AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/06 00:31	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "SECURITY", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES", "BPF_LSM" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "selinux_inode_create", "selinux_inode_link", "selinux_inode_symlink", "selinux_inode_mkdir", "selinux_inode_mknod", "smack_inode_link", "cachefiles_check_cache_dir", "vfs_mkobj" ], "KMSANReasoning": "The patch modifies several LSM inode hook prototypes (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their invocations in the VFS layer (fs/namei.c, fs/cachefiles/security.c) and security modules to propagate the 'struct mnt_idmap idmap' argument, along with adding BPF LSM test cases for these hooks.\n\nNo new memory allocations, uninitialized variable reads, or copies to user space are introduced or altered. The changes are strictly signature and calling convention updates passing an existing idmap pointer through to the LSM hook infrastructure. Thus, there are no uninitialized memory risks that would require dedicated KMSAN fuzzing.", "NeedsKMSAN": false, "Reasoning": "The patch updates LSM inode hook interfaces (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their callers across the VFS layer, CacheFiles, SELinux, and Smack to pass the mount idmap (struct mnt_idmap idmap). This alters core VFS and LSM interaction paths which are fully reachable and relevant to fuzzing.", "WorthFuzzing": true }
1/1	2026/09/06 00:31	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 55d0f237c02a3ea5e8a12e11f1ced261eb11923e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Sep 6 00:31:07 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c\nindex fc6611886b3b5..eefe5453b904e 100644\n--- a/fs/cachefiles/security.c\n+++ b/fs/cachefiles/security.c\n@@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache cache,\n {\n \tint ret;\n \n-\tret = security_inode_mkdir(d_backing_inode(root), root, 0);\n+\tret = security_inode_mkdir(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\n \tif (ret \u003c 0) {\n \t\tpr_err(\"Security denies permission to make dirs: error %d\",\n \t\t ret);\n \t\treturn ret;\n \t}\n \n-\tret = security_inode_create(d_backing_inode(root), root, 0);\n+\tret = security_inode_create(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\n \tif (ret \u003c 0)\n \t\tpr_err(\"Security denies permission to create files: error %d\",\n \t\t ret);\ndiff --git a/fs/namei.c b/fs/namei.c\nindex 20a6534ea3eff..99f894f3f7e13 100644\n--- a/fs/namei.c\n+++ b/fs/namei.c\n@@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap idmap,\n \tif (unlikely(retval))\n \t\treturn retval;\n \n-\treturn security_inode_permission(inode, mask);\n+\treturn security_inode_permission(idmap, inode, mask);\n }\n EXPORT_SYMBOL(inode_permission);\n \n@@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap id\n \tif (unlikely(((inode-\u003ei_mode \u0026 0111) != 0111) \|\| !no_acl_inode(inode)))\n \t\treturn inode_permission(idmap, inode, mask);\n \n-\treturn security_inode_permission(inode, mask);\n+\treturn security_inode_permission(idmap, inode, mask);\n }\n \n /\n@@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode,\n \t\treturn -EACCES;\t/ shouldn't it be ENOSYS? /\n \n \tmode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);\n-\terror = security_inode_create(dir, dentry, mode);\n+\terror = security_inode_create(idmap, dir, dentry, mode);\n \tif (error)\n \t\treturn error;\n \terror = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di);\n@@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry dentry, umode_t mode,\n \n \tmode \u0026= S_IALLUGO;\n \tmode \|= S_IFREG;\n-\terror = security_inode_create(dir, dentry, mode);\n+\terror = security_inode_create(\u0026nop_mnt_idmap, dir, dentry, mode);\n \tif (error)\n \t\treturn error;\n \terror = f(dentry, mode, arg);\n@@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap idmap,\n \tif (error)\n \t\treturn error;\n \n-\treturn security_inode_create(dir-\u003edentry-\u003ed_inode, dentry, mode);\n+\treturn security_inode_create(idmap, dir-\u003edentry-\u003ed_inode, dentry, mode);\n }\n \n /\n@@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap idmap, struct inode dir,\n \tif (error)\n \t\treturn error;\n \n-\terror = security_inode_mknod(dir, dentry, mode, dev);\n+\terror = security_inode_mknod(idmap, dir, dentry, mode, dev);\n \tif (error)\n \t\treturn error;\n \n@@ -5395,7 +5395,7 @@ struct dentry vfs_mkdir(struct mnt_idmap idmap, struct inode dir,\n \t\tgoto err;\n \n \tmode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO \| S_ISVTX, S_IFDIR);\n-\terror = security_inode_mkdir(dir, dentry, mode);\n+\terror = security_inode_mkdir(idmap, dir, dentry, mode);\n \tif (error)\n \t\tgoto err;\n \n@@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap idmap, struct inode dir,\n \tif (!dir-\u003ei_op-\u003esymlink)\n \t\treturn -EPERM;\n \n-\terror = security_inode_symlink(dir, dentry, oldname);\n+\terror = security_inode_symlink(idmap, dir, dentry, oldname);\n \tif (error)\n \t\treturn error;\n \n@@ -5907,7 +5907,7 @@ int vfs_link(struct dentry old_dentry, struct mnt_idmap idmap,\n \tif (S_ISDIR(inode-\u003ei_mode))\n \t\treturn -EPERM;\n \n-\terror = security_inode_link(old_dentry, dir, new_dentry);\n+\terror = security_inode_link(idmap, old_dentry, dir, new_dentry);\n \tif (error)\n \t\treturn error;\n \ndiff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h\nindex 65c9609ec2077..9e49a5bc9ff3c 100644\n--- a/include/linux/lsm_hook_defs.h\n+++ b/include/linux/lsm_hook_defs.h\n@@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode inode,\n \t int xattr_count)\n LSM_HOOK(int, 0, inode_init_security_anon, struct inode inode,\n \t const struct qstr name, const struct inode context_inode)\n-LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry,\n-\t umode_t mode)\n+LSM_HOOK(int, 0, inode_create, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode)\n LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap idmap,\n \t struct inode inode)\n-LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir,\n-\t struct dentry new_dentry)\n+LSM_HOOK(int, 0, inode_link, struct mnt_idmap idmap,\n+\t struct dentry old_dentry, struct inode dir, struct dentry new_dentry)\n LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry)\n-LSM_HOOK(int, 0, inode_symlink, struct inode dir, struct dentry dentry,\n-\t const char old_name)\n-LSM_HOOK(int, 0, inode_mkdir, struct inode dir, struct dentry dentry,\n-\t umode_t mode)\n+LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, const char old_name)\n+LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode)\n LSM_HOOK(int, 0, inode_rmdir, struct inode dir, struct dentry dentry)\n-LSM_HOOK(int, 0, inode_mknod, struct inode dir, struct dentry dentry,\n-\t umode_t mode, dev_t dev)\n+LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, dev_t dev)\n LSM_HOOK(int, 0, inode_rename, struct inode old_dir, struct dentry old_dentry,\n \t struct inode new_dir, struct dentry new_dentry)\n LSM_HOOK(int, 0, inode_readlink, struct dentry dentry)\n LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode,\n \t bool rcu)\n-LSM_HOOK(int, 0, inode_permission, struct inode inode, int mask)\n+LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap,\n+\t struct inode inode, int mask)\n LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry,\n \t struct iattr attr)\n LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap idmap,\ndiff --git a/include/linux/security.h b/include/linux/security.h\nindex 153e9043058f8..0f5f20ac10507 100644\n--- a/include/linux/security.h\n+++ b/include/linux/security.h\n@@ -404,24 +404,28 @@ int security_inode_init_security(struct inode inode, struct inode dir,\n int security_inode_init_security_anon(struct inode inode,\n \t\t\t\t const struct qstr name,\n \t\t\t\t const struct inode context_inode);\n-int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode);\n+int security_inode_create(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode);\n void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n \t\t\t\t\tstruct inode inode);\n-int security_inode_link(struct dentry old_dentry, struct inode dir,\n-\t\t\t struct dentry new_dentry);\n+int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\tstruct inode dir, struct dentry new_dentry);\n int security_inode_unlink(struct inode dir, struct dentry dentry);\n-int security_inode_symlink(struct inode dir, struct dentry dentry,\n-\t\t\t const char old_name);\n-int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode);\n+int security_inode_symlink(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, const char old_name);\n+int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode);\n int security_inode_rmdir(struct inode dir, struct dentry dentry);\n-int security_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev);\n+int security_inode_mknod(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode, dev_t dev);\n int security_inode_rename(struct inode old_dir, struct dentry old_dentry,\n \t\t\t struct inode new_dir, struct dentry new_dentry,\n \t\t\t unsigned int flags);\n int security_inode_readlink(struct dentry dentry);\n int security_inode_follow_link(struct dentry dentry, struct inode inode,\n \t\t\t bool rcu);\n-int security_inode_permission(struct inode inode, int mask);\n+int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\n+\t\t\t int mask);\n int security_inode_setattr(struct mnt_idmap idmap,\n \t\t\t struct dentry dentry, struct iattr attr);\n void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry,\n@@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode inode,\n \treturn 0;\n }\n \n-static inline int security_inode_create(struct inode dir,\n-\t\t\t\t\t struct dentry dentry,\n-\t\t\t\t\t umode_t mode)\n+static inline int security_inode_create(struct mnt_idmap idmap,\n+\t\t\t\t\tstruct inode dir,\n+\t\t\t\t\tstruct dentry dentry,\n+\t\t\t\t\tumode_t mode)\n {\n \treturn 0;\n }\n@@ -913,9 +918,10 @@ static inline void\n security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode)\n { }\n \n-static inline int security_inode_link(struct dentry old_dentry,\n-\t\t\t\t struct inode dir,\n-\t\t\t\t struct dentry new_dentry)\n+static inline int security_inode_link(struct mnt_idmap idmap,\n+\t\t\t\t struct dentry old_dentry,\n+\t\t\t\t struct inode dir,\n+\t\t\t\t struct dentry new_dentry)\n {\n \treturn 0;\n }\n@@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode dir,\n \treturn 0;\n }\n \n-static inline int security_inode_symlink(struct inode dir,\n-\t\t\t\t\t struct dentry dentry,\n-\t\t\t\t\t const char old_name)\n+static inline int security_inode_symlink(struct mnt_idmap idmap,\n+\t\t\t\t\t struct inode dir,\n+\t\t\t\t\t struct dentry dentry,\n+\t\t\t\t\t const char old_name)\n {\n \treturn 0;\n }\n \n-static inline int security_inode_mkdir(struct inode dir,\n-\t\t\t\t\tstruct dentry dentry,\n-\t\t\t\t\tint mode)\n+static inline int security_inode_mkdir(struct mnt_idmap idmap,\n+\t\t\t\t struct inode dir,\n+\t\t\t\t struct dentry dentry,\n+\t\t\t\t int mode)\n {\n \treturn 0;\n }\n@@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode dir,\n \treturn 0;\n }\n \n-static inline int security_inode_mknod(struct inode dir,\n-\t\t\t\t\tstruct dentry dentry,\n-\t\t\t\t\tint mode, dev_t dev)\n+static inline int security_inode_mknod(struct mnt_idmap idmap,\n+\t\t\t\t struct inode dir,\n+\t\t\t\t struct dentry dentry,\n+\t\t\t\t int mode, dev_t dev)\n {\n \treturn 0;\n }\n@@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry dentry,\n \treturn 0;\n }\n \n-static inline int security_inode_permission(struct inode inode, int mask)\n+static inline int security_inode_permission(struct mnt_idmap idmap,\n+\t\t\t\t\t struct inode inode, int mask)\n {\n \treturn 0;\n }\ndiff --git a/security/security.c b/security/security.c\nindex 2ee276ab15c5b..a9190da3341dd 100644\n--- a/security/security.c\n+++ b/security/security.c\n@@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path path)\n \n /*\n security_inode_create() - Check if creating a file is allowed\n+ * @idmap: idmap of the mount\n * @dir: the parent directory\n * @dentry: the file being created\n * @mode: requested file mode\n@@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path path)\n \n * Return: Returns 0 if permission is granted.\n /\n-int security_inode_create(struct inode dir, struct dentry dentry,\n-\t\t\t umode_t mode)\n+int security_inode_create(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_create, dir, dentry, mode);\n+\treturn call_int_hook(inode_create, idmap, dir, dentry, mode);\n }\n EXPORT_SYMBOL_GPL(security_inode_create);\n \n@@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n \n /\n security_inode_link() - Check if creating a hard link is allowed\n+ * @idmap: idmap of the mount\n * @old_dentry: existing file\n * @dir: new parent directory\n * @new_dentry: new link\n@@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n \n * Return: Returns 0 if permission is granted.\n /\n-int security_inode_link(struct dentry old_dentry, struct inode dir,\n-\t\t\tstruct dentry new_dentry)\n+int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\tstruct inode dir, struct dentry new_dentry)\n {\n \tif (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))\n \t\treturn 0;\n-\treturn call_int_hook(inode_link, old_dentry, dir, new_dentry);\n+\treturn call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry);\n }\n \n /*\n@@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry)\n \n /\n security_inode_symlink() - Check if creating a symbolic link is allowed\n+ * @idmap: idmap of the mount\n * @dir: parent directory\n * @dentry: symbolic link\n * @old_name: existing filename\n@@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode dir, struct dentry dentry)\n \n Return: Returns 0 if permission is granted.\n /\n-int security_inode_symlink(struct inode dir, struct dentry dentry,\n-\t\t\t const char old_name)\n+int security_inode_symlink(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, const char old_name)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_symlink, dir, dentry, old_name);\n+\treturn call_int_hook(inode_symlink, idmap, dir, dentry, old_name);\n }\n \n /*\n security_inode_mkdir() - Check if creating a new directory is allowed\n+ * @idmap: idmap of the mount\n * @dir: parent directory\n * @dentry: new directory\n * @mode: new directory mode\n@@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode dir, struct dentry dentry,\n \n Return: Returns 0 if permission is granted.\n /\n-int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode)\n+int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_mkdir, dir, dentry, mode);\n+\treturn call_int_hook(inode_mkdir, idmap, dir, dentry, mode);\n }\n EXPORT_SYMBOL_GPL(security_inode_mkdir);\n \n@@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry)\n \n /*\n security_inode_mknod() - Check if creating a special file is allowed\n+ * @idmap: idmap of the mount\n * @dir: parent directory\n * @dentry: new file\n * @mode: new file mode\n@@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry)\n \n Return: Returns 0 if permission is granted.\n /\n-int security_inode_mknod(struct inode dir, struct dentry dentry,\n-\t\t\t umode_t mode, dev_t dev)\n+int security_inode_mknod(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_mknod, dir, dentry, mode, dev);\n+\treturn call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev);\n }\n \n /*\n@@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode,\n \n /\n security_inode_permission() - Check if accessing an inode is allowed\n+ * @idmap: idmap of the mount\n * @inode: inode\n * @mask: access mask\n \n@@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode,\n \n * Return: Returns 0 if permission is granted.\n /\n-int security_inode_permission(struct inode inode, int mask)\n+int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\n+\t\t\t int mask)\n {\n \tif (unlikely(IS_PRIVATE(inode)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_permission, inode, mask);\n+\treturn call_int_hook(inode_permission, idmap, inode, mask);\n }\n \n /*\ndiff --git a/security/selinux/hooks.c b/security/selinux/hooks.c\nindex 035aaf113d1da..967984d0af300 100644\n--- a/security/selinux/hooks.c\n+++ b/security/selinux/hooks.c\n@@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode inode,\n \t\t\t \u0026ad);\n }\n \n-static int selinux_inode_create(struct inode dir, struct dentry dentry, umode_t mode)\n+static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t\tstruct dentry dentry, umode_t mode)\n {\n \treturn may_create(dir, dentry, SECCLASS_FILE);\n }\n \n-static int selinux_inode_link(struct dentry old_dentry, struct inode dir, struct dentry new_dentry)\n+static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\t struct inode dir, struct dentry new_dentry)\n {\n \treturn may_link(dir, old_dentry, MAY_LINK);\n }\n@@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode dir, struct dentry dentry)\n \treturn may_link(dir, dentry, MAY_UNLINK);\n }\n \n-static int selinux_inode_symlink(struct inode dir, struct dentry dentry, const char name)\n+static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t\t struct dentry dentry, const char name)\n {\n \treturn may_create(dir, dentry, SECCLASS_LNK_FILE);\n }\n \n-static int selinux_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mask)\n+static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mask)\n {\n \treturn may_create(dir, dentry, SECCLASS_DIR);\n }\n@@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode dir, struct dentry dentry)\n \treturn may_link(dir, dentry, MAY_RMDIR);\n }\n \n-static int selinux_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev)\n+static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n {\n \treturn may_create(dir, dentry, inode_mode_to_security_class(mode));\n }\n@@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct tsec,\n \n /*\n selinux_inode_permission - Check if the current task can access an inode\n+ * @idmap: idmap of the mount\n * @inode: the inode that is being accessed\n * @requested: the accesses being requested\n \n Check if the current task is allowed to access @inode according to\n * @requested. Returns 0 if allowed, negative values otherwise.\n /\n-static int selinux_inode_permission(struct inode inode, int requested)\n+static int selinux_inode_permission(struct mnt_idmap idmap,\n+\t\t\t\t struct inode inode, int requested)\n {\n \tint mask;\n \tu32 perms;\ndiff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c\nindex 8e88ac65fd7fc..a45819d13c0d6 100644\n--- a/security/smack/smack_lsm.c\n+++ b/security/smack/smack_lsm.c\n@@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode inode, struct inode dir,\n \n /*\n smack_inode_link - Smack check on link\n+ * @idmap: idmap of the mount\n * @old_dentry: the existing object\n * @dir: unused\n * @new_dentry: the new object\n \n Returns 0 if access is permitted, an error code otherwise\n /\n-static int smack_inode_link(struct dentry old_dentry, struct inode dir,\n-\t\t\t struct dentry new_dentry)\n+static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\t struct inode dir, struct dentry new_dentry)\n {\n \tstruct smack_known isp;\n \tstruct smk_audit_info ad;\n@@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode old_inode,\n \n /*\n smack_inode_permission - Smack version of permission()\n+ * @idmap: idmap of the mount\n * @inode: the inode in question\n * @mask: the access requested\n \n@@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode old_inode,\n \n Returns 0 if access is permitted, an error code otherwise\n /\n-static int smack_inode_permission(struct inode inode, int mask)\n+static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode,\n+\t\t\t\t int mask)\n {\n \tstruct superblock_smack sbsp = smack_superblock(inode-\u003ei_sb);\n \tstruct smk_audit_info ad;\ndiff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c\nindex d7495efd4a562..c0ae813698ae2 100644\n--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c\n+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c\n@@ -1,18 +1,30 @@\n // SPDX-License-Identifier: GPL-2.0\n+#define _GNU_SOURCE\n \n /\n * Copyright (C) 2020 Google LLC.\n /\n \n #include \u003ctest_progs.h\u003e\n+#include \u003csched.h\u003e\n+#include \u003csignal.h\u003e\n+#include \u003cstring.h\u003e\n+#include \u003csys/stat.h\u003e\n+#include \u003csys/syscall.h\u003e\n #include \u003csys/wait.h\u003e\n #include \u003cunistd.h\u003e\n \n+#include \u003clinux/mount.h\u003e\n+\n #include \"lsm.skel.h\"\n #include \"lsm_tailcall.skel.h\"\n \n char CMD_ARGS[] = {\"true\", NULL};\n \n+enum {\n+\tINODE_IDMAP_ALL = (1U \u003c\u003c 6) - 1,\n+};\n+\n int exec_cmd(int monitored_pid)\n {\n \tint child_pid, child_status;\n@@ -30,6 +42,219 @@ int exec_cmd(int monitored_pid)\n \treturn -EINVAL;\n }\n \n+static ssize_t write_nointr(int fd, const void buf, size_t count)\n+{\n+\tssize_t ret;\n+\n+\tdo {\n+\t\tret = write(fd, buf, count);\n+\t} while (ret \u003c 0 \u0026\u0026 errno == EINTR);\n+\n+\treturn ret;\n+}\n+\n+static int write_file(const char path, const char value)\n+{\n+\tsize_t len = strlen(value);\n+\tint fd, saved_errno = 0;\n+\tssize_t ret;\n+\n+\tfd = open(path, O_WRONLY \| O_CLOEXEC \| O_NOCTTY \| O_NOFOLLOW);\n+\tif (fd \u003c 0)\n+\t\treturn -1;\n+\n+\tret = write_nointr(fd, value, len);\n+\tif (ret \u003c 0)\n+\t\tsaved_errno = errno;\n+\telse if ((size_t)ret != len)\n+\t\tsaved_errno = EIO;\n+\tclose(fd);\n+\tif (saved_errno) {\n+\t\terrno = saved_errno;\n+\t\treturn -1;\n+\t}\n+\treturn 0;\n+}\n+\n+static int write_userns_file(pid_t pid, const char name, const char value)\n+{\n+\tchar path[64];\n+\tint len;\n+\n+\tlen = snprintf(path, sizeof(path), \"/proc/%d/%s\", pid, name);\n+\tif (len \u003c 0 \|\| (size_t)len \u003e= sizeof(path)) {\n+\t\terrno = EOVERFLOW;\n+\t\treturn -1;\n+\t}\n+\n+\treturn write_file(path, value);\n+}\n+\n+static int create_userns_fd(void)\n+{\n+\tchar path[64];\n+\tpid_t pid, waited;\n+\tint fd = -1, len, saved_errno, status;\n+\n+\tpid = fork();\n+\tif (pid \u003c 0)\n+\t\treturn -1;\n+\tif (pid == 0) {\n+\t\tif (unshare(CLONE_NEWUSER))\n+\t\t\t_exit(1);\n+\t\traise(SIGSTOP);\n+\t\t_exit(0);\n+\t}\n+\n+\tdo {\n+\t\twaited = waitpid(pid, \u0026status, WUNTRACED);\n+\t} while (waited \u003c 0 \u0026\u0026 errno == EINTR);\n+\tif (waited != pid)\n+\t\tgoto out;\n+\tif (!WIFSTOPPED(status)) {\n+\t\tpid = -1;\n+\t\tgoto out;\n+\t}\n+\n+\t/ A one-entry map is identity for root but remains distinct from nop_mnt_idmap. /\n+\tif (write_userns_file(pid, \"setgroups\", \"deny\") \u0026\u0026 errno != ENOENT)\n+\t\tgoto out;\n+\tif (write_userns_file(pid, \"uid_map\", \"0 0 1\") \|\|\n+\t write_userns_file(pid, \"gid_map\", \"0 0 1\"))\n+\t\tgoto out;\n+\n+\tlen = snprintf(path, sizeof(path), \"/proc/%d/ns/user\", pid);\n+\tif (len \u003c 0 \|\| (size_t)len \u003e= sizeof(path)) {\n+\t\terrno = EOVERFLOW;\n+\t\tgoto out;\n+\t}\n+\tfd = open(path, O_RDONLY \| O_CLOEXEC);\n+\n+out:\n+\tsaved_errno = errno;\n+\tif (pid \u003e 0) {\n+\t\tkill(pid, SIGKILL);\n+\t\tdo {\n+\t\t\twaited = waitpid(pid, NULL, 0);\n+\t\t} while (waited \u003c 0 \u0026\u0026 errno == EINTR);\n+\t}\n+\terrno = saved_errno;\n+\treturn fd;\n+}\n+\n+static int create_idmapped_tmpfs(void)\n+{\n+\tstruct mount_attr attr = {\n+\t\t.attr_set = MOUNT_ATTR_IDMAP,\n+\t};\n+\tint fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1;\n+\n+\tuserns_fd = create_userns_fd();\n+\tif (userns_fd \u003c 0)\n+\t\tgoto out;\n+\n+\t/ A detached tmpfs avoids relying on the host test directory supporting idmaps. /\n+\tfsfd = syscall(__NR_fsopen, \"tmpfs\", FSOPEN_CLOEXEC);\n+\tif (fsfd \u003c 0)\n+\t\tgoto out;\n+\tif (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0))\n+\t\tgoto out;\n+\n+\tmntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0);\n+\tif (mntfd \u003c 0)\n+\t\tgoto out;\n+\n+\tattr.userns_fd = userns_fd;\n+\tif (syscall(__NR_mount_setattr, mntfd, \"\", AT_EMPTY_PATH, \u0026attr,\n+\t\t sizeof(attr))) {\n+\t\tclose(mntfd);\n+\t\tmntfd = -1;\n+\t}\n+\n+out:\n+\tsaved_errno = errno;\n+\tif (fsfd \u003e= 0)\n+\t\tclose(fsfd);\n+\tif (userns_fd \u003e= 0)\n+\t\tclose(userns_fd);\n+\terrno = saved_errno;\n+\treturn mntfd;\n+}\n+\n+static int exercise_inode_idmap_hooks(int dirfd)\n+{\n+\tint fd = -1, ret = -1;\n+\n+\tfd = openat(dirfd, \"file\", O_CREAT \| O_EXCL \| O_WRONLY \| O_CLOEXEC,\n+\t\t 0600);\n+\tif (!ASSERT_GE(fd, 0, \"create\"))\n+\t\tgoto out;\n+\tclose(fd);\n+\tfd = -1;\n+\n+\tif (!ASSERT_OK(mkdirat(dirfd, \"dir\", 0700), \"mkdir\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(symlinkat(\"target\", dirfd, \"symlink\"), \"symlink\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(linkat(dirfd, \"file\", dirfd, \"link\", 0), \"link\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(mkfifoat(dirfd, \"fifo\", 0600), \"mknod\"))\n+\t\tgoto out;\n+\n+\tret = 0;\n+out:\n+\tif (fd \u003e= 0)\n+\t\tclose(fd);\n+\tunlinkat(dirfd, \"link\", 0);\n+\tunlinkat(dirfd, \"fifo\", 0);\n+\tunlinkat(dirfd, \"symlink\", 0);\n+\tunlinkat(dirfd, \"file\", 0);\n+\tunlinkat(dirfd, \"dir\", AT_REMOVEDIR);\n+\treturn ret;\n+}\n+\n+static int test_lsm_inode_idmap(struct lsm skel)\n+{\n+\tchar tmpdir[] = \"/var/tmp/test_lsm_idmap.XXXXXX\";\n+\t__u32 expected = INODE_IDMAP_ALL;\n+\tint dirfd = -1, idmapped_dirfd = -1;\n+\tint ret = -1;\n+\n+\tif (!ASSERT_OK_PTR(mkdtemp(tmpdir), \"mkdtemp\"))\n+\t\treturn -1;\n+\n+\tdirfd = open(tmpdir, O_RDONLY \| O_DIRECTORY \| O_CLOEXEC);\n+\tif (!ASSERT_GE(dirfd, 0, \"open_tmpdir\"))\n+\t\tgoto out;\n+\n+\tidmapped_dirfd = create_idmapped_tmpfs();\n+\tif (!ASSERT_GE(idmapped_dirfd, 0, \"create_idmapped_tmpfs\"))\n+\t\tgoto out;\n+\n+\tskel-\u003ebss-\u003einode_identity_idmap_seen = 0;\n+\tskel-\u003ebss-\u003einode_idmapped_mount_seen = 0;\n+\n+\tif (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), \"identity_idmap\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd),\n+\t\t \"idmapped_mount\"))\n+\t\tgoto out;\n+\n+\tif (!ASSERT_EQ(skel-\u003ebss-\u003einode_identity_idmap_seen, expected,\n+\t\t \"inode_identity_idmap_seen\"))\n+\t\tgoto out;\n+\tret = ASSERT_EQ(skel-\u003ebss-\u003einode_idmapped_mount_seen, expected,\n+\t\t\t\"inode_idmapped_mount_seen\") ? 0 : -1;\n+\n+out:\n+\tif (idmapped_dirfd \u003e= 0)\n+\t\tclose(idmapped_dirfd);\n+\tif (dirfd \u003e= 0)\n+\t\tclose(dirfd);\n+\trmdir(tmpdir);\n+\treturn ret;\n+}\n+\n static int test_lsm(struct lsm skel)\n {\n \tstruct bpf_link link;\n@@ -53,6 +278,10 @@ static int test_lsm(struct lsm skel)\n \n \tskel-\u003ebss-\u003emonitored_pid = getpid();\n \n+\terr = test_lsm_inode_idmap(skel);\n+\tif (!ASSERT_OK(err, \"test_lsm_inode_idmap\"))\n+\t\treturn err;\n+\n \terr = stack_mprotect();\n \tif (!ASSERT_EQ(err, -1, \"stack_mprotect\") \|\|\n \t !ASSERT_EQ(errno, EPERM, \"stack_mprotect\"))\n@@ -71,6 +300,8 @@ static int test_lsm(struct lsm skel)\n \tskel-\u003ebss-\u003ecopy_test = 0;\n \tskel-\u003ebss-\u003ebprm_count = 0;\n \tskel-\u003ebss-\u003emprotect_count = 0;\n+\tskel-\u003ebss-\u003einode_identity_idmap_seen = 0;\n+\tskel-\u003ebss-\u003einode_idmapped_mount_seen = 0;\n \treturn 0;\n }\n \ndiff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c\nindex 7de173daf27b6..7e32fbddbfadf 100644\n--- a/tools/testing/selftests/bpf/progs/lsm.c\n+++ b/tools/testing/selftests/bpf/progs/lsm.c\n@@ -84,6 +84,85 @@ char _license[] SEC(\"license\") = \"GPL\";\n int monitored_pid = 0;\n int mprotect_count = 0;\n int bprm_count = 0;\n+__u32 inode_identity_idmap_seen = 0;\n+__u32 inode_idmapped_mount_seen = 0;\n+\n+enum {\n+\tINODE_IDMAP_CREATE\t= 1U \u003c\u003c 0,\n+\tINODE_IDMAP_LINK\t= 1U \u003c\u003c 1,\n+\tINODE_IDMAP_SYMLINK\t= 1U \u003c\u003c 2,\n+\tINODE_IDMAP_MKDIR\t= 1U \u003c\u003c 3,\n+\tINODE_IDMAP_MKNOD\t= 1U \u003c\u003c 4,\n+\tINODE_IDMAP_PERMISSION\t= 1U \u003c\u003c 5,\n+};\n+\n+static __always_inline bool is_monitored_idmap(struct mnt_idmap idmap)\n+{\n+\t__u32 pid = bpf_get_current_pid_tgid() \u003e\u003e 32;\n+\n+\treturn monitored_pid == pid \u0026\u0026 idmap;\n+}\n+\n+static __always_inline bool is_identity_idmap(struct mnt_idmap idmap)\n+{\n+\treturn idmap-\u003euid_map.nr_extents == 0 \u0026\u0026\n+\t idmap-\u003egid_map.nr_extents == 0;\n+}\n+\n+static __always_inline int record_inode_idmap(struct mnt_idmap idmap,\n+\t\t\t\t\t __u32 hook, int ret)\n+{\n+\tif (ret \|\| !is_monitored_idmap(idmap))\n+\t\treturn ret;\n+\tif (is_identity_idmap(idmap))\n+\t\tinode_identity_idmap_seen \|= hook;\n+\telse\n+\t\tinode_idmapped_mount_seen \|= hook;\n+\treturn 0;\n+}\n+\n+SEC(\"lsm/inode_create\")\n+int BPF_PROG(test_inode_create, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret);\n+}\n+\n+SEC(\"lsm/inode_link\")\n+int BPF_PROG(test_inode_link, struct mnt_idmap idmap,\n+\t struct dentry old_dentry, struct inode dir,\n+\t struct dentry new_dentry, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_LINK, ret);\n+}\n+\n+SEC(\"lsm/inode_symlink\")\n+int BPF_PROG(test_inode_symlink, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, const char old_name, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret);\n+}\n+\n+SEC(\"lsm/inode_mkdir\")\n+int BPF_PROG(test_inode_mkdir, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret);\n+}\n+\n+SEC(\"lsm/inode_mknod\")\n+int BPF_PROG(test_inode_mknod, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, dev_t dev, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret);\n+}\n+\n+SEC(\"lsm/inode_permission\")\n+int BPF_PROG(test_inode_permission, struct mnt_idmap idmap,\n+\t struct inode inode, int mask, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret);\n+}\n \n SEC(\"lsm/file_mprotect\")\n int BPF_PROG(test_int_hook, struct vm_area_struct *vma,\n" }
2/1	2026/09/06 00:31	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": [ "SECURITY", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES", "BPF_LSM" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "selinux_inode_create", "selinux_inode_link", "selinux_inode_symlink", "selinux_inode_mkdir", "selinux_inode_mknod", "smack_inode_link", "cachefiles_check_cache_dir", "vfs_mkobj" ], "Reasoning": "The patch updates LSM inode hook interfaces (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their callers across the VFS layer, CacheFiles, SELinux, and Smack to pass the mount idmap (struct mnt_idmap idmap). This alters core VFS and LSM interaction paths which are fully reachable and relevant to fuzzing.", "WorthFuzzing": true } Instruction:* You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 55d0f237c02a3ea5e8a12e11f1ced261eb11923e Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 6 00:31:07 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c index fc6611886b3b5..eefe5453b904e 100644 --- a/fs/cachefiles/security.c +++ b/fs/cachefiles/security.c @@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache cache, { int ret; - ret = security_inode_mkdir(d_backing_inode(root), root, 0); + ret = security_inode_mkdir(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) { pr_err("Security denies permission to make dirs: error %d", ret); return ret; } - ret = security_inode_create(d_backing_inode(root), root, 0); + ret = security_inode_create(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) pr_err("Security denies permission to create files: error %d", ret); diff --git a/fs/namei.c b/fs/namei.c index 20a6534ea3eff..99f894f3f7e13 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap idmap, if (unlikely(retval)) return retval; - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } EXPORT_SYMBOL(inode_permission); @@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap id if (unlikely(((inode->i_mode & 0111) != 0111) \|\| !no_acl_inode(inode))) return inode_permission(idmap, inode, mask); - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } /* @@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode, return -EACCES; /* shouldn't it be ENOSYS? / mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(idmap, dir, dentry, mode); if (error) return error; error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di); @@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry dentry, umode_t mode, mode &= S_IALLUGO; mode \|= S_IFREG; - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(&nop_mnt_idmap, dir, dentry, mode); if (error) return error; error = f(dentry, mode, arg); @@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap idmap, if (error) return error; - return security_inode_create(dir->dentry->d_inode, dentry, mode); + return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode); } /* @@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap idmap, struct inode dir, if (error) return error; - error = security_inode_mknod(dir, dentry, mode, dev); + error = security_inode_mknod(idmap, dir, dentry, mode, dev); if (error) return error; @@ -5395,7 +5395,7 @@ struct dentry vfs_mkdir(struct mnt_idmap idmap, struct inode dir, goto err; mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO \| S_ISVTX, S_IFDIR); - error = security_inode_mkdir(dir, dentry, mode); + error = security_inode_mkdir(idmap, dir, dentry, mode); if (error) goto err; @@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap idmap, struct inode dir, if (!dir->i_op->symlink) return -EPERM; - error = security_inode_symlink(dir, dentry, oldname); + error = security_inode_symlink(idmap, dir, dentry, oldname); if (error) return error; @@ -5907,7 +5907,7 @@ int vfs_link(struct dentry old_dentry, struct mnt_idmap idmap, if (S_ISDIR(inode->i_mode)) return -EPERM; - error = security_inode_link(old_dentry, dir, new_dentry); + error = security_inode_link(idmap, old_dentry, dir, new_dentry); if (error) return error; diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec2077..9e49a5bc9ff3c 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode inode, int xattr_count) LSM_HOOK(int, 0, inode_init_security_anon, struct inode inode, const struct qstr name, const struct inode context_inode) -LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap idmap, struct inode inode) -LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +LSM_HOOK(int, 0, inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_symlink, struct inode dir, struct dentry dentry, - const char old_name) -LSM_HOOK(int, 0, inode_mkdir, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) +LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(int, 0, inode_rmdir, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_mknod, struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) LSM_HOOK(int, 0, inode_rename, struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_readlink, struct dentry dentry) LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode, bool rcu) -LSM_HOOK(int, 0, inode_permission, struct inode inode, int mask) +LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask) LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry, struct iattr attr) LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap idmap, diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f8..0f5f20ac10507 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -404,24 +404,28 @@ int security_inode_init_security(struct inode inode, struct inode dir, int security_inode_init_security_anon(struct inode inode, const struct qstr name, const struct inode context_inode); -int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode); -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry); +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry); int security_inode_unlink(struct inode dir, struct dentry dentry); -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name); -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name); +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); int security_inode_rmdir(struct inode dir, struct dentry dentry); -int security_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev); +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev); int security_inode_rename(struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry, unsigned int flags); int security_inode_readlink(struct dentry dentry); int security_inode_follow_link(struct dentry dentry, struct inode inode, bool rcu); -int security_inode_permission(struct inode inode, int mask); +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask); int security_inode_setattr(struct mnt_idmap idmap, struct dentry dentry, struct iattr attr); void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry, @@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode inode, return 0; } -static inline int security_inode_create(struct inode dir, - struct dentry dentry, - umode_t mode) +static inline int security_inode_create(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + umode_t mode) { return 0; } @@ -913,9 +918,10 @@ static inline void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode) { } -static inline int security_inode_link(struct dentry old_dentry, - struct inode dir, - struct dentry new_dentry) +static inline int security_inode_link(struct mnt_idmap idmap, + struct dentry old_dentry, + struct inode dir, + struct dentry new_dentry) { return 0; } @@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode dir, return 0; } -static inline int security_inode_symlink(struct inode dir, - struct dentry dentry, - const char old_name) +static inline int security_inode_symlink(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + const char old_name) { return 0; } -static inline int security_inode_mkdir(struct inode dir, - struct dentry dentry, - int mode) +static inline int security_inode_mkdir(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode) { return 0; } @@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode dir, return 0; } -static inline int security_inode_mknod(struct inode dir, - struct dentry dentry, - int mode, dev_t dev) +static inline int security_inode_mknod(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode, dev_t dev) { return 0; } @@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry dentry, return 0; } -static inline int security_inode_permission(struct inode inode, int mask) +static inline int security_inode_permission(struct mnt_idmap idmap, + struct inode inode, int mask) { return 0; } diff --git a/security/security.c b/security/security.c index 2ee276ab15c5b..a9190da3341dd 100644 --- a/security/security.c +++ b/security/security.c @@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path path) /* * security_inode_create() - Check if creating a file is allowed + * @idmap: idmap of the mount * @dir: the parent directory * @dentry: the file being created * @mode: requested file mode @@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path path) * Return: Returns 0 if permission is granted. / -int security_inode_create(struct inode dir, struct dentry dentry, - umode_t mode) +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_create, dir, dentry, mode); + return call_int_hook(inode_create, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_create); @@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, /* * security_inode_link() - Check if creating a hard link is allowed + * @idmap: idmap of the mount * @old_dentry: existing file * @dir: new parent directory * @new_dentry: new link @@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, * Return: Returns 0 if permission is granted. / -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) return 0; - return call_int_hook(inode_link, old_dentry, dir, new_dentry); + return call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry); } /** @@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) /** * security_inode_symlink() - Check if creating a symbolic link is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: symbolic link * @old_name: existing filename @@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name) +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_symlink, dir, dentry, old_name); + return call_int_hook(inode_symlink, idmap, dir, dentry, old_name); } /** * security_inode_mkdir() - Check if creating a new directory is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new directory * @mode: new directory mode @@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode dir, struct dentry dentry, * * Return: Returns 0 if permission is granted. / -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode) +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mkdir, dir, dentry, mode); + return call_int_hook(inode_mkdir, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_mkdir); @@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) /** * security_inode_mknod() - Check if creating a special file is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new file * @mode: new file mode @@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_mknod(struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mknod, dir, dentry, mode, dev); + return call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev); } /** @@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, /** * security_inode_permission() - Check if accessing an inode is allowed + * @idmap: idmap of the mount * @inode: inode * @mask: access mask * @@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, * * Return: Returns 0 if permission is granted. / -int security_inode_permission(struct inode inode, int mask) +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { if (unlikely(IS_PRIVATE(inode))) return 0; - return call_int_hook(inode_permission, inode, mask); + return call_int_hook(inode_permission, idmap, inode, mask); } /** diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 035aaf113d1da..967984d0af300 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode inode, &ad); } -static int selinux_inode_create(struct inode dir, struct dentry dentry, umode_t mode) +static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { return may_create(dir, dentry, SECCLASS_FILE); } -static int selinux_inode_link(struct dentry old_dentry, struct inode dir, struct dentry new_dentry) +static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { return may_link(dir, old_dentry, MAY_LINK); } @@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_UNLINK); } -static int selinux_inode_symlink(struct inode dir, struct dentry dentry, const char name) +static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char name) { return may_create(dir, dentry, SECCLASS_LNK_FILE); } -static int selinux_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mask) +static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mask) { return may_create(dir, dentry, SECCLASS_DIR); } @@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_RMDIR); } -static int selinux_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev) +static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { return may_create(dir, dentry, inode_mode_to_security_class(mode)); } @@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct tsec, /* * selinux_inode_permission - Check if the current task can access an inode + * @idmap: idmap of the mount * @inode: the inode that is being accessed * @requested: the accesses being requested * * Check if the current task is allowed to access @inode according to * @requested. Returns 0 if allowed, negative values otherwise. / -static int selinux_inode_permission(struct inode inode, int requested) +static int selinux_inode_permission(struct mnt_idmap idmap, + struct inode inode, int requested) { int mask; u32 perms; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8e88ac65fd7fc..a45819d13c0d6 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode inode, struct inode dir, /** * smack_inode_link - Smack check on link + * @idmap: idmap of the mount * @old_dentry: the existing object * @dir: unused * @new_dentry: the new object * * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { struct smack_known isp; struct smk_audit_info ad; @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode old_inode, /** * smack_inode_permission - Smack version of permission() + * @idmap: idmap of the mount * @inode: the inode in question * @mask: the access requested * @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode old_inode, * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_permission(struct inode inode, int mask) +static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { struct superblock_smack sbsp = smack_superblock(inode->i_sb); struct smk_audit_info ad; diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c index d7495efd4a562..c0ae813698ae2 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c @@ -1,18 +1,30 @@ // SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE / * Copyright (C) 2020 Google LLC. / #include <test_progs.h> +#include <sched.h> +#include <signal.h> +#include <string.h> +#include <sys/stat.h> +#include <sys/syscall.h> #include <sys/wait.h> #include <unistd.h> +#include <linux/mount.h> + #include "lsm.skel.h" #include "lsm_tailcall.skel.h" char CMD_ARGS[] = {"true", NULL}; +enum { + INODE_IDMAP_ALL = (1U << 6) - 1, +}; + int exec_cmd(int monitored_pid) { int child_pid, child_status; @@ -30,6 +42,219 @@ int exec_cmd(int monitored_pid) return -EINVAL; } +static ssize_t write_nointr(int fd, const void buf, size_t count) +{ + ssize_t ret; + + do { + ret = write(fd, buf, count); + } while (ret < 0 && errno == EINTR); + + return ret; +} + +static int write_file(const char path, const char value) +{ + size_t len = strlen(value); + int fd, saved_errno = 0; + ssize_t ret; + + fd = open(path, O_WRONLY \| O_CLOEXEC \| O_NOCTTY \| O_NOFOLLOW); + if (fd < 0) + return -1; + + ret = write_nointr(fd, value, len); + if (ret < 0) + saved_errno = errno; + else if ((size_t)ret != len) + saved_errno = EIO; + close(fd); + if (saved_errno) { + errno = saved_errno; + return -1; + } + return 0; +} + +static int write_userns_file(pid_t pid, const char name, const char value) +{ + char path[64]; + int len; + + len = snprintf(path, sizeof(path), "/proc/%d/%s", pid, name); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + return -1; + } + + return write_file(path, value); +} + +static int create_userns_fd(void) +{ + char path[64]; + pid_t pid, waited; + int fd = -1, len, saved_errno, status; + + pid = fork(); + if (pid < 0) + return -1; + if (pid == 0) { + if (unshare(CLONE_NEWUSER)) + _exit(1); + raise(SIGSTOP); + _exit(0); + } + + do { + waited = waitpid(pid, &status, WUNTRACED); + } while (waited < 0 && errno == EINTR); + if (waited != pid) + goto out; + if (!WIFSTOPPED(status)) { + pid = -1; + goto out; + } + + / A one-entry map is identity for root but remains distinct from nop_mnt_idmap. / + if (write_userns_file(pid, "setgroups", "deny") && errno != ENOENT) + goto out; + if (write_userns_file(pid, "uid_map", "0 0 1") \|\| + write_userns_file(pid, "gid_map", "0 0 1")) + goto out; + + len = snprintf(path, sizeof(path), "/proc/%d/ns/user", pid); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + goto out; + } + fd = open(path, O_RDONLY \| O_CLOEXEC); + +out: + saved_errno = errno; + if (pid > 0) { + kill(pid, SIGKILL); + do { + waited = waitpid(pid, NULL, 0); + } while (waited < 0 && errno == EINTR); + } + errno = saved_errno; + return fd; +} + +static int create_idmapped_tmpfs(void) +{ + struct mount_attr attr = { + .attr_set = MOUNT_ATTR_IDMAP, + }; + int fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1; + + userns_fd = create_userns_fd(); + if (userns_fd < 0) + goto out; + + / A detached tmpfs avoids relying on the host test directory supporting idmaps. / + fsfd = syscall(__NR_fsopen, "tmpfs", FSOPEN_CLOEXEC); + if (fsfd < 0) + goto out; + if (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)) + goto out; + + mntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0); + if (mntfd < 0) + goto out; + + attr.userns_fd = userns_fd; + if (syscall(__NR_mount_setattr, mntfd, "", AT_EMPTY_PATH, &attr, + sizeof(attr))) { + close(mntfd); + mntfd = -1; + } + +out: + saved_errno = errno; + if (fsfd >= 0) + close(fsfd); + if (userns_fd >= 0) + close(userns_fd); + errno = saved_errno; + return mntfd; +} + +static int exercise_inode_idmap_hooks(int dirfd) +{ + int fd = -1, ret = -1; + + fd = openat(dirfd, "file", O_CREAT \| O_EXCL \| O_WRONLY \| O_CLOEXEC, + 0600); + if (!ASSERT_GE(fd, 0, "create")) + goto out; + close(fd); + fd = -1; + + if (!ASSERT_OK(mkdirat(dirfd, "dir", 0700), "mkdir")) + goto out; + if (!ASSERT_OK(symlinkat("target", dirfd, "symlink"), "symlink")) + goto out; + if (!ASSERT_OK(linkat(dirfd, "file", dirfd, "link", 0), "link")) + goto out; + if (!ASSERT_OK(mkfifoat(dirfd, "fifo", 0600), "mknod")) + goto out; + + ret = 0; +out: + if (fd >= 0) + close(fd); + unlinkat(dirfd, "link", 0); + unlinkat(dirfd, "fifo", 0); + unlinkat(dirfd, "symlink", 0); + unlinkat(dirfd, "file", 0); + unlinkat(dirfd, "dir", AT_REMOVEDIR); + return ret; +} + +static int test_lsm_inode_idmap(struct lsm skel) +{ + char tmpdir[] = "/var/tmp/test_lsm_idmap.XXXXXX"; + __u32 expected = INODE_IDMAP_ALL; + int dirfd = -1, idmapped_dirfd = -1; + int ret = -1; + + if (!ASSERT_OK_PTR(mkdtemp(tmpdir), "mkdtemp")) + return -1; + + dirfd = open(tmpdir, O_RDONLY \| O_DIRECTORY \| O_CLOEXEC); + if (!ASSERT_GE(dirfd, 0, "open_tmpdir")) + goto out; + + idmapped_dirfd = create_idmapped_tmpfs(); + if (!ASSERT_GE(idmapped_dirfd, 0, "create_idmapped_tmpfs")) + goto out; + + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; + + if (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), "identity_idmap")) + goto out; + if (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd), + "idmapped_mount")) + goto out; + + if (!ASSERT_EQ(skel->bss->inode_identity_idmap_seen, expected, + "inode_identity_idmap_seen")) + goto out; + ret = ASSERT_EQ(skel->bss->inode_idmapped_mount_seen, expected, + "inode_idmapped_mount_seen") ? 0 : -1; + +out: + if (idmapped_dirfd >= 0) + close(idmapped_dirfd); + if (dirfd >= 0) + close(dirfd); + rmdir(tmpdir); + return ret; +} + static int test_lsm(struct lsm skel) { struct bpf_link link; @@ -53,6 +278,10 @@ static int test_lsm(struct lsm skel) skel->bss->monitored_pid = getpid(); + err = test_lsm_inode_idmap(skel); + if (!ASSERT_OK(err, "test_lsm_inode_idmap")) + return err; + err = stack_mprotect(); if (!ASSERT_EQ(err, -1, "stack_mprotect") \|\| !ASSERT_EQ(errno, EPERM, "stack_mprotect")) @@ -71,6 +300,8 @@ static int test_lsm(struct lsm skel) skel->bss->copy_test = 0; skel->bss->bprm_count = 0; skel->bss->mprotect_count = 0; + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; return 0; } diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c index 7de173daf27b6..7e32fbddbfadf 100644 --- a/tools/testing/selftests/bpf/progs/lsm.c +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -84,6 +84,85 @@ char _license[] SEC("license") = "GPL"; int monitored_pid = 0; int mprotect_count = 0; int bprm_count = 0; +__u32 inode_identity_idmap_seen = 0; +__u32 inode_idmapped_mount_seen = 0; + +enum { + INODE_IDMAP_CREATE = 1U << 0, + INODE_IDMAP_LINK = 1U << 1, + INODE_IDMAP_SYMLINK = 1U << 2, + INODE_IDMAP_MKDIR = 1U << 3, + INODE_IDMAP_MKNOD = 1U << 4, + INODE_IDMAP_PERMISSION = 1U << 5, +}; + +static __always_inline bool is_monitored_idmap(struct mnt_idmap idmap) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + + return monitored_pid == pid && idmap; +} + +static __always_inline bool is_identity_idmap(struct mnt_idmap idmap) +{ + return idmap->uid_map.nr_extents == 0 && + idmap->gid_map.nr_extents == 0; +} + +static __always_inline int record_inode_idmap(struct mnt_idmap idmap, + __u32 hook, int ret) +{ + if (ret \|\| !is_monitored_idmap(idmap)) + return ret; + if (is_identity_idmap(idmap)) + inode_identity_idmap_seen \|= hook; + else + inode_idmapped_mount_seen \|= hook; + return 0; +} + +SEC("lsm/inode_create") +int BPF_PROG(test_inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret); +} + +SEC("lsm/inode_link") +int BPF_PROG(test_inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, + struct dentry new_dentry, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_LINK, ret); +} + +SEC("lsm/inode_symlink") +int BPF_PROG(test_inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret); +} + +SEC("lsm/inode_mkdir") +int BPF_PROG(test_inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret); +} + +SEC("lsm/inode_mknod") +int BPF_PROG(test_inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret); +} + +SEC("lsm/inode_permission") +int BPF_PROG(test_inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret); +} SEC("lsm/file_mprotect") int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
3/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 14354 output: 23 thoughts: 645 Thoughts: Fuzzing Potential: A Quick Assessment Alright, let's break down this patch and see if it's worth tossing into the syzkaller grinder. My initial scan of the files touched - `fs/cachefiles/security.c`, `fs/namei.c`, a bunch of `include/linux/` headers, various `security/` files, and even some BPF self-tests – immediately flags my attention. This patch is clearly poking around in sensitive areas: the filesystems, naming interface, and the security layer. The core of the change seems to be injecting a `struct mnt_idmap idmap` into several LSM inode hooks. Think `security_inode_create`, `security_inode_link`, the whole suite. They've updated the hook signatures in the relevant LSM subsystems (SELinux, Smack) and the BPF self-tests. That means they’re touching the core LSM dispatchers and, by extension, any* security modules that depend on them. Now, the real question: are these modifications hitting core, reachable kernel code? I can see it, based on my knowledge of the files, `fs/namei.c` which includes fundamental VFS operations like `vfs_create`, `vfs_mkobj`, `vfs_mknod`, all the way down to `inode_permission`. `security/security.c` is the LSM dispatcher itself, which is always in the critical path. We're talking about fundamental VFS path resolution and inode operations (open, mkdir, mknod, symlink, link, etc.) and security framework (LSM). According to section 3, anything touching core VFS, LSM interfaces, or any refactorings of algorithms, memory management, synchronization/locking, BPF, scheduler, core networking, VFS, or syscall handling should be worth fuzzing. WorthFuzzing must be true. So, yeah, this is definitely worth fuzzing. I'll need to figure out which configurations and symbols we should be focusing on – time to fire up `grepper` and see what we can find, or check Kconfig. I want to identify any specific configurations that enable these security features or any new symbols that might expose new fuzzing targets.
4/2	2026/09/06 00:31	tool	grepper	0m Args: { "Expression": "SECURITY", "PathPrefix": "security/" } Results: { "Output": "\nFull output is too long, showing 500 out of 2170 lines.\nUse more precise expression if possible.\n\nsecurity/Kconfig=8=source \"security/keys/Kconfig\"\nsecurity/Kconfig-9-\nsecurity/Kconfig:10:config SECURITY_DMESG_RESTRICT\nsecurity/Kconfig-11-\tbool \"Restrict unprivileged access to the kernel syslog\"\n--\nsecurity/Kconfig=52=config MSEAL_SYSTEM_MAPPINGS\n--\nsecurity/Kconfig-72-\nsecurity/Kconfig:73:config SECURITY\nsecurity/Kconfig-74-\tbool \"Enable different security models\"\n--\nsecurity/Kconfig-85-\nsecurity/Kconfig:86:config HAS_SECURITY_AUDIT\nsecurity/Kconfig-87-\tdef_bool y\nsecurity/Kconfig-88-\tdepends on AUDIT\nsecurity/Kconfig:89:\tdepends on SECURITY\nsecurity/Kconfig-90-\nsecurity/Kconfig:91:config SECURITYFS\nsecurity/Kconfig-92-\tbool \"Enable the securityfs filesystem\"\n--\nsecurity/Kconfig-98-\nsecurity/Kconfig:99:config SECURITY_NETWORK\nsecurity/Kconfig-100-\tbool \"Socket and Networking Security Hooks\"\nsecurity/Kconfig:101:\tdepends on SECURITY\nsecurity/Kconfig-102-\thelp\n--\nsecurity/Kconfig-107-\nsecurity/Kconfig:108:config SECURITY_INFINIBAND\nsecurity/Kconfig-109-\tbool \"Infiniband Security Hooks\"\nsecurity/Kconfig:110:\tdepends on SECURITY \u0026\u0026 INFINIBAND\nsecurity/Kconfig-111-\thelp\n--\nsecurity/Kconfig-116-\nsecurity/Kconfig:117:config SECURITY_NETWORK_XFRM\nsecurity/Kconfig-118-\tbool \"XFRM (IPSec) Networking Security Hooks\"\nsecurity/Kconfig:119:\tdepends on XFRM \u0026\u0026 SECURITY_NETWORK\nsecurity/Kconfig-120-\thelp\n--\nsecurity/Kconfig-129-\nsecurity/Kconfig:130:config SECURITY_PATH\nsecurity/Kconfig-131-\tbool \"Security hooks for pathname based access control\"\nsecurity/Kconfig:132:\tdepends on SECURITY\nsecurity/Kconfig-133-\thelp\n--\nsecurity/Kconfig=169=config LSM_MMAP_MIN_ADDR\nsecurity/Kconfig-170-\tint \"Low address space for LSM to protect from user allocation\"\nsecurity/Kconfig:171:\tdepends on SECURITY \u0026\u0026 SECURITY_SELINUX\nsecurity/Kconfig-172-\tdefault 32768 if ARM \|\| (ARM64 \u0026\u0026 COMPAT)\n--\nsecurity/Kconfig=234=choice\nsecurity/Kconfig-235-\tprompt \"First legacy 'major LSM' to be initialized\"\nsecurity/Kconfig:236:\tdefault DEFAULT_SECURITY_SELINUX if SECURITY_SELINUX\nsecurity/Kconfig:237:\tdefault DEFAULT_SECURITY_SMACK if SECURITY_SMACK\nsecurity/Kconfig:238:\tdefault DEFAULT_SECURITY_TOMOYO if SECURITY_TOMOYO\nsecurity/Kconfig:239:\tdefault DEFAULT_SECURITY_APPARMOR if SECURITY_APPARMOR\nsecurity/Kconfig:240:\tdefault DEFAULT_SECURITY_DAC\nsecurity/Kconfig-241-\nsecurity/Kconfig-242-\thelp\nsecurity/Kconfig:243:\t This choice is there only for converting CONFIG_DEFAULT_SECURITY\nsecurity/Kconfig-244-\t in old kernel configs to CONFIG_LSM in new kernel configs. Don't\n--\nsecurity/Kconfig-250-\nsecurity/Kconfig:251:\tconfig DEFAULT_SECURITY_SELINUX\nsecurity/Kconfig:252:\t\tbool \"SELinux\" if SECURITY_SELINUX=y\nsecurity/Kconfig-253-\nsecurity/Kconfig:254:\tconfig DEFAULT_SECURITY_SMACK\nsecurity/Kconfig:255:\t\tbool \"Simplified Mandatory Access Control\" if SECURITY_SMACK=y\nsecurity/Kconfig-256-\nsecurity/Kconfig:257:\tconfig DEFAULT_SECURITY_TOMOYO\nsecurity/Kconfig:258:\t\tbool \"TOMOYO\" if SECURITY_TOMOYO=y\nsecurity/Kconfig-259-\nsecurity/Kconfig:260:\tconfig DEFAULT_SECURITY_APPARMOR\nsecurity/Kconfig:261:\t\tbool \"AppArmor\" if SECURITY_APPARMOR=y\nsecurity/Kconfig-262-\nsecurity/Kconfig:263:\tconfig DEFAULT_SECURITY_DAC\nsecurity/Kconfig-264-\t\tbool \"Unix Discretionary Access Controls\"\n--\nsecurity/Kconfig=268=config LSM\nsecurity/Kconfig-269-\tstring \"Ordered list of enabled LSMs\"\nsecurity/Kconfig:270:\tdepends on SECURITY\nsecurity/Kconfig:271:\tdefault \"landlock,lockdown,yama,loadpin,safesetid,smack,selinux,tomoyo,apparmor,ipe,bpf\" if DEFAULT_SECURITY_SMACK\nsecurity/Kconfig:272:\tdefault \"landlock,lockdown,yama,loadpin,safesetid,apparmor,selinux,smack,tomoyo,ipe,bpf\" if DEFAULT_SECURITY_APPARMOR\nsecurity/Kconfig:273:\tdefault \"landlock,lockdown,yama,loadpin,safesetid,tomoyo,ipe,bpf\" if DEFAULT_SECURITY_TOMOYO\nsecurity/Kconfig:274:\tdefault \"landlock,lockdown,yama,loadpin,safesetid,ipe,bpf\" if DEFAULT_SECURITY_DAC\nsecurity/Kconfig-275-\tdefault \"landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf\"\n--\nsecurity/Kconfig-284-\nsecurity/Kconfig:285:config SECURITY_COMMONCAP_KUNIT_TEST\nsecurity/Kconfig-286-\tbool \"Build KUnit tests for commoncap\" if !KUNIT_ALL_TESTS\n--\nsecurity/Makefile=9=obj-y\t\t\t\t\t+= commoncap.o\nsecurity/Makefile:10:obj-$(CONFIG_SECURITY) \t\t\t+= lsm_syscalls.o\nsecurity/Makefile-11-obj-$(CONFIG_MMU)\t\t\t+= min_addr.o\n--\nsecurity/Makefile-13-# Object file lists\nsecurity/Makefile:14:obj-$(CONFIG_SECURITY)\t\t\t+= security.o lsm_notifier.o lsm_init.o\nsecurity/Makefile:15:obj-$(CONFIG_SECURITYFS)\t\t+= inode.o\nsecurity/Makefile:16:obj-$(CONFIG_SECURITY_SELINUX)\t\t+= selinux/\nsecurity/Makefile:17:obj-$(CONFIG_SECURITY_SMACK)\t\t+= smack/\nsecurity/Makefile:18:obj-$(CONFIG_HAS_SECURITY_AUDIT)\t+= lsm_audit.o\nsecurity/Makefile:19:obj-$(CONFIG_SECURITY_TOMOYO)\t\t+= tomoyo/\nsecurity/Makefile:20:obj-$(CONFIG_SECURITY_APPARMOR)\t\t+= apparmor/\nsecurity/Makefile:21:obj-$(CONFIG_SECURITY_YAMA)\t\t+= yama/\nsecurity/Makefile:22:obj-$(CONFIG_SECURITY_LOADPIN)\t\t+= loadpin/\nsecurity/Makefile:23:obj-$(CONFIG_SECURITY_SAFESETID) += safesetid/\nsecurity/Makefile:24:obj-$(CONFIG_SECURITY_LOCKDOWN_LSM)\t+= lockdown/\nsecurity/Makefile-25-obj-$(CONFIG_CGROUPS)\t\t\t+= device_cgroup.o\nsecurity/Makefile=26=obj-$(CONFIG_BPF_LSM)\t\t\t+= bpf/\nsecurity/Makefile:27:obj-$(CONFIG_SECURITY_LANDLOCK)\t\t+= landlock/\nsecurity/Makefile:28:obj-$(CONFIG_SECURITY_IPE)\t\t+= ipe/\nsecurity/Makefile-29-\n--\nsecurity/apparmor/.kunitconfig=2=CONFIG_NET=y\nsecurity/apparmor/.kunitconfig:3:CONFIG_SECURITY=y\nsecurity/apparmor/.kunitconfig:4:CONFIG_SECURITY_APPARMOR=y\nsecurity/apparmor/.kunitconfig:5:CONFIG_SECURITY_APPARMOR_KUNIT_TEST=y\n--\nsecurity/apparmor/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/apparmor/Kconfig:2:config SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-3-\tbool \"AppArmor support\"\nsecurity/apparmor/Kconfig:4:\tdepends on SECURITY \u0026\u0026 NET\nsecurity/apparmor/Kconfig-5-\tselect AUDIT\nsecurity/apparmor/Kconfig:6:\tselect SECURITY_PATH\nsecurity/apparmor/Kconfig:7:\tselect SECURITYFS\nsecurity/apparmor/Kconfig:8:\tselect SECURITY_NETWORK\nsecurity/apparmor/Kconfig-9-\tdefault n\n--\nsecurity/apparmor/Kconfig-17-\nsecurity/apparmor/Kconfig:18:config SECURITY_APPARMOR_DEBUG\nsecurity/apparmor/Kconfig-19-\tbool \"Build AppArmor with debug code\"\nsecurity/apparmor/Kconfig:20:\tdepends on SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-21-\tdefault n\n--\nsecurity/apparmor/Kconfig-27-\nsecurity/apparmor/Kconfig:28:config SECURITY_APPARMOR_DEBUG_ASSERTS\nsecurity/apparmor/Kconfig-29-\tbool \"Build AppArmor with debugging asserts\"\nsecurity/apparmor/Kconfig:30:\tdepends on SECURITY_APPARMOR_DEBUG\nsecurity/apparmor/Kconfig-31-\tdefault y\n--\nsecurity/apparmor/Kconfig-37-\nsecurity/apparmor/Kconfig:38:config SECURITY_APPARMOR_DEBUG_MESSAGES\nsecurity/apparmor/Kconfig-39-\tbool \"Debug messages enabled by default\"\nsecurity/apparmor/Kconfig:40:\tdepends on SECURITY_APPARMOR_DEBUG\nsecurity/apparmor/Kconfig-41-\tdefault n\n--\nsecurity/apparmor/Kconfig-46-\nsecurity/apparmor/Kconfig:47:config SECURITY_APPARMOR_INTROSPECT_POLICY\nsecurity/apparmor/Kconfig-48-\tbool \"Allow loaded policy to be introspected\"\nsecurity/apparmor/Kconfig:49:\tdepends on SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-50-\tdefault y\n--\nsecurity/apparmor/Kconfig-58-\nsecurity/apparmor/Kconfig:59:config SECURITY_APPARMOR_HASH\nsecurity/apparmor/Kconfig-60-\tbool \"Enable introspection of sha256 hashes for loaded profiles\"\nsecurity/apparmor/Kconfig:61:\tdepends on SECURITY_APPARMOR_INTROSPECT_POLICY\nsecurity/apparmor/Kconfig-62-\tselect CRYPTO_LIB_SHA256\n--\nsecurity/apparmor/Kconfig-70-\nsecurity/apparmor/Kconfig:71:config SECURITY_APPARMOR_HASH_DEFAULT\nsecurity/apparmor/Kconfig-72- bool \"Enable policy hash introspection by default\"\nsecurity/apparmor/Kconfig:73: depends on SECURITY_APPARMOR_HASH\nsecurity/apparmor/Kconfig-74- default y\n--\nsecurity/apparmor/Kconfig-83-\nsecurity/apparmor/Kconfig:84:config SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/Kconfig-85-\tbool \"Allow exporting the raw binary policy\"\nsecurity/apparmor/Kconfig:86:\tdepends on SECURITY_APPARMOR_INTROSPECT_POLICY\nsecurity/apparmor/Kconfig-87-\tselect ZSTD_COMPRESS\n--\nsecurity/apparmor/Kconfig-95-\nsecurity/apparmor/Kconfig:96:config SECURITY_APPARMOR_COMPRESSED_POLICY\nsecurity/apparmor/Kconfig-97-\tbool \"Allow loading policy in a compressed format\"\nsecurity/apparmor/Kconfig:98:\tdepends on SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-99-\tselect ZSTD_DECOMPRESS\n--\nsecurity/apparmor/Kconfig-107-\nsecurity/apparmor/Kconfig:108:config SECURITY_APPARMOR_PARANOID_LOAD\nsecurity/apparmor/Kconfig-109-\tbool \"Perform full verification of loaded policy\"\nsecurity/apparmor/Kconfig:110:\tdepends on SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-111-\tdefault y\n--\nsecurity/apparmor/Kconfig-118-\nsecurity/apparmor/Kconfig:119:config SECURITY_APPARMOR_KUNIT_TEST\nsecurity/apparmor/Kconfig-120-\ttristate \"Build KUnit tests for policy_unpack.c\" if !KUNIT_ALL_TESTS\nsecurity/apparmor/Kconfig:121:\tdepends on KUNIT \u0026\u0026 SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-122-\tdefault KUNIT_ALL_TESTS\n--\nsecurity/apparmor/Makefile-3-#\nsecurity/apparmor/Makefile:4:obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o\nsecurity/apparmor/Makefile-5-\nsecurity/apparmor/Makefile=6=apparmor-y := apparmorfs.o audit.o capability.o task.o ipc.o lib.o match.o \\\n--\nsecurity/apparmor/Makefile-9- policy_compat.o af_unix.o af_inet.o\nsecurity/apparmor/Makefile:10:apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o\nsecurity/apparmor/Makefile-11-\nsecurity/apparmor/Makefile:12:obj-$(CONFIG_SECURITY_APPARMOR_KUNIT_TEST) += apparmor_policy_unpack_test.o\nsecurity/apparmor/Makefile-13-apparmor_policy_unpack_test-objs += policy_unpack_test.o\n--\nsecurity/apparmor/apparmorfs.c=75=struct rawdata_f_data {\n--\nsecurity/apparmor/apparmorfs.c-79-\nsecurity/apparmor/apparmorfs.c:80:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/apparmorfs.c-81-\n--\nsecurity/apparmor/apparmorfs.c=172=static struct aa_proxy get_proxy_common_ref(struct aa_common_ref ref)\n--\nsecurity/apparmor/apparmorfs.c-179-\nsecurity/apparmor/apparmorfs.c:180:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/apparmorfs.c-181-static struct aa_loaddata get_loaddata_common_ref(struct aa_common_ref ref)\n--\nsecurity/apparmor/apparmorfs.c=459=static struct aa_loaddata aa_simple_write_to_buffer(const char __user userbuf,\n--\nsecurity/apparmor/apparmorfs.c-486-\nsecurity/apparmor/apparmorfs.c:487:#if defined(CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY) \|\| \\\nsecurity/apparmor/apparmorfs.c:488: defined(CONFIG_SECURITY_APPARMOR_EXPORT_BINARY)\nsecurity/apparmor/apparmorfs.c-489-static int decompress_zstd(char src, size_t slen, char dst, size_t dlen)\n--\nsecurity/apparmor/apparmorfs.c-525-\nsecurity/apparmor/apparmorfs.c:526:#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY\nsecurity/apparmor/apparmorfs.c-527-/*\n--\nsecurity/apparmor/apparmorfs.c=589=static struct aa_loaddata aa_get_data_from_compressed(const char __user userbuf __always_unused,\n--\nsecurity/apparmor/apparmorfs.c-595-}\nsecurity/apparmor/apparmorfs.c:596:#endif / CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY /\nsecurity/apparmor/apparmorfs.c-597-\n--\nsecurity/apparmor/apparmorfs.c=1470=SEQ_NS_FOPS(name);\nsecurity/apparmor/apparmorfs.c-1471-\nsecurity/apparmor/apparmorfs.c:1472:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/apparmorfs.c-1473-static int seq_ns_compress_min_show(struct seq_file seq, void v)\n--\nsecurity/apparmor/apparmorfs.c=1665=int __aa_fs_create_rawdata(struct aa_ns ns, struct aa_loaddata rawdata)\n--\nsecurity/apparmor/apparmorfs.c-1733-}\nsecurity/apparmor/apparmorfs.c:1734:#endif / CONFIG_SECURITY_APPARMOR_EXPORT_BINARY /\nsecurity/apparmor/apparmorfs.c-1735-\n--\nsecurity/apparmor/apparmorfs.c=1788=static struct dentry create_profile_file(struct dentry dir, const char name,\n--\nsecurity/apparmor/apparmorfs.c-1794-\nsecurity/apparmor/apparmorfs.c:1795:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/apparmorfs.c-1796-static int profile_depth(struct aa_profile profile)\n--\nsecurity/apparmor/apparmorfs.c=1943=int __aa_create_rawdata_symlink_dents(struct aa_profile profile)\n--\nsecurity/apparmor/apparmorfs.c-1979-\nsecurity/apparmor/apparmorfs.c:1980:#endif /* CONFIG_SECURITY_APPARMOR_EXPORT_BINARY /\nsecurity/apparmor/apparmorfs.c-1981-\n--\nsecurity/apparmor/apparmorfs.c=2623=static struct aa_sfs_entry aa_sfs_entry_policy[] = {\n--\nsecurity/apparmor/apparmorfs.c-2632-\tAA_SFS_DIR(\"unconfined_restrictions\", aa_sfs_entry_unconfined),\nsecurity/apparmor/apparmorfs.c:2633:#ifdef CONFIG_SECURITY_APPARMOR_COMPRESSED_POLICY\nsecurity/apparmor/apparmorfs.c-2634-\tAA_SFS_FILE_BOOLEAN(\"compressed_load\",\t1),\n--\nsecurity/apparmor/apparmorfs.c=2694=static struct aa_sfs_entry aa_sfs_entry_apparmor[] = {\n--\nsecurity/apparmor/apparmorfs.c-2700-\tAA_SFS_FILE_FOPS(\"profiles\", 0444, \u0026aa_sfs_profiles_fops),\nsecurity/apparmor/apparmorfs.c:2701:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/apparmorfs.c-2702-\tAA_SFS_FILE_FOPS(\"raw_data_compression_level_min\", 0444, \u0026seq_ns_compress_min_fops),\n--\nsecurity/apparmor/include/apparmor.h=56=extern unsigned int aa_g_path_max;\nsecurity/apparmor/include/apparmor.h-57-\nsecurity/apparmor/include/apparmor.h:58:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/include/apparmor.h-59-#define AA_MIN_CLEVEL zstd_min_clevel()\n--\nsecurity/apparmor/include/apparmor.h-65-#define AA_DEFAULT_CLEVEL 0\nsecurity/apparmor/include/apparmor.h:66:#endif / CONFIG_SECURITY_APPARMOR_EXPORT_BINARY /\nsecurity/apparmor/include/apparmor.h-67-\n--\nsecurity/apparmor/include/apparmorfs.h=121=struct aa_loaddata;\nsecurity/apparmor/include/apparmorfs.h-122-\nsecurity/apparmor/include/apparmorfs.h:123:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/include/apparmorfs.h-124-void __aa_fs_remove_rawdata(struct aa_loaddata rawdata);\n--\nsecurity/apparmor/include/apparmorfs.h=145=static inline int __aa_create_rawdata_symlink_dents(struct aa_profile profile)\n--\nsecurity/apparmor/include/apparmorfs.h-148-}\nsecurity/apparmor/include/apparmorfs.h:149:#endif / CONFIG_SECURITY_APPARMOR_EXPORT_BINARY /\nsecurity/apparmor/include/apparmorfs.h-150-\n--\nsecurity/apparmor/include/crypto.h-14-\nsecurity/apparmor/include/crypto.h:15:#ifdef CONFIG_SECURITY_APPARMOR_HASH\nsecurity/apparmor/include/crypto.h-16-int init_profile_hash(void);\n--\nsecurity/apparmor/include/lib.h=48=do {\t\t\t\t\t\t\t\t\t\\\n--\nsecurity/apparmor/include/lib.h-62-\t} while (0)\nsecurity/apparmor/include/lib.h:63:#ifdef CONFIG_SECURITY_APPARMOR_DEBUG_ASSERTS\nsecurity/apparmor/include/lib.h-64-#define AA_BUG_FMT(X, fmt, args...)\t\t\t\t\t\\\n--\nsecurity/apparmor/lsm.c=1929=module_param_call(mode, param_set_mode, param_get_mode,\n--\nsecurity/apparmor/lsm.c-1932-/ whether policy verification hashing is enabled /\nsecurity/apparmor/lsm.c:1933:bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT);\nsecurity/apparmor/lsm.c:1934:#ifdef CONFIG_SECURITY_APPARMOR_HASH\nsecurity/apparmor/lsm.c-1935-module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR \| S_IWUSR);\n--\nsecurity/apparmor/lsm.c-1938-/ whether policy exactly as loaded is retained for debug and checkpointing /\nsecurity/apparmor/lsm.c:1939:bool aa_g_export_binary = IS_ENABLED(CONFIG_SECURITY_APPARMOR_EXPORT_BINARY);\nsecurity/apparmor/lsm.c:1940:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/lsm.c-1941-module_param_named(export_binary, aa_g_export_binary, aabool, 0600);\n--\nsecurity/apparmor/lsm.c=1980=module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);\n--\nsecurity/apparmor/lsm.c-1986- /\nsecurity/apparmor/lsm.c:1987:bool aa_g_paranoid_load = IS_ENABLED(CONFIG_SECURITY_APPARMOR_PARANOID_LOAD);\nsecurity/apparmor/lsm.c-1988-module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);\n--\nsecurity/apparmor/lsm.c=2629=DEFINE_LSM(apparmor) = {\n--\nsecurity/apparmor/lsm.c-2638-#endif\nsecurity/apparmor/lsm.c:2639:#ifdef CONFIG_SECURITY_APPARMOR_HASH\nsecurity/apparmor/lsm.c-2640-\t.initcall_late = init_profile_hash,\n--\nsecurity/apparmor/policy_unpack.c=1619=static int compress_zstd(const char src, size_t slen, char dst, size_t dlen)\nsecurity/apparmor/policy_unpack.c-1620-{\nsecurity/apparmor/policy_unpack.c:1621:#ifdef CONFIG_SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/policy_unpack.c-1622-\tconst zstd_parameters params =\n--\nsecurity/commoncap.c=1025=int cap_inode_setxattr(struct dentry dentry, const char name,\n--\nsecurity/commoncap.c-1030-\t/* Ignore non-security xattrs /\nsecurity/commoncap.c:1031:\tif (strncmp(name, XATTR_SECURITY_PREFIX,\nsecurity/commoncap.c:1032:\t\t\tXATTR_SECURITY_PREFIX_LEN) != 0)\nsecurity/commoncap.c-1033-\t\treturn 0;\n--\nsecurity/commoncap.c=1066=int cap_inode_removexattr(struct mnt_idmap idmap,\n--\nsecurity/commoncap.c-1071-\t/* Ignore non-security xattrs /\nsecurity/commoncap.c:1072:\tif (strncmp(name, XATTR_SECURITY_PREFIX,\nsecurity/commoncap.c:1073:\t\t\tXATTR_SECURITY_PREFIX_LEN) != 0)\nsecurity/commoncap.c-1074-\t\treturn 0;\n--\nsecurity/commoncap.c=1469=int cap_mmap_addr(unsigned long addr)\n--\nsecurity/commoncap.c-1482-\nsecurity/commoncap.c:1483:#ifdef CONFIG_SECURITY\nsecurity/commoncap.c-1484-\n--\nsecurity/commoncap.c=1517=DEFINE_LSM(capability) = {\n--\nsecurity/commoncap.c-1522-\nsecurity/commoncap.c:1523:#endif / CONFIG_SECURITY /\nsecurity/commoncap.c-1524-\nsecurity/commoncap.c:1525:#ifdef CONFIG_SECURITY_COMMONCAP_KUNIT_TEST\nsecurity/commoncap.c-1526-#include \"commoncap_test.c\"\n--\nsecurity/commoncap_test.c-17-\nsecurity/commoncap_test.c:18:#ifdef CONFIG_SECURITY_COMMONCAP_KUNIT_TEST\nsecurity/commoncap_test.c-19-\n--\nsecurity/commoncap_test.c=286=MODULE_LICENSE(\"GPL\");\nsecurity/commoncap_test.c-287-\nsecurity/commoncap_test.c:288:#endif / CONFIG_SECURITY_COMMONCAP_KUNIT_TEST /\n--\nsecurity/inode.c=42=static int securityfs_fill_super(struct super_block sb, struct fs_context fc)\n--\nsecurity/inode.c-46-\nsecurity/inode.c:47:\terror = simple_fill_super(sb, SECURITYFS_MAGIC, files);\nsecurity/inode.c-48-\tif (error)\n--\nsecurity/inode.c=308=EXPORT_SYMBOL_GPL(securityfs_remove);\nsecurity/inode.c-309-\nsecurity/inode.c:310:#ifdef CONFIG_SECURITY\nsecurity/inode.c-311-#include \u003clinux/spinlock.h\u003e\n--\nsecurity/inode.c=362=int __init securityfs_init(void)\n--\nsecurity/inode.c-374-\t}\nsecurity/inode.c:375:#ifdef CONFIG_SECURITY\nsecurity/inode.c-376-\tlsm_dentry = securityfs_create_file(\"lsm\", 0444, NULL, NULL,\n--\nsecurity/integrity/Kconfig=3=config INTEGRITY\nsecurity/integrity/Kconfig-4-\tbool \"Integrity subsystem\"\nsecurity/integrity/Kconfig:5:\tdepends on SECURITY\nsecurity/integrity/Kconfig-6-\tdefault y\n--\nsecurity/integrity/evm/Kconfig=2=config EVM\n--\nsecurity/integrity/evm/Kconfig-8-\tselect CRYPTO_HASH_INFO\nsecurity/integrity/evm/Kconfig:9:\tselect SECURITY_PATH\nsecurity/integrity/evm/Kconfig-10-\tdefault n\n--\nsecurity/integrity/evm/Kconfig=31=config EVM_EXTRA_SMACK_XATTRS\nsecurity/integrity/evm/Kconfig-32-\tbool \"Additional SMACK xattrs\"\nsecurity/integrity/evm/Kconfig:33:\tdepends on EVM \u0026\u0026 SECURITY_SMACK\nsecurity/integrity/evm/Kconfig-34-\tdefault n\n--\nsecurity/integrity/evm/evm_crypto.c=406=int evm_init_hmac(struct inode inode, const struct xattr xattrs,\n--\nsecurity/integrity/evm/evm_crypto.c-422-\t\t\tif (strcmp(xattr_entry-\u003ename +\nsecurity/integrity/evm/evm_crypto.c:423:\t\t\t\t XATTR_SECURITY_PREFIX_LEN, xattr-\u003ename) != 0)\nsecurity/integrity/evm/evm_crypto.c-424-\t\t\t\tcontinue;\n--\nsecurity/integrity/evm/evm_main.c=38=static struct xattr_list evm_config_default_xattrnames[] = {\n--\nsecurity/integrity/evm/evm_main.c-40-\t .name = XATTR_NAME_SELINUX,\nsecurity/integrity/evm/evm_main.c:41:\t .enabled = IS_ENABLED(CONFIG_SECURITY_SELINUX)\nsecurity/integrity/evm/evm_main.c-42-\t},\n--\nsecurity/integrity/evm/evm_main.c-44-\t .name = XATTR_NAME_SMACK,\nsecurity/integrity/evm/evm_main.c:45:\t .enabled = IS_ENABLED(CONFIG_SECURITY_SMACK)\nsecurity/integrity/evm/evm_main.c-46-\t},\n--\nsecurity/integrity/evm/evm_main.c-60-\t .name = XATTR_NAME_APPARMOR,\nsecurity/integrity/evm/evm_main.c:61:\t .enabled = IS_ENABLED(CONFIG_SECURITY_APPARMOR)\nsecurity/integrity/evm/evm_main.c-62-\t},\n--\nsecurity/integrity/evm/evm_main.c=322=static int evm_protected_xattr_common(const char req_xattr_name,\n--\nsecurity/integrity/evm/evm_main.c-339-\t\tif (strncmp(req_xattr_name,\nsecurity/integrity/evm/evm_main.c:340:\t\t\t xattr-\u003ename + XATTR_SECURITY_PREFIX_LEN,\nsecurity/integrity/evm/evm_main.c-341-\t\t\t strlen(req_xattr_name)) == 0) {\n--\nsecurity/integrity/evm/evm_secfs.c=185=static ssize_t evm_write_xattrs(struct file file, const char __user buf,\n--\nsecurity/integrity/evm/evm_secfs.c-242-\nsecurity/integrity/evm/evm_secfs.c:243:\tif (strncmp(xattr-\u003ename, XATTR_SECURITY_PREFIX,\nsecurity/integrity/evm/evm_secfs.c:244:\t\t XATTR_SECURITY_PREFIX_LEN) != 0) {\nsecurity/integrity/evm/evm_secfs.c-245-\t\terr = -EINVAL;\n--\nsecurity/integrity/ima/Kconfig=4=config IMA\nsecurity/integrity/ima/Kconfig-5-\tbool \"Integrity Measurement Architecture(IMA)\"\nsecurity/integrity/ima/Kconfig:6:\tselect SECURITYFS\nsecurity/integrity/ima/Kconfig-7-\tselect CRYPTO\n--\nsecurity/integrity/ima/Kconfig-10-\tselect CRYPTO_HASH_INFO\nsecurity/integrity/ima/Kconfig:11:\tselect SECURITY_PATH\nsecurity/integrity/ima/Kconfig-12-\tselect TCG_TPM if HAS_IOMEM\n--\nsecurity/integrity/ima/Kconfig=56=config IMA_LSM_RULES\nsecurity/integrity/ima/Kconfig-57-\tbool\nsecurity/integrity/ima/Kconfig:58:\tdepends on AUDIT \u0026\u0026 (SECURITY_SELINUX \|\| SECURITY_SMACK \|\| SECURITY_APPARMOR)\nsecurity/integrity/ima/Kconfig-59-\tdefault y\n--\nsecurity/integrity/ima/ima_policy.c=152=static struct ima_rule_entry dont_measure_rules[] __ro_after_init = {\n--\nsecurity/integrity/ima/ima_policy.c-159-\t{.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},\nsecurity/integrity/ima/ima_policy.c:160:\t{.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},\nsecurity/integrity/ima/ima_policy.c-161-\t{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},\n--\nsecurity/integrity/ima/ima_policy.c=199=static struct ima_rule_entry default_appraise_rules[] __ro_after_init = {\n--\nsecurity/integrity/ima/ima_policy.c-206-\t{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},\nsecurity/integrity/ima/ima_policy.c:207:\t{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},\nsecurity/integrity/ima/ima_policy.c-208-\t{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},\n--\nsecurity/integrity/platform_certs/load_uefi.c=160=static int __init load_uefi_certs(void)\nsecurity/integrity/platform_certs/load_uefi.c-161-{\nsecurity/integrity/platform_certs/load_uefi.c:162:\tefi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID;\nsecurity/integrity/platform_certs/load_uefi.c-163-\tefi_guid_t mok_var = EFI_SHIM_LOCK_GUID;\n--\nsecurity/ipe/Kconfig-5-\nsecurity/ipe/Kconfig:6:menuconfig SECURITY_IPE\nsecurity/ipe/Kconfig-7-\tbool \"Integrity Policy Enforcement (IPE)\"\nsecurity/ipe/Kconfig:8:\tdepends on SECURITY \u0026\u0026 SECURITYFS \u0026\u0026 AUDIT \u0026\u0026 AUDITSYSCALL\nsecurity/ipe/Kconfig-9-\tselect CRYPTO_LIB_SHA256\n--\nsecurity/ipe/Kconfig-23-\nsecurity/ipe/Kconfig:24:if SECURITY_IPE\nsecurity/ipe/Kconfig-25-config IPE_BOOT_POLICY\n--\nsecurity/ipe/Kconfig=98=endmenu\nsecurity/ipe/Kconfig-99-\nsecurity/ipe/Kconfig:100:config SECURITY_IPE_KUNIT_TEST\nsecurity/ipe/Kconfig-101-\tbool \"Build KUnit tests for IPE\" if !KUNIT_ALL_TESTS\n--\nsecurity/ipe/Makefile=13=$(obj)/boot_policy.c: scripts/ipe/polgen/polgen $(CONFIG_IPE_BOOT_POLICY) FORCE\n--\nsecurity/ipe/Makefile-15-\nsecurity/ipe/Makefile:16:obj-$(CONFIG_SECURITY_IPE) += \\\nsecurity/ipe/Makefile-17-\tboot_policy.o \\\n--\nsecurity/ipe/Makefile=28=clean-files := boot_policy.c \\\nsecurity/ipe/Makefile-29-\nsecurity/ipe/Makefile:30:obj-$(CONFIG_SECURITY_IPE_KUNIT_TEST) += \\\nsecurity/ipe/Makefile-31-\tpolicy_tests.o \\\n--\nsecurity/keys/compat.c=17=COMPAT_SYSCALL_DEFINE5(keyctl, u32, option,\n--\nsecurity/keys/compat.c-73-\nsecurity/keys/compat.c:74:\tcase KEYCTL_GET_SECURITY:\nsecurity/keys/compat.c-75-\t\treturn keyctl_get_security(arg2, compat_ptr(arg3), arg4);\n--\nsecurity/keys/keyctl.c=1886=SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,\n--\nsecurity/keys/keyctl.c-1961-\nsecurity/keys/keyctl.c:1962:\tcase KEYCTL_GET_SECURITY:\nsecurity/keys/keyctl.c-1963-\t\treturn keyctl_get_security((key_serial_t) arg2,\n--\nsecurity/landlock/.kunitconfig=3=CONFIG_NET=y\nsecurity/landlock/.kunitconfig:4:CONFIG_SECURITY=y\nsecurity/landlock/.kunitconfig:5:CONFIG_SECURITY_LANDLOCK=y\nsecurity/landlock/.kunitconfig:6:CONFIG_SECURITY_LANDLOCK_KUNIT_TEST=y\n--\nsecurity/landlock/Kconfig-2-\nsecurity/landlock/Kconfig:3:config SECURITY_LANDLOCK\nsecurity/landlock/Kconfig-4-\tbool \"Landlock support\"\n\n" }
5/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 24816 output: 28 thoughts: 976 Thoughts: Analyzing Security Context Updates in the Kernel Okay, let's break this down. First, I need to understand the scope of the changes related to `security/security.c`, given it's compiled under `CONFIG_SECURITY`. I'm also going to note the dependencies, like `security/selinux/hooks.c` which relies on `CONFIG_SECURITY_SELINUX`, and `security/smack/smack_lsm.c` on `CONFIG_SECURITY_SMACK`. The VFS core function `fs/namei.c` is always compiled, which is key to understanding its interactions. Also, there's `fs/cachefiles/security.c` and `CONFIG_CACHEFILES`, so I'll keep that in mind. Now, I need to identify which specific functions are being touched in `security/security.c` and `fs/namei.c`, and note which symbols are being modified or are direct entry points for this patch. I see the patch modifies several functions in `fs/namei.c`: `vfs_create`, `vfs_mkobj`, `may_o_create`, `vfs_mknod`, `vfs_mkdir`, `vfs_symlink`, `vfs_link`, `inode_permission`, and `lookup_inode_permission_may_exec`. In `fs/cachefiles/security.c`, `cachefiles_check_cache_dir` is relevant. Of course, `security/security.c` has these security hooks: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_permission`. The SELinux implementations are: `selinux_inode_create`, `selinux_inode_link`, `selinux_inode_symlink`, `selinux_inode_mkdir`, `selinux_inode_mknod`, and `selinux_inode_permission`. And for SMACK: `smack_inode_link` and `smack_inode_permission`. Okay, next I need to apply Section 4: FocusSymbols guidelines. The critical point is to AVOID ubiquitous lifecycle hot-paths. I have to think about what is actually ubiquitous. Clearly `inode_permission` and `security_inode_permission` are called everywhere during path lookup or file access, so they're probably out. Listing them would dilute the coverage, but what about the specific hooks like `security_inode_create`, `security_inode_link`, etc.? Same question for the LSM implementations and the VFS functions like `vfs_mkdir`, `vfs_symlink`, etc. Wait a second. The specific LSM hook entry points that the patch modifies, to take `struct mnt_idmap *idmap`, are good focus symbols. So, I need to check those: `security_inode_create`, `security_inode_mkdir`, and so on, are good. And also: `selinux_inode_create`, `selinux_inode_link`, `selinux_inode_symlink`, `selinux_inode_mkdir`, `selinux_inode_mknod`, `smack_inode_link`. Got it. Now, let's verify the relevant configurations: `CONFIG_SECURITY`, `CONFIG_SECURITY_SELINUX`, `CONFIG_SECURITY_SMACK`, and `CONFIG_CACHEFILES`. Finally, I need to check if any other configurations or `BPF_LSM` are relevant here, since there were updates to the BPF LSM selftests. Time to check `BPF_LSM` in `Kconfig`.
6/2	2026/09/06 00:31	tool	grepper	0m Error: no matches Args: { "Expression": "config BPF_LSM", "PathPrefix": "security/" } Results: { "error": "no matches" }
7/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 26648 output: 20 thoughts: 13 Thoughts: Here's my thought process, summarized as you requested: Locating the BPF_LSM Definition Okay, so I need to track down the definition of `BPF_LSM`. It's pretty straightforward, but I have a feeling I'll be in for a deep dive, given its significance in the Linux Security Module (LSM) context. I'll need to figure out which headers or source files hold this constant. It's likely in a header file, given that it's probably used across multiple parts of the kernel or related tools. I'll probably start with the standard include paths, and then narrow down my search to likely spots like the BPF (Berkeley Packet Filter) or LSM-specific directories. I'll utilize my knowledge of the kernel's source layout to efficiently pinpoint where this constant is declared. I may even start with a `grep` or similar command.
8/2	2026/09/06 00:31	tool	grepper	0m Args: { "Expression": "config BPF_LSM" } Results: { "Output": "kernel/bpf/Kconfig=90=source \"kernel/bpf/preload/Kconfig\"\nkernel/bpf/Kconfig-91-\nkernel/bpf/Kconfig:92:config BPF_LSM\nkernel/bpf/Kconfig-93-\tbool \"Enable BPF LSM Instrumentation\"\n" }
9/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 26959 output: 34 thoughts: 19 Thoughts: Here's my take on the situation: Investigating BPF Configuration Okay, so I need to dig into the BPF configuration. My initial thought is to zero in on `kernel/bpf/Kconfig`. I'm going to start around line 92. Hopefully, that will give me a good entry point to understand how things are set up and perhaps identify any potential issues or areas for further exploration within the BPF configuration options. Let's see what we can find there.
10/2	2026/09/06 00:31	tool	read-file	0m Args: { "File": "kernel/bpf/Kconfig", "FirstLine": 90, "LineCount": 20 } Results: { "Contents": " 90:\tsource \"kernel/bpf/preload/Kconfig\"\n 91:\t\n 92:\tconfig BPF_LSM\n 93:\t\tbool \"Enable BPF LSM Instrumentation\"\n 94:\t\tdepends on BPF_EVENTS\n 95:\t\tdepends on BPF_SYSCALL\n 96:\t\tdepends on SECURITY\n 97:\t\tdepends on BPF_JIT\n 98:\t\thelp\n 99:\t\t Enables instrumentation of the security hooks with BPF programs for\n 100:\t\t implementing dynamic MAC and Audit Policies.\n 101:\t\n 102:\t\t If you are unsure how to answer this question, answer N.\n 103:\t\n 104:\tendmenu # \"BPF subsystem\"\n" }
11/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 27321 output: 29 thoughts: 18 Thoughts: Okay, here's my summary, tailored for an expert audience, as if it's coming directly from my own thought process: Diving into the Cachefiles Configuration Alright, time to get to the heart of the matter. My immediate thought is to zero in on the `fs/cachefiles/Kconfig` file. I need to understand the configuration options related to `CACHEFILES`, specifically. I'm assuming that it is in this area where the core settings and dependencies for cachefiles are defined. I want to see precisely how `CACHEFILES` is managed and what other features or modules are contingent on it. This should give me a solid foundation for addressing whatever the current problem is. I need to quickly grasp the implications of any configuration changes I might consider. Let's see what's in there.
12/2	2026/09/06 00:31	tool	grepper	0m Args: { "Expression": "config CACHEFILES", "PathPrefix": "fs/cachefiles/" } Results: { "Output": "fs/cachefiles/Kconfig-2-\nfs/cachefiles/Kconfig:3:config CACHEFILES\nfs/cachefiles/Kconfig-4-\ttristate \"Filesystem caching on files\"\n--\nfs/cachefiles/Kconfig-13-\nfs/cachefiles/Kconfig:14:config CACHEFILES_DEBUG\nfs/cachefiles/Kconfig-15-\tbool \"Debug CacheFiles\"\n--\nfs/cachefiles/Kconfig-22-\nfs/cachefiles/Kconfig:23:config CACHEFILES_ERROR_INJECTION\nfs/cachefiles/Kconfig-24-\tbool \"Provide error injection for cachefiles\"\n" }
13/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 27707 output: 32 thoughts: 24 Thoughts: Here's my take: Investigating Security Configuration Options Alright, time to dig into the kernel configuration. I need to get a handle on the SELinux and SMACK security modules. I'll start by checking out the `security/selinux/Kconfig` file and the `security/smack/Kconfig` file. Those Kconfig files are the heart of configuring each security module. They should give me a clear picture of what options are available, how they're structured, and what dependencies might be at play. Understanding this at the Kconfig level is crucial before I can even start to think about the intricacies of the actual code or any potential integration work. Time to get down to the nitty-gritty.
14/2	2026/09/06 00:31	tool	grepper	0m Args: { "Expression": "config SECURITY_SELINUX", "PathPrefix": "security/selinux/" } Results: { "Output": "security/selinux/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/selinux/Kconfig:2:config SECURITY_SELINUX\nsecurity/selinux/Kconfig-3-\tbool \"SELinux Support\"\n--\nsecurity/selinux/Kconfig-11-\nsecurity/selinux/Kconfig:12:config SECURITY_SELINUX_BOOTPARAM\nsecurity/selinux/Kconfig-13-\tbool \"SELinux boot parameter\"\n--\nsecurity/selinux/Kconfig-25-\nsecurity/selinux/Kconfig:26:config SECURITY_SELINUX_DEVELOP\nsecurity/selinux/Kconfig-27-\tbool \"SELinux Development Support\"\n--\nsecurity/selinux/Kconfig-39-\nsecurity/selinux/Kconfig:40:config SECURITY_SELINUX_AVC_STATS\nsecurity/selinux/Kconfig-41-\tbool \"SELinux AVC Statistics\"\n--\nsecurity/selinux/Kconfig-48-\nsecurity/selinux/Kconfig:49:config SECURITY_SELINUX_SIDTAB_HASH_BITS\nsecurity/selinux/Kconfig-50-\tint \"SELinux sidtab hashtable size\"\n--\nsecurity/selinux/Kconfig-60-\nsecurity/selinux/Kconfig:61:config SECURITY_SELINUX_SID2STR_CACHE_SIZE\nsecurity/selinux/Kconfig-62-\tint \"SELinux SID to context string translation cache size\"\n--\nsecurity/selinux/Kconfig-71-\nsecurity/selinux/Kconfig:72:config SECURITY_SELINUX_AVC_HASH_BITS\nsecurity/selinux/Kconfig-73-\tint \"SELinux avc hashtable size\"\n--\nsecurity/selinux/Kconfig-82-\nsecurity/selinux/Kconfig:83:config SECURITY_SELINUX_DEBUG\nsecurity/selinux/Kconfig-84-\tbool \"SELinux kernel debugging support\"\n" }
15/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 28422 output: 30 thoughts: 13 Thoughts: Here's my take on those thoughts, tailored for an expert audience: Examining the SMACK Kconfig Configuration Okay, so I'm thinking, let's dive into the `security/smack/Kconfig` file. This is where the core configuration options for Security-Enhanced Linux (SMACK) within the kernel are defined, and it's a critical piece of the puzzle. I need to refresh my memory on the current state of the options, their dependencies, and any recent changes. I want to understand how the build system handles SMACK's inclusion or exclusion. I'm looking for the specific configuration variables, their default values, and the associated help text. Are there any conditional dependencies I should be aware of, perhaps related to other security modules or features? I need to quickly grasp the implications of enabling or disabling SMACK on a system, and how the configuration will impact other kernel components. Time to get into the details of the configuration file.
16/2	2026/09/06 00:31	tool	grepper	0m Args: { "Expression": "config SECURITY_SMACK", "PathPrefix": "security/smack/" } Results: { "Output": "security/smack/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/smack/Kconfig:2:config SECURITY_SMACK\nsecurity/smack/Kconfig-3-\tbool \"Simplified Mandatory Access Control Kernel Support\"\n--\nsecurity/smack/Kconfig-15-\nsecurity/smack/Kconfig:16:config SECURITY_SMACK_BRINGUP\nsecurity/smack/Kconfig-17-\tbool \"Reporting on access granted by Smack rules\"\n--\nsecurity/smack/Kconfig-33-\nsecurity/smack/Kconfig:34:config SECURITY_SMACK_NETFILTER\nsecurity/smack/Kconfig-35-\tbool \"Packet marking using secmarks for netfilter\"\n--\nsecurity/smack/Kconfig-44-\nsecurity/smack/Kconfig:45:config SECURITY_SMACK_APPEND_SIGNALS\nsecurity/smack/Kconfig-46-\tbool \"Treat delivering signals as an append operation\"\n" }
17/2	2026/09/06 00:31	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 28916 output: 274 thoughts: 873 Thoughts: Reviewing Security LSM Hook Updates for Fuzzing Okay, let's take a look at these modifications and zero in on what's relevant for fuzzing. First, I need to double-check all the modified functions and files to understand the scope of this change. It looks like we've got a list of changes that mainly involve passing an `idmap` struct to various security-related functions. Specifically, I'm seeing changes in `fs/cachefiles/security.c`, where `cachefiles_check_cache_dir` now uses `security_inode_mkdir` and `security_inode_create`. Then, a good chunk of `fs/namei.c` has been updated; `inode_permission`, `lookup_inode_permission_may_exec`, `vfs_create`, `vfs_mkobj`, `may_o_create`, `vfs_mknod`, `vfs_mkdir`, `vfs_symlink`, and `vfs_link` all now pass `idmap` to their respective security functions. The core API signature updates are reflected in `include/linux/lsm_hook_defs.h` and `include/linux/security.h`, adding the `struct mnt_idmap idmap` parameter to the relevant inode hooks. Of course, this ripples down into the implementations within `security/security.c`, `security/selinux/hooks.c`, and `security/smack/smack_lsm.c` as they are now updated to handle the new `idmap` parameter. Finally, there's some activity in `tools/testing/selftests/bpf/...`. Given the presence of `SECURITY`, `SECURITY_SELINUX`, `SECURITY_SMACK`, `CACHEFILES`, and `BPF_LSM` in the enabled configurations, this is definitely worth fuzzing. I'm focusing on these specific symbols: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, along with their SELinux counterparts (`selinux_inode_`) and `smack_inode_link`. I'm also including `cachefiles_check_cache_dir` and `vfs_mkobj`. My focus is to avoid common, "ubiquitous" functions like `inode_permission` or `security_inode_permission` if they're called everywhere. Instead, I want to target the more specific inode hook functions, such as those related to creating, linking, symlinking, making directories, and making nodes. Those should offer more targeted fuzzing opportunities. Alright, I'm confident in this assessment. Time to call `set-results`.
18/2	2026/09/06 00:31	tool	set-results	0m Args: { "EnableConfigs": [ "SECURITY", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES", "BPF_LSM" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "selinux_inode_create", "selinux_inode_link", "selinux_inode_symlink", "selinux_inode_mkdir", "selinux_inode_mknod", "smack_inode_link", "cachefiles_check_cache_dir", "vfs_mkobj" ], "Reasoning": "The patch updates LSM inode hook interfaces (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their callers across the VFS layer, CacheFiles, SELinux, and Smack to pass the mount idmap (struct mnt_idmap idmap). This alters core VFS and LSM interaction paths which are fully reachable and relevant to fuzzing.", "WorthFuzzing": true } Results:* { "EnableConfigs": [ "SECURITY", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES", "BPF_LSM" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "selinux_inode_create", "selinux_inode_link", "selinux_inode_symlink", "selinux_inode_mkdir", "selinux_inode_mknod", "smack_inode_link", "cachefiles_check_cache_dir", "vfs_mkobj" ], "Reasoning": "The patch updates LSM inode hook interfaces (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their callers across the VFS layer, CacheFiles, SELinux, and Smack to pass the mount idmap (struct mnt_idmap *idmap). This alters core VFS and LSM interaction paths which are fully reachable and relevant to fuzzing.", "WorthFuzzing": true }
19/1	2026/09/06 00:31	action	If	0m Args: { "WorthFuzzing": true } Results: null
20/2	2026/09/06 00:31	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch modifies several LSM inode hook prototypes (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their invocations in the VFS layer (fs/namei.c, fs/cachefiles/security.c) and security modules to propagate the 'struct mnt_idmap idmap' argument, along with adding BPF LSM test cases for these hooks.\n\nNo new memory allocations, uninitialized variable reads, or copies to user space are introduced or altered. The changes are strictly signature and calling convention updates passing an existing idmap pointer through to the LSM hook infrastructure. Thus, there are no uninitialized memory risks that would require dedicated KMSAN fuzzing.", "NeedsKMSAN": false } Instruction:* You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 55d0f237c02a3ea5e8a12e11f1ced261eb11923e Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 6 00:31:07 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c index fc6611886b3b5..eefe5453b904e 100644 --- a/fs/cachefiles/security.c +++ b/fs/cachefiles/security.c @@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache cache, { int ret; - ret = security_inode_mkdir(d_backing_inode(root), root, 0); + ret = security_inode_mkdir(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) { pr_err("Security denies permission to make dirs: error %d", ret); return ret; } - ret = security_inode_create(d_backing_inode(root), root, 0); + ret = security_inode_create(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) pr_err("Security denies permission to create files: error %d", ret); diff --git a/fs/namei.c b/fs/namei.c index 20a6534ea3eff..99f894f3f7e13 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap idmap, if (unlikely(retval)) return retval; - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } EXPORT_SYMBOL(inode_permission); @@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap id if (unlikely(((inode->i_mode & 0111) != 0111) \|\| !no_acl_inode(inode))) return inode_permission(idmap, inode, mask); - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } /* @@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode, return -EACCES; /* shouldn't it be ENOSYS? / mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(idmap, dir, dentry, mode); if (error) return error; error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di); @@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry dentry, umode_t mode, mode &= S_IALLUGO; mode \|= S_IFREG; - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(&nop_mnt_idmap, dir, dentry, mode); if (error) return error; error = f(dentry, mode, arg); @@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap idmap, if (error) return error; - return security_inode_create(dir->dentry->d_inode, dentry, mode); + return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode); } /* @@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap idmap, struct inode dir, if (error) return error; - error = security_inode_mknod(dir, dentry, mode, dev); + error = security_inode_mknod(idmap, dir, dentry, mode, dev); if (error) return error; @@ -5395,7 +5395,7 @@ struct dentry vfs_mkdir(struct mnt_idmap idmap, struct inode dir, goto err; mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO \| S_ISVTX, S_IFDIR); - error = security_inode_mkdir(dir, dentry, mode); + error = security_inode_mkdir(idmap, dir, dentry, mode); if (error) goto err; @@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap idmap, struct inode dir, if (!dir->i_op->symlink) return -EPERM; - error = security_inode_symlink(dir, dentry, oldname); + error = security_inode_symlink(idmap, dir, dentry, oldname); if (error) return error; @@ -5907,7 +5907,7 @@ int vfs_link(struct dentry old_dentry, struct mnt_idmap idmap, if (S_ISDIR(inode->i_mode)) return -EPERM; - error = security_inode_link(old_dentry, dir, new_dentry); + error = security_inode_link(idmap, old_dentry, dir, new_dentry); if (error) return error; diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec2077..9e49a5bc9ff3c 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode inode, int xattr_count) LSM_HOOK(int, 0, inode_init_security_anon, struct inode inode, const struct qstr name, const struct inode context_inode) -LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap idmap, struct inode inode) -LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +LSM_HOOK(int, 0, inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_symlink, struct inode dir, struct dentry dentry, - const char old_name) -LSM_HOOK(int, 0, inode_mkdir, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) +LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(int, 0, inode_rmdir, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_mknod, struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) LSM_HOOK(int, 0, inode_rename, struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_readlink, struct dentry dentry) LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode, bool rcu) -LSM_HOOK(int, 0, inode_permission, struct inode inode, int mask) +LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask) LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry, struct iattr attr) LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap idmap, diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f8..0f5f20ac10507 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -404,24 +404,28 @@ int security_inode_init_security(struct inode inode, struct inode dir, int security_inode_init_security_anon(struct inode inode, const struct qstr name, const struct inode context_inode); -int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode); -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry); +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry); int security_inode_unlink(struct inode dir, struct dentry dentry); -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name); -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name); +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); int security_inode_rmdir(struct inode dir, struct dentry dentry); -int security_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev); +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev); int security_inode_rename(struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry, unsigned int flags); int security_inode_readlink(struct dentry dentry); int security_inode_follow_link(struct dentry dentry, struct inode inode, bool rcu); -int security_inode_permission(struct inode inode, int mask); +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask); int security_inode_setattr(struct mnt_idmap idmap, struct dentry dentry, struct iattr attr); void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry, @@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode inode, return 0; } -static inline int security_inode_create(struct inode dir, - struct dentry dentry, - umode_t mode) +static inline int security_inode_create(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + umode_t mode) { return 0; } @@ -913,9 +918,10 @@ static inline void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode) { } -static inline int security_inode_link(struct dentry old_dentry, - struct inode dir, - struct dentry new_dentry) +static inline int security_inode_link(struct mnt_idmap idmap, + struct dentry old_dentry, + struct inode dir, + struct dentry new_dentry) { return 0; } @@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode dir, return 0; } -static inline int security_inode_symlink(struct inode dir, - struct dentry dentry, - const char old_name) +static inline int security_inode_symlink(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + const char old_name) { return 0; } -static inline int security_inode_mkdir(struct inode dir, - struct dentry dentry, - int mode) +static inline int security_inode_mkdir(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode) { return 0; } @@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode dir, return 0; } -static inline int security_inode_mknod(struct inode dir, - struct dentry dentry, - int mode, dev_t dev) +static inline int security_inode_mknod(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode, dev_t dev) { return 0; } @@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry dentry, return 0; } -static inline int security_inode_permission(struct inode inode, int mask) +static inline int security_inode_permission(struct mnt_idmap idmap, + struct inode inode, int mask) { return 0; } diff --git a/security/security.c b/security/security.c index 2ee276ab15c5b..a9190da3341dd 100644 --- a/security/security.c +++ b/security/security.c @@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path path) /* * security_inode_create() - Check if creating a file is allowed + * @idmap: idmap of the mount * @dir: the parent directory * @dentry: the file being created * @mode: requested file mode @@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path path) * Return: Returns 0 if permission is granted. / -int security_inode_create(struct inode dir, struct dentry dentry, - umode_t mode) +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_create, dir, dentry, mode); + return call_int_hook(inode_create, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_create); @@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, /* * security_inode_link() - Check if creating a hard link is allowed + * @idmap: idmap of the mount * @old_dentry: existing file * @dir: new parent directory * @new_dentry: new link @@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, * Return: Returns 0 if permission is granted. / -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) return 0; - return call_int_hook(inode_link, old_dentry, dir, new_dentry); + return call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry); } /** @@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) /** * security_inode_symlink() - Check if creating a symbolic link is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: symbolic link * @old_name: existing filename @@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name) +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_symlink, dir, dentry, old_name); + return call_int_hook(inode_symlink, idmap, dir, dentry, old_name); } /** * security_inode_mkdir() - Check if creating a new directory is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new directory * @mode: new directory mode @@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode dir, struct dentry dentry, * * Return: Returns 0 if permission is granted. / -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode) +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mkdir, dir, dentry, mode); + return call_int_hook(inode_mkdir, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_mkdir); @@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) /** * security_inode_mknod() - Check if creating a special file is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new file * @mode: new file mode @@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_mknod(struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mknod, dir, dentry, mode, dev); + return call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev); } /** @@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, /** * security_inode_permission() - Check if accessing an inode is allowed + * @idmap: idmap of the mount * @inode: inode * @mask: access mask * @@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, * * Return: Returns 0 if permission is granted. / -int security_inode_permission(struct inode inode, int mask) +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { if (unlikely(IS_PRIVATE(inode))) return 0; - return call_int_hook(inode_permission, inode, mask); + return call_int_hook(inode_permission, idmap, inode, mask); } /** diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 035aaf113d1da..967984d0af300 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode inode, &ad); } -static int selinux_inode_create(struct inode dir, struct dentry dentry, umode_t mode) +static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { return may_create(dir, dentry, SECCLASS_FILE); } -static int selinux_inode_link(struct dentry old_dentry, struct inode dir, struct dentry new_dentry) +static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { return may_link(dir, old_dentry, MAY_LINK); } @@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_UNLINK); } -static int selinux_inode_symlink(struct inode dir, struct dentry dentry, const char name) +static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char name) { return may_create(dir, dentry, SECCLASS_LNK_FILE); } -static int selinux_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mask) +static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mask) { return may_create(dir, dentry, SECCLASS_DIR); } @@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_RMDIR); } -static int selinux_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev) +static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { return may_create(dir, dentry, inode_mode_to_security_class(mode)); } @@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct tsec, /* * selinux_inode_permission - Check if the current task can access an inode + * @idmap: idmap of the mount * @inode: the inode that is being accessed * @requested: the accesses being requested * * Check if the current task is allowed to access @inode according to * @requested. Returns 0 if allowed, negative values otherwise. / -static int selinux_inode_permission(struct inode inode, int requested) +static int selinux_inode_permission(struct mnt_idmap idmap, + struct inode inode, int requested) { int mask; u32 perms; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8e88ac65fd7fc..a45819d13c0d6 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode inode, struct inode dir, /** * smack_inode_link - Smack check on link + * @idmap: idmap of the mount * @old_dentry: the existing object * @dir: unused * @new_dentry: the new object * * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { struct smack_known isp; struct smk_audit_info ad; @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode old_inode, /** * smack_inode_permission - Smack version of permission() + * @idmap: idmap of the mount * @inode: the inode in question * @mask: the access requested * @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode old_inode, * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_permission(struct inode inode, int mask) +static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { struct superblock_smack sbsp = smack_superblock(inode->i_sb); struct smk_audit_info ad; diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c index d7495efd4a562..c0ae813698ae2 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c @@ -1,18 +1,30 @@ // SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE / * Copyright (C) 2020 Google LLC. / #include <test_progs.h> +#include <sched.h> +#include <signal.h> +#include <string.h> +#include <sys/stat.h> +#include <sys/syscall.h> #include <sys/wait.h> #include <unistd.h> +#include <linux/mount.h> + #include "lsm.skel.h" #include "lsm_tailcall.skel.h" char CMD_ARGS[] = {"true", NULL}; +enum { + INODE_IDMAP_ALL = (1U << 6) - 1, +}; + int exec_cmd(int monitored_pid) { int child_pid, child_status; @@ -30,6 +42,219 @@ int exec_cmd(int monitored_pid) return -EINVAL; } +static ssize_t write_nointr(int fd, const void buf, size_t count) +{ + ssize_t ret; + + do { + ret = write(fd, buf, count); + } while (ret < 0 && errno == EINTR); + + return ret; +} + +static int write_file(const char path, const char value) +{ + size_t len = strlen(value); + int fd, saved_errno = 0; + ssize_t ret; + + fd = open(path, O_WRONLY \| O_CLOEXEC \| O_NOCTTY \| O_NOFOLLOW); + if (fd < 0) + return -1; + + ret = write_nointr(fd, value, len); + if (ret < 0) + saved_errno = errno; + else if ((size_t)ret != len) + saved_errno = EIO; + close(fd); + if (saved_errno) { + errno = saved_errno; + return -1; + } + return 0; +} + +static int write_userns_file(pid_t pid, const char name, const char value) +{ + char path[64]; + int len; + + len = snprintf(path, sizeof(path), "/proc/%d/%s", pid, name); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + return -1; + } + + return write_file(path, value); +} + +static int create_userns_fd(void) +{ + char path[64]; + pid_t pid, waited; + int fd = -1, len, saved_errno, status; + + pid = fork(); + if (pid < 0) + return -1; + if (pid == 0) { + if (unshare(CLONE_NEWUSER)) + _exit(1); + raise(SIGSTOP); + _exit(0); + } + + do { + waited = waitpid(pid, &status, WUNTRACED); + } while (waited < 0 && errno == EINTR); + if (waited != pid) + goto out; + if (!WIFSTOPPED(status)) { + pid = -1; + goto out; + } + + / A one-entry map is identity for root but remains distinct from nop_mnt_idmap. / + if (write_userns_file(pid, "setgroups", "deny") && errno != ENOENT) + goto out; + if (write_userns_file(pid, "uid_map", "0 0 1") \|\| + write_userns_file(pid, "gid_map", "0 0 1")) + goto out; + + len = snprintf(path, sizeof(path), "/proc/%d/ns/user", pid); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + goto out; + } + fd = open(path, O_RDONLY \| O_CLOEXEC); + +out: + saved_errno = errno; + if (pid > 0) { + kill(pid, SIGKILL); + do { + waited = waitpid(pid, NULL, 0); + } while (waited < 0 && errno == EINTR); + } + errno = saved_errno; + return fd; +} + +static int create_idmapped_tmpfs(void) +{ + struct mount_attr attr = { + .attr_set = MOUNT_ATTR_IDMAP, + }; + int fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1; + + userns_fd = create_userns_fd(); + if (userns_fd < 0) + goto out; + + / A detached tmpfs avoids relying on the host test directory supporting idmaps. / + fsfd = syscall(__NR_fsopen, "tmpfs", FSOPEN_CLOEXEC); + if (fsfd < 0) + goto out; + if (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)) + goto out; + + mntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0); + if (mntfd < 0) + goto out; + + attr.userns_fd = userns_fd; + if (syscall(__NR_mount_setattr, mntfd, "", AT_EMPTY_PATH, &attr, + sizeof(attr))) { + close(mntfd); + mntfd = -1; + } + +out: + saved_errno = errno; + if (fsfd >= 0) + close(fsfd); + if (userns_fd >= 0) + close(userns_fd); + errno = saved_errno; + return mntfd; +} + +static int exercise_inode_idmap_hooks(int dirfd) +{ + int fd = -1, ret = -1; + + fd = openat(dirfd, "file", O_CREAT \| O_EXCL \| O_WRONLY \| O_CLOEXEC, + 0600); + if (!ASSERT_GE(fd, 0, "create")) + goto out; + close(fd); + fd = -1; + + if (!ASSERT_OK(mkdirat(dirfd, "dir", 0700), "mkdir")) + goto out; + if (!ASSERT_OK(symlinkat("target", dirfd, "symlink"), "symlink")) + goto out; + if (!ASSERT_OK(linkat(dirfd, "file", dirfd, "link", 0), "link")) + goto out; + if (!ASSERT_OK(mkfifoat(dirfd, "fifo", 0600), "mknod")) + goto out; + + ret = 0; +out: + if (fd >= 0) + close(fd); + unlinkat(dirfd, "link", 0); + unlinkat(dirfd, "fifo", 0); + unlinkat(dirfd, "symlink", 0); + unlinkat(dirfd, "file", 0); + unlinkat(dirfd, "dir", AT_REMOVEDIR); + return ret; +} + +static int test_lsm_inode_idmap(struct lsm skel) +{ + char tmpdir[] = "/var/tmp/test_lsm_idmap.XXXXXX"; + __u32 expected = INODE_IDMAP_ALL; + int dirfd = -1, idmapped_dirfd = -1; + int ret = -1; + + if (!ASSERT_OK_PTR(mkdtemp(tmpdir), "mkdtemp")) + return -1; + + dirfd = open(tmpdir, O_RDONLY \| O_DIRECTORY \| O_CLOEXEC); + if (!ASSERT_GE(dirfd, 0, "open_tmpdir")) + goto out; + + idmapped_dirfd = create_idmapped_tmpfs(); + if (!ASSERT_GE(idmapped_dirfd, 0, "create_idmapped_tmpfs")) + goto out; + + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; + + if (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), "identity_idmap")) + goto out; + if (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd), + "idmapped_mount")) + goto out; + + if (!ASSERT_EQ(skel->bss->inode_identity_idmap_seen, expected, + "inode_identity_idmap_seen")) + goto out; + ret = ASSERT_EQ(skel->bss->inode_idmapped_mount_seen, expected, + "inode_idmapped_mount_seen") ? 0 : -1; + +out: + if (idmapped_dirfd >= 0) + close(idmapped_dirfd); + if (dirfd >= 0) + close(dirfd); + rmdir(tmpdir); + return ret; +} + static int test_lsm(struct lsm skel) { struct bpf_link link; @@ -53,6 +278,10 @@ static int test_lsm(struct lsm skel) skel->bss->monitored_pid = getpid(); + err = test_lsm_inode_idmap(skel); + if (!ASSERT_OK(err, "test_lsm_inode_idmap")) + return err; + err = stack_mprotect(); if (!ASSERT_EQ(err, -1, "stack_mprotect") \|\| !ASSERT_EQ(errno, EPERM, "stack_mprotect")) @@ -71,6 +300,8 @@ static int test_lsm(struct lsm skel) skel->bss->copy_test = 0; skel->bss->bprm_count = 0; skel->bss->mprotect_count = 0; + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; return 0; } diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c index 7de173daf27b6..7e32fbddbfadf 100644 --- a/tools/testing/selftests/bpf/progs/lsm.c +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -84,6 +84,85 @@ char _license[] SEC("license") = "GPL"; int monitored_pid = 0; int mprotect_count = 0; int bprm_count = 0; +__u32 inode_identity_idmap_seen = 0; +__u32 inode_idmapped_mount_seen = 0; + +enum { + INODE_IDMAP_CREATE = 1U << 0, + INODE_IDMAP_LINK = 1U << 1, + INODE_IDMAP_SYMLINK = 1U << 2, + INODE_IDMAP_MKDIR = 1U << 3, + INODE_IDMAP_MKNOD = 1U << 4, + INODE_IDMAP_PERMISSION = 1U << 5, +}; + +static __always_inline bool is_monitored_idmap(struct mnt_idmap idmap) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + + return monitored_pid == pid && idmap; +} + +static __always_inline bool is_identity_idmap(struct mnt_idmap idmap) +{ + return idmap->uid_map.nr_extents == 0 && + idmap->gid_map.nr_extents == 0; +} + +static __always_inline int record_inode_idmap(struct mnt_idmap idmap, + __u32 hook, int ret) +{ + if (ret \|\| !is_monitored_idmap(idmap)) + return ret; + if (is_identity_idmap(idmap)) + inode_identity_idmap_seen \|= hook; + else + inode_idmapped_mount_seen \|= hook; + return 0; +} + +SEC("lsm/inode_create") +int BPF_PROG(test_inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret); +} + +SEC("lsm/inode_link") +int BPF_PROG(test_inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, + struct dentry new_dentry, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_LINK, ret); +} + +SEC("lsm/inode_symlink") +int BPF_PROG(test_inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret); +} + +SEC("lsm/inode_mkdir") +int BPF_PROG(test_inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret); +} + +SEC("lsm/inode_mknod") +int BPF_PROG(test_inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret); +} + +SEC("lsm/inode_permission") +int BPF_PROG(test_inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret); +} SEC("lsm/file_mprotect") int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
21/3	2026/09/06 00:31	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 13566 output: 39 thoughts: 445 Thoughts: KMSAN Fuzzing Session Assessment Okay, let's break down this patch and figure out if it necessitates a dedicated KMSAN fuzzing session. The primary goal here is to determine whether `NeedsKMSAN=true` is the right call or if we can get away with `NeedsKMSAN=false`. First, I see changes primarily focused on integrating an `idmap` into various inode security-related functions across the filesystem and security subsystems. Specifically, `fs/cachefiles/security.c` and `fs/namei.c` are modified to use `&nop_mnt_idmap` or `idmap`. The include files `include/linux/lsm_hook_defs.h` and `include/linux/security.h` have the function prototypes updated to include `struct mnt_idmap idmap` parameter in `inode_` functions and `security_inode_`. The security implementations also gets updated. The patch also touches on LSM implementations: SELinux and SMACK. It updates their respective hook signatures, such as `selinux_inode_` and `smack_inode_*`, to accept the `idmap` parameter. Finally, there's the addition of test cases for BPF LSM hooks involving the `idmap` in the self-tests. Now, the crucial question: does this involve security-sensitive data flows that are prone to KMSAN-detectable issues? I need to know if we are passing new potentially tainted data to kernel security functions. The addition of the `idmap` argument is the key. Is this just a refactoring, or does this potentially introduce a new attack surface or data flow? I need to determine if new data is being passed through these hooks that could be uninitialized or otherwise problematic. To be sure, I need to check the scope of these changes. I'll need to run `grepper` or a similar tool to ensure that we are not missing any other LSM implementations or files that also implement these hooks. AppArmor, Landlock, TOMOYO, and other LSMs are the obvious suspects. I want to make sure the changes are applied consistently across the board. If other LSMs are affected or if these hooks are used elsewhere, then the risk profile changes. This will help determine whether a deeper KMSAN dive is warranted.
22/3	2026/09/06 00:31	tool	grepper	0m Args: { "Expression": "inode_(create\|link\|symlink\|mkdir\|mknod\|permission)", "PathPrefix": "security/" } Results: { "Output": "security/security.c=1225=static void inode_free_by_rcu(struct rcu_head head)\n--\nsecurity/security.c-1241- security_inode_free(), @inode may still be referenced in a VFS path walk\nsecurity/security.c:1242: * and calls to security_inode_permission() may be made during, or after,\nsecurity/security.c-1243- * a call to security_inode_free(). For this reason the inode-\u003ei_security\nsecurity/security.c-1244- * field is released via a call_rcu() callback and any LSMs which need to\nsecurity/security.c:1245: * retain inode state for use in security_inode_permission() should only\nsecurity/security.c-1246- * release that state in the inode_free_security_rcu() LSM hook callback.\n--\nsecurity/security.c=1609=int security_path_chroot(const struct path path)\n--\nsecurity/security.c-1615-/\nsecurity/security.c:1616: security_inode_create() - Check if creating a file is allowed\nsecurity/security.c-1617- * @idmap: idmap of the mount\n--\nsecurity/security.c-1625- /\nsecurity/security.c:1626:int security_inode_create(struct mnt_idmap idmap, struct inode dir,\nsecurity/security.c-1627-\t\t\t struct dentry dentry, umode_t mode)\n--\nsecurity/security.c-1630-\t\treturn 0;\nsecurity/security.c:1631:\treturn call_int_hook(inode_create, idmap, dir, dentry, mode);\nsecurity/security.c-1632-}\nsecurity/security.c:1633:EXPORT_SYMBOL_GPL(security_inode_create);\nsecurity/security.c-1634-\n--\nsecurity/security.c=1642=void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n--\nsecurity/security.c-1650-/\nsecurity/security.c:1651: security_inode_link() - Check if creating a hard link is allowed\nsecurity/security.c-1652- * @idmap: idmap of the mount\n--\nsecurity/security.c-1660- /\nsecurity/security.c:1661:int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\nsecurity/security.c-1662-\t\t\tstruct inode dir, struct dentry new_dentry)\n--\nsecurity/security.c-1665-\t\treturn 0;\nsecurity/security.c:1666:\treturn call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry);\nsecurity/security.c-1667-}\n--\nsecurity/security.c=1678=int security_inode_unlink(struct inode dir, struct dentry dentry)\n--\nsecurity/security.c-1685-/\nsecurity/security.c:1686: security_inode_symlink() - Check if creating a symbolic link is allowed\nsecurity/security.c-1687- * @idmap: idmap of the mount\n--\nsecurity/security.c-1695- /\nsecurity/security.c:1696:int security_inode_symlink(struct mnt_idmap idmap, struct inode dir,\nsecurity/security.c-1697-\t\t\t struct dentry dentry, const char old_name)\n--\nsecurity/security.c-1700-\t\treturn 0;\nsecurity/security.c:1701:\treturn call_int_hook(inode_symlink, idmap, dir, dentry, old_name);\nsecurity/security.c-1702-}\n--\nsecurity/security.c-1704-/\nsecurity/security.c:1705: security_inode_mkdir() - Check if creating a new directory is allowed\nsecurity/security.c-1706- * @idmap: idmap of the mount\n--\nsecurity/security.c-1715- /\nsecurity/security.c:1716:int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\nsecurity/security.c-1717-\t\t\t struct dentry dentry, umode_t mode)\n--\nsecurity/security.c-1720-\t\treturn 0;\nsecurity/security.c:1721:\treturn call_int_hook(inode_mkdir, idmap, dir, dentry, mode);\nsecurity/security.c-1722-}\nsecurity/security.c:1723:EXPORT_SYMBOL_GPL(security_inode_mkdir);\nsecurity/security.c-1724-\n--\nsecurity/security.c=1734=int security_inode_rmdir(struct inode dir, struct dentry dentry)\n--\nsecurity/security.c-1741-/*\nsecurity/security.c:1742: security_inode_mknod() - Check if creating a special file is allowed\nsecurity/security.c-1743- * @idmap: idmap of the mount\n--\nsecurity/security.c-1755- /\nsecurity/security.c:1756:int security_inode_mknod(struct mnt_idmap idmap, struct inode dir,\nsecurity/security.c-1757-\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n--\nsecurity/security.c-1760-\t\treturn 0;\nsecurity/security.c:1761:\treturn call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev);\nsecurity/security.c-1762-}\n--\nsecurity/security.c=1822=int security_inode_follow_link(struct dentry dentry, struct inode inode,\n--\nsecurity/security.c-1830-/*\nsecurity/security.c:1831: security_inode_permission() - Check if accessing an inode is allowed\nsecurity/security.c-1832- * @idmap: idmap of the mount\n--\nsecurity/security.c-1844- /\nsecurity/security.c:1845:int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\nsecurity/security.c-1846-\t\t\t int mask)\n--\nsecurity/security.c-1849-\t\treturn 0;\nsecurity/security.c:1850:\treturn call_int_hook(inode_permission, idmap, inode, mask);\nsecurity/security.c-1851-}\n--\nsecurity/security.c=2727=int security_file_receive(struct file file)\n--\nsecurity/security.c-2736- * Save open-time permission checking state for later use upon file_permission,\nsecurity/security.c:2737: * and recheck access if anything has changed since inode_permission.\nsecurity/security.c-2738- \n--\nsecurity/selinux/hooks.c=3011=static int selinux_inode_init_security_anon(struct inode inode,\n--\nsecurity/selinux/hooks.c-3076-\nsecurity/selinux/hooks.c:3077:static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir,\nsecurity/selinux/hooks.c-3078-\t\t\t\tstruct dentry dentry, umode_t mode)\n--\nsecurity/selinux/hooks.c-3082-\nsecurity/selinux/hooks.c:3083:static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\nsecurity/selinux/hooks.c-3084-\t\t\t struct inode dir, struct dentry new_dentry)\n--\nsecurity/selinux/hooks.c=3089=static int selinux_inode_unlink(struct inode dir, struct dentry dentry)\n--\nsecurity/selinux/hooks.c-3093-\nsecurity/selinux/hooks.c:3094:static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir,\nsecurity/selinux/hooks.c-3095-\t\t\t\t struct dentry dentry, const char name)\n--\nsecurity/selinux/hooks.c-3099-\nsecurity/selinux/hooks.c:3100:static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\nsecurity/selinux/hooks.c-3101-\t\t\t struct dentry dentry, umode_t mask)\n--\nsecurity/selinux/hooks.c=3106=static int selinux_inode_rmdir(struct inode dir, struct dentry dentry)\n--\nsecurity/selinux/hooks.c-3110-\nsecurity/selinux/hooks.c:3111:static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir,\nsecurity/selinux/hooks.c-3112-\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n--\nsecurity/selinux/hooks.c=3130=static int selinux_inode_follow_link(struct dentry dentry, struct inode inode,\n--\nsecurity/selinux/hooks.c-3145-\nsecurity/selinux/hooks.c:3146:static noinline int audit_inode_permission(struct inode inode,\nsecurity/selinux/hooks.c-3147-\t\t\t\t\t u32 perms, u32 audited, u32 denied,\n--\nsecurity/selinux/hooks.c=3223=static inline void task_avdcache_update(struct task_security_struct tsec,\n--\nsecurity/selinux/hooks.c-3242-/\nsecurity/selinux/hooks.c:3243: selinux_inode_permission - Check if the current task can access an inode\nsecurity/selinux/hooks.c-3244- * @idmap: idmap of the mount\n--\nsecurity/selinux/hooks.c-3250- /\nsecurity/selinux/hooks.c:3251:static int selinux_inode_permission(struct mnt_idmap idmap,\nsecurity/selinux/hooks.c-3252-\t\t\t\t struct inode inode, int requested)\n--\nsecurity/selinux/hooks.c-3299-\nsecurity/selinux/hooks.c:3300:\trc2 = audit_inode_permission(inode, perms, audited, denied, rc);\nsecurity/selinux/hooks.c-3301-\tif (rc2)\n--\nsecurity/selinux/hooks.c=4263=static int selinux_file_open(struct file file)\n--\nsecurity/selinux/hooks.c-4280-\t * Since the inode label or policy seqno may have changed\nsecurity/selinux/hooks.c:4281:\t * between the selinux_inode_permission check and the saving\nsecurity/selinux/hooks.c-4282-\t * of state above, recheck that access is still permitted.\n--\nsecurity/selinux/hooks.c=7567=static struct security_hook_list selinux_hooks[] __ro_after_init = {\n--\nsecurity/selinux/hooks.c-7607-\tLSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),\nsecurity/selinux/hooks.c:7608:\tLSM_HOOK_INIT(inode_create, selinux_inode_create),\nsecurity/selinux/hooks.c:7609:\tLSM_HOOK_INIT(inode_link, selinux_inode_link),\nsecurity/selinux/hooks.c-7610-\tLSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),\nsecurity/selinux/hooks.c:7611:\tLSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),\nsecurity/selinux/hooks.c:7612:\tLSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),\nsecurity/selinux/hooks.c-7613-\tLSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),\nsecurity/selinux/hooks.c:7614:\tLSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),\nsecurity/selinux/hooks.c-7615-\tLSM_HOOK_INIT(inode_rename, selinux_inode_rename),\n--\nsecurity/selinux/hooks.c-7617-\tLSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),\nsecurity/selinux/hooks.c:7618:\tLSM_HOOK_INIT(inode_permission, selinux_inode_permission),\nsecurity/selinux/hooks.c-7619-\tLSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),\n--\nsecurity/smack/smack_lsm.c=1020=static int smack_inode_init_security(struct inode inode, struct inode dir,\n--\nsecurity/smack/smack_lsm.c-1033-\t * UNIX domain sockets use lower level socket data. Let\nsecurity/smack/smack_lsm.c:1034:\t * UDS inode have fixed * label to keep smack_inode_permission() calm\nsecurity/smack/smack_lsm.c-1035-\t * when called from unix_find_bsd()\n--\nsecurity/smack/smack_lsm.c-1090-/*\nsecurity/smack/smack_lsm.c:1091: smack_inode_link - Smack check on link\nsecurity/smack/smack_lsm.c-1092- * @idmap: idmap of the mount\n--\nsecurity/smack/smack_lsm.c-1098- /\nsecurity/smack/smack_lsm.c:1099:static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\nsecurity/smack/smack_lsm.c-1100-\t\t\t struct inode dir, struct dentry new_dentry)\n--\nsecurity/smack/smack_lsm.c=1203=static int smack_inode_rename(struct inode old_inode,\n--\nsecurity/smack/smack_lsm.c-1228-/*\nsecurity/smack/smack_lsm.c:1229: smack_inode_permission - Smack version of permission()\nsecurity/smack/smack_lsm.c-1230- * @idmap: idmap of the mount\n--\nsecurity/smack/smack_lsm.c-1237- /\nsecurity/smack/smack_lsm.c:1238:static int smack_inode_permission(struct mnt_idmap idmap, struct inode *inode,\nsecurity/smack/smack_lsm.c-1239-\t\t\t\t int mask)\n--\nsecurity/smack/smack_lsm.c=5158=static struct security_hook_list smack_hooks[] __ro_after_init = {\n--\nsecurity/smack/smack_lsm.c-5176-\tLSM_HOOK_INIT(inode_init_security, smack_inode_init_security),\nsecurity/smack/smack_lsm.c:5177:\tLSM_HOOK_INIT(inode_link, smack_inode_link),\nsecurity/smack/smack_lsm.c-5178-\tLSM_HOOK_INIT(inode_unlink, smack_inode_unlink),\n--\nsecurity/smack/smack_lsm.c-5180-\tLSM_HOOK_INIT(inode_rename, smack_inode_rename),\nsecurity/smack/smack_lsm.c:5181:\tLSM_HOOK_INIT(inode_permission, smack_inode_permission),\nsecurity/smack/smack_lsm.c-5182-\tLSM_HOOK_INIT(inode_setattr, smack_inode_setattr),\n" }
23/3	2026/09/06 00:31	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 18757 output: 180 thoughts: 447 Thoughts: Analyzing the Memory Safety of This LSM Hook Patch Okay, let's break this down. This patch is adding a `struct mnt_idmap idmap` parameter to several LSM hooks, specifically `inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`. It's touching a decent spread of files across the filesystem, security, and BPF layers, so we need to be thorough. I need to make sure this doesn't introduce any new uninitialized memory issues. The core idea is that this `idmap` pointer is being passed through* the LSM hook definitions. The VFS functions like `vfs_create` and `vfs_mkdir` or `&nop_mnt_idmap` are setting up `idmap`. The LSM hooks themselves, like SELinux and Smack, are then receiving this parameter, although, based on the description, SELinux and Smack aren't currently using it. The BPF tests are also using this `idmap` within the programs themselves, so that warrants close scrutiny. Now, the important part: is there any risk here? I've got to check. Based on my analysis: * No new memory allocations are introduced, which is good. * There's no copying of uninitialized kernel memory to userspace, which is a critical point. * I see no evidence of uninitialized reads or branches that would depend on potentially uninitialized values. I've got to go through my mental checklist: 1. Kernel structures to userspace? Nope. 2. Conditional logic on uninitialized variables? Nope. 3. Complex data structures with potentially uninitialized fields? Nope. 4. Bounds checks exposing uninitialized bytes? Nope. Given that nothing is introduced that could possibly expose uninitialized memory, KASAN and standard fuzzing should be enough to find any bugs. This doesn't require a dedicated KMSAN fuzzing session. It's time to call `set-results`. I will set `NeedsKMSAN: false` and give a detailed explanation of my analysis. That should be sufficient.
24/3	2026/09/06 00:31	tool	set-results	0m Args: { "KMSANReasoning": "The patch modifies several LSM inode hook prototypes (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their invocations in the VFS layer (fs/namei.c, fs/cachefiles/security.c) and security modules to propagate the 'struct mnt_idmap idmap' argument, along with adding BPF LSM test cases for these hooks.\n\nNo new memory allocations, uninitialized variable reads, or copies to user space are introduced or altered. The changes are strictly signature and calling convention updates passing an existing idmap pointer through to the LSM hook infrastructure. Thus, there are no uninitialized memory risks that would require dedicated KMSAN fuzzing.", "NeedsKMSAN": false } Results:* { "KMSANReasoning": "The patch modifies several LSM inode hook prototypes (inode_create, inode_link, inode_symlink, inode_mkdir, inode_mknod, inode_permission) and their invocations in the VFS layer (fs/namei.c, fs/cachefiles/security.c) and security modules to propagate the 'struct mnt_idmap *idmap' argument, along with adding BPF LSM test cases for these hooks.\n\nNo new memory allocations, uninitialized variable reads, or copies to user space are introduced or altered. The changes are strictly signature and calling convention updates passing an existing idmap pointer through to the LSM hook infrastructure. Thus, there are no uninitialized memory risks that would require dedicated KMSAN fuzzing.", "NeedsKMSAN": false }

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)