Re: [PATCH v5] security: Expand task_setscheduler LSM hook

[Serge E. Hallyn]

On Fri, Nov 06, 2026 at 02:50:34PM -0500, Aaron Tomlin wrote:
> On Fri, Nov 06, 2026 at 01:21:34PM -0600, Serge E. Hallyn wrote:
> > > This change updates all in-tree security modules (capabilities, SELinux,
> > > and Smack) to accommodate the new parameters mechanically, while
> > > providing LSMs with the necessary context to enforce strict scheduling
> > > and affinity policies.
> > > 
> > > Reviewed-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
> > 
> > This seems misleading - Casey explicitly said "for the smack bits".  This
> > makes it seem like he reviewed and approved of the whole set.
> 
> Hi Serge,
> 
> Apologies for that, it was not my intention to misrepresent the scope of
> Casey's review. The qualifier line was dropped when collecting the trailer.
> I will update the tag in the next revision to explicitly scope it:
> 
>     Reviewed-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx> # Smack
> 
> > I see no issues with the commoncap.c and security.c changes, but as
> > Paul said two versions ago in
> > https://lore.kernel.org/lkml/CAHC9VhSROg6RGUN4_ZVBoEwYjRnKvyjnkbx2D88c09KiTgY3KQ@xxxxxxxxxxxxxx/
> > nothing appaers to be using these.  Where is the user?
> 
> The intended consumer is the BPF LSM (via the generated
> bpf_lsm_task_setscheduler() hook and the __nullable BTF annotations in

Ah, I see, thanks.

> include/linux/lsm_hook_defs.h). As discussed with Peter and Paul in the v3
> thread [1], when sched_setaffinity() is called, the cpuset controller
> silently intersects and truncates the requested mask without surfacing the
> original request, and seccomp cannot safely dereference the __user cpumask
> or sched_attr pointers without TOCTOU races. Exposing the copied-in
> sched_attr and cpumask to task_setscheduler allows BPF LSM programs to
> audit or mediate the actual userspace request before it is sanitised or
> applied.
> 
> In my reply to Paul on v3 [1], I mentioned that once the MIPS prerequisite
> landed, I would include a concrete in-tree demonstration alongside the hook
> expansion, which I neglected to include in v4 and v5.
> 
> Would adding a BPF LSM selftest (under tools/testing/selftests/bpf/) that
> attaches to lsm/task_setscheduler and exercises both the sched_attr and
> cpumask parameters (including NULL and non-NULL paths) be sufficient as an
> in-tree user/test?

Self-tests are good :)

> [1]: https://lore.kernel.org/lkml/ozsngetxq44lahategdi43sqrwdnpotsrebssczymqtkbh7snl@u6ytkznmpne5/
> 
> Kind regards,
> -- 
> Aaron Tomlin