the user?

The intended consumer is the BPF LSM (via the generated
bpf_lsm_task_setscheduler() hook and the __nullable BTF annotations in
include/linux/lsm_hook_defs.h). As discussed with Peter and Paul in the v3
thread [1], when sched_setaffinity() is called, the cpuset controller
silently intersects and truncates the requested mask without surfacing the
original request, and seccomp cannot safely dereference the __user cpumask
or sched_attr pointers without TOCTOU races. Exposing the copied-in
sched_attr and cpumask to task_setscheduler allows BPF LSM programs to
audit or mediate the actual userspace request before it is sanitised or
applied.

In my reply to Paul on v3 [1], I mentioned that once the MIPS prerequisite
landed, I would include a concrete in-tree demonstration alongside the hook
expansion, which I neglected to include in v4 and v5.

Would adding a BPF LSM selftest (under tools/testing/selftests/bpf/) that
attaches to lsm/task_setscheduler and exercises both the sched_attr and
cpumask parameters (including NULL and non-NULL paths) be sufficient as an
in-tree user/test?

[1]: https://lore.kernel.org/lkml/ozsngetxq44lahategdi43sqrwdnpotsrebssczymqtkbh7snl@u6ytkznmpne5/

Kind regards,
-- 
Aaron Tomlin