AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/02 02:08	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "SECURITY", "BPF_LSM", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "security_inode_permission" ], "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.", "NeedsKMSAN": false, "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.", "WorthFuzzing": true }
1/1	2026/09/02 02:08	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit e9c28218b2d5e57d772a682e02a587bfa3470b48\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Sep 2 02:08:49 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c\nindex fc6611886b3b5..eefe5453b904e 100644\n--- a/fs/cachefiles/security.c\n+++ b/fs/cachefiles/security.c\n@@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache cache,\n {\n \tint ret;\n \n-\tret = security_inode_mkdir(d_backing_inode(root), root, 0);\n+\tret = security_inode_mkdir(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\n \tif (ret \u003c 0) {\n \t\tpr_err(\"Security denies permission to make dirs: error %d\",\n \t\t ret);\n \t\treturn ret;\n \t}\n \n-\tret = security_inode_create(d_backing_inode(root), root, 0);\n+\tret = security_inode_create(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\n \tif (ret \u003c 0)\n \t\tpr_err(\"Security denies permission to create files: error %d\",\n \t\t ret);\ndiff --git a/fs/namei.c b/fs/namei.c\nindex 20a6534ea3eff..99f894f3f7e13 100644\n--- a/fs/namei.c\n+++ b/fs/namei.c\n@@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap idmap,\n \tif (unlikely(retval))\n \t\treturn retval;\n \n-\treturn security_inode_permission(inode, mask);\n+\treturn security_inode_permission(idmap, inode, mask);\n }\n EXPORT_SYMBOL(inode_permission);\n \n@@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap id\n \tif (unlikely(((inode-\u003ei_mode \u0026 0111) != 0111) \|\| !no_acl_inode(inode)))\n \t\treturn inode_permission(idmap, inode, mask);\n \n-\treturn security_inode_permission(inode, mask);\n+\treturn security_inode_permission(idmap, inode, mask);\n }\n \n /\n@@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode,\n \t\treturn -EACCES;\t/ shouldn't it be ENOSYS? /\n \n \tmode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);\n-\terror = security_inode_create(dir, dentry, mode);\n+\terror = security_inode_create(idmap, dir, dentry, mode);\n \tif (error)\n \t\treturn error;\n \terror = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di);\n@@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry dentry, umode_t mode,\n \n \tmode \u0026= S_IALLUGO;\n \tmode \|= S_IFREG;\n-\terror = security_inode_create(dir, dentry, mode);\n+\terror = security_inode_create(\u0026nop_mnt_idmap, dir, dentry, mode);\n \tif (error)\n \t\treturn error;\n \terror = f(dentry, mode, arg);\n@@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap idmap,\n \tif (error)\n \t\treturn error;\n \n-\treturn security_inode_create(dir-\u003edentry-\u003ed_inode, dentry, mode);\n+\treturn security_inode_create(idmap, dir-\u003edentry-\u003ed_inode, dentry, mode);\n }\n \n /\n@@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap idmap, struct inode dir,\n \tif (error)\n \t\treturn error;\n \n-\terror = security_inode_mknod(dir, dentry, mode, dev);\n+\terror = security_inode_mknod(idmap, dir, dentry, mode, dev);\n \tif (error)\n \t\treturn error;\n \n@@ -5395,7 +5395,7 @@ struct dentry vfs_mkdir(struct mnt_idmap idmap, struct inode dir,\n \t\tgoto err;\n \n \tmode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO \| S_ISVTX, S_IFDIR);\n-\terror = security_inode_mkdir(dir, dentry, mode);\n+\terror = security_inode_mkdir(idmap, dir, dentry, mode);\n \tif (error)\n \t\tgoto err;\n \n@@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap idmap, struct inode dir,\n \tif (!dir-\u003ei_op-\u003esymlink)\n \t\treturn -EPERM;\n \n-\terror = security_inode_symlink(dir, dentry, oldname);\n+\terror = security_inode_symlink(idmap, dir, dentry, oldname);\n \tif (error)\n \t\treturn error;\n \n@@ -5907,7 +5907,7 @@ int vfs_link(struct dentry old_dentry, struct mnt_idmap idmap,\n \tif (S_ISDIR(inode-\u003ei_mode))\n \t\treturn -EPERM;\n \n-\terror = security_inode_link(old_dentry, dir, new_dentry);\n+\terror = security_inode_link(idmap, old_dentry, dir, new_dentry);\n \tif (error)\n \t\treturn error;\n \ndiff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h\nindex 65c9609ec2077..9e49a5bc9ff3c 100644\n--- a/include/linux/lsm_hook_defs.h\n+++ b/include/linux/lsm_hook_defs.h\n@@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode inode,\n \t int xattr_count)\n LSM_HOOK(int, 0, inode_init_security_anon, struct inode inode,\n \t const struct qstr name, const struct inode context_inode)\n-LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry,\n-\t umode_t mode)\n+LSM_HOOK(int, 0, inode_create, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode)\n LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap idmap,\n \t struct inode inode)\n-LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir,\n-\t struct dentry new_dentry)\n+LSM_HOOK(int, 0, inode_link, struct mnt_idmap idmap,\n+\t struct dentry old_dentry, struct inode dir, struct dentry new_dentry)\n LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry)\n-LSM_HOOK(int, 0, inode_symlink, struct inode dir, struct dentry dentry,\n-\t const char old_name)\n-LSM_HOOK(int, 0, inode_mkdir, struct inode dir, struct dentry dentry,\n-\t umode_t mode)\n+LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, const char old_name)\n+LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode)\n LSM_HOOK(int, 0, inode_rmdir, struct inode dir, struct dentry dentry)\n-LSM_HOOK(int, 0, inode_mknod, struct inode dir, struct dentry dentry,\n-\t umode_t mode, dev_t dev)\n+LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, dev_t dev)\n LSM_HOOK(int, 0, inode_rename, struct inode old_dir, struct dentry old_dentry,\n \t struct inode new_dir, struct dentry new_dentry)\n LSM_HOOK(int, 0, inode_readlink, struct dentry dentry)\n LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode,\n \t bool rcu)\n-LSM_HOOK(int, 0, inode_permission, struct inode inode, int mask)\n+LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap,\n+\t struct inode inode, int mask)\n LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry,\n \t struct iattr attr)\n LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap idmap,\ndiff --git a/include/linux/security.h b/include/linux/security.h\nindex 153e9043058f8..0f5f20ac10507 100644\n--- a/include/linux/security.h\n+++ b/include/linux/security.h\n@@ -404,24 +404,28 @@ int security_inode_init_security(struct inode inode, struct inode dir,\n int security_inode_init_security_anon(struct inode inode,\n \t\t\t\t const struct qstr name,\n \t\t\t\t const struct inode context_inode);\n-int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode);\n+int security_inode_create(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode);\n void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n \t\t\t\t\tstruct inode inode);\n-int security_inode_link(struct dentry old_dentry, struct inode dir,\n-\t\t\t struct dentry new_dentry);\n+int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\tstruct inode dir, struct dentry new_dentry);\n int security_inode_unlink(struct inode dir, struct dentry dentry);\n-int security_inode_symlink(struct inode dir, struct dentry dentry,\n-\t\t\t const char old_name);\n-int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode);\n+int security_inode_symlink(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, const char old_name);\n+int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode);\n int security_inode_rmdir(struct inode dir, struct dentry dentry);\n-int security_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev);\n+int security_inode_mknod(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode, dev_t dev);\n int security_inode_rename(struct inode old_dir, struct dentry old_dentry,\n \t\t\t struct inode new_dir, struct dentry new_dentry,\n \t\t\t unsigned int flags);\n int security_inode_readlink(struct dentry dentry);\n int security_inode_follow_link(struct dentry dentry, struct inode inode,\n \t\t\t bool rcu);\n-int security_inode_permission(struct inode inode, int mask);\n+int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\n+\t\t\t int mask);\n int security_inode_setattr(struct mnt_idmap idmap,\n \t\t\t struct dentry dentry, struct iattr attr);\n void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry,\n@@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode inode,\n \treturn 0;\n }\n \n-static inline int security_inode_create(struct inode dir,\n-\t\t\t\t\t struct dentry dentry,\n-\t\t\t\t\t umode_t mode)\n+static inline int security_inode_create(struct mnt_idmap idmap,\n+\t\t\t\t\tstruct inode dir,\n+\t\t\t\t\tstruct dentry dentry,\n+\t\t\t\t\tumode_t mode)\n {\n \treturn 0;\n }\n@@ -913,9 +918,10 @@ static inline void\n security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode)\n { }\n \n-static inline int security_inode_link(struct dentry old_dentry,\n-\t\t\t\t struct inode dir,\n-\t\t\t\t struct dentry new_dentry)\n+static inline int security_inode_link(struct mnt_idmap idmap,\n+\t\t\t\t struct dentry old_dentry,\n+\t\t\t\t struct inode dir,\n+\t\t\t\t struct dentry new_dentry)\n {\n \treturn 0;\n }\n@@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode dir,\n \treturn 0;\n }\n \n-static inline int security_inode_symlink(struct inode dir,\n-\t\t\t\t\t struct dentry dentry,\n-\t\t\t\t\t const char old_name)\n+static inline int security_inode_symlink(struct mnt_idmap idmap,\n+\t\t\t\t\t struct inode dir,\n+\t\t\t\t\t struct dentry dentry,\n+\t\t\t\t\t const char old_name)\n {\n \treturn 0;\n }\n \n-static inline int security_inode_mkdir(struct inode dir,\n-\t\t\t\t\tstruct dentry dentry,\n-\t\t\t\t\tint mode)\n+static inline int security_inode_mkdir(struct mnt_idmap idmap,\n+\t\t\t\t struct inode dir,\n+\t\t\t\t struct dentry dentry,\n+\t\t\t\t int mode)\n {\n \treturn 0;\n }\n@@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode dir,\n \treturn 0;\n }\n \n-static inline int security_inode_mknod(struct inode dir,\n-\t\t\t\t\tstruct dentry dentry,\n-\t\t\t\t\tint mode, dev_t dev)\n+static inline int security_inode_mknod(struct mnt_idmap idmap,\n+\t\t\t\t struct inode dir,\n+\t\t\t\t struct dentry dentry,\n+\t\t\t\t int mode, dev_t dev)\n {\n \treturn 0;\n }\n@@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry dentry,\n \treturn 0;\n }\n \n-static inline int security_inode_permission(struct inode inode, int mask)\n+static inline int security_inode_permission(struct mnt_idmap idmap,\n+\t\t\t\t\t struct inode inode, int mask)\n {\n \treturn 0;\n }\ndiff --git a/security/security.c b/security/security.c\nindex 2ee276ab15c5b..a9190da3341dd 100644\n--- a/security/security.c\n+++ b/security/security.c\n@@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path path)\n \n /*\n security_inode_create() - Check if creating a file is allowed\n+ * @idmap: idmap of the mount\n * @dir: the parent directory\n * @dentry: the file being created\n * @mode: requested file mode\n@@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path path)\n \n * Return: Returns 0 if permission is granted.\n /\n-int security_inode_create(struct inode dir, struct dentry dentry,\n-\t\t\t umode_t mode)\n+int security_inode_create(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_create, dir, dentry, mode);\n+\treturn call_int_hook(inode_create, idmap, dir, dentry, mode);\n }\n EXPORT_SYMBOL_GPL(security_inode_create);\n \n@@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n \n /\n security_inode_link() - Check if creating a hard link is allowed\n+ * @idmap: idmap of the mount\n * @old_dentry: existing file\n * @dir: new parent directory\n * @new_dentry: new link\n@@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap,\n \n * Return: Returns 0 if permission is granted.\n /\n-int security_inode_link(struct dentry old_dentry, struct inode dir,\n-\t\t\tstruct dentry new_dentry)\n+int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\tstruct inode dir, struct dentry new_dentry)\n {\n \tif (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))\n \t\treturn 0;\n-\treturn call_int_hook(inode_link, old_dentry, dir, new_dentry);\n+\treturn call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry);\n }\n \n /*\n@@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry)\n \n /\n security_inode_symlink() - Check if creating a symbolic link is allowed\n+ * @idmap: idmap of the mount\n * @dir: parent directory\n * @dentry: symbolic link\n * @old_name: existing filename\n@@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode dir, struct dentry dentry)\n \n Return: Returns 0 if permission is granted.\n /\n-int security_inode_symlink(struct inode dir, struct dentry dentry,\n-\t\t\t const char old_name)\n+int security_inode_symlink(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, const char old_name)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_symlink, dir, dentry, old_name);\n+\treturn call_int_hook(inode_symlink, idmap, dir, dentry, old_name);\n }\n \n /*\n security_inode_mkdir() - Check if creating a new directory is allowed\n+ * @idmap: idmap of the mount\n * @dir: parent directory\n * @dentry: new directory\n * @mode: new directory mode\n@@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode dir, struct dentry dentry,\n \n Return: Returns 0 if permission is granted.\n /\n-int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode)\n+int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_mkdir, dir, dentry, mode);\n+\treturn call_int_hook(inode_mkdir, idmap, dir, dentry, mode);\n }\n EXPORT_SYMBOL_GPL(security_inode_mkdir);\n \n@@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry)\n \n /*\n security_inode_mknod() - Check if creating a special file is allowed\n+ * @idmap: idmap of the mount\n * @dir: parent directory\n * @dentry: new file\n * @mode: new file mode\n@@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry)\n \n Return: Returns 0 if permission is granted.\n /\n-int security_inode_mknod(struct inode dir, struct dentry dentry,\n-\t\t\t umode_t mode, dev_t dev)\n+int security_inode_mknod(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_mknod, dir, dentry, mode, dev);\n+\treturn call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev);\n }\n \n /*\n@@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode,\n \n /\n security_inode_permission() - Check if accessing an inode is allowed\n+ * @idmap: idmap of the mount\n * @inode: inode\n * @mask: access mask\n \n@@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode,\n \n * Return: Returns 0 if permission is granted.\n /\n-int security_inode_permission(struct inode inode, int mask)\n+int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\n+\t\t\t int mask)\n {\n \tif (unlikely(IS_PRIVATE(inode)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_permission, inode, mask);\n+\treturn call_int_hook(inode_permission, idmap, inode, mask);\n }\n \n /*\ndiff --git a/security/selinux/hooks.c b/security/selinux/hooks.c\nindex 035aaf113d1da..967984d0af300 100644\n--- a/security/selinux/hooks.c\n+++ b/security/selinux/hooks.c\n@@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode inode,\n \t\t\t \u0026ad);\n }\n \n-static int selinux_inode_create(struct inode dir, struct dentry dentry, umode_t mode)\n+static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t\tstruct dentry dentry, umode_t mode)\n {\n \treturn may_create(dir, dentry, SECCLASS_FILE);\n }\n \n-static int selinux_inode_link(struct dentry old_dentry, struct inode dir, struct dentry new_dentry)\n+static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\t struct inode dir, struct dentry new_dentry)\n {\n \treturn may_link(dir, old_dentry, MAY_LINK);\n }\n@@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode dir, struct dentry dentry)\n \treturn may_link(dir, dentry, MAY_UNLINK);\n }\n \n-static int selinux_inode_symlink(struct inode dir, struct dentry dentry, const char name)\n+static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t\t struct dentry dentry, const char name)\n {\n \treturn may_create(dir, dentry, SECCLASS_LNK_FILE);\n }\n \n-static int selinux_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mask)\n+static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mask)\n {\n \treturn may_create(dir, dentry, SECCLASS_DIR);\n }\n@@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode dir, struct dentry dentry)\n \treturn may_link(dir, dentry, MAY_RMDIR);\n }\n \n-static int selinux_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev)\n+static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir,\n+\t\t\t struct dentry dentry, umode_t mode, dev_t dev)\n {\n \treturn may_create(dir, dentry, inode_mode_to_security_class(mode));\n }\n@@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct tsec,\n \n /*\n selinux_inode_permission - Check if the current task can access an inode\n+ * @idmap: idmap of the mount\n * @inode: the inode that is being accessed\n * @requested: the accesses being requested\n \n Check if the current task is allowed to access @inode according to\n * @requested. Returns 0 if allowed, negative values otherwise.\n /\n-static int selinux_inode_permission(struct inode inode, int requested)\n+static int selinux_inode_permission(struct mnt_idmap idmap,\n+\t\t\t\t struct inode inode, int requested)\n {\n \tint mask;\n \tu32 perms;\ndiff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c\nindex 8e88ac65fd7fc..a45819d13c0d6 100644\n--- a/security/smack/smack_lsm.c\n+++ b/security/smack/smack_lsm.c\n@@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode inode, struct inode dir,\n \n /*\n smack_inode_link - Smack check on link\n+ * @idmap: idmap of the mount\n * @old_dentry: the existing object\n * @dir: unused\n * @new_dentry: the new object\n \n Returns 0 if access is permitted, an error code otherwise\n /\n-static int smack_inode_link(struct dentry old_dentry, struct inode dir,\n-\t\t\t struct dentry new_dentry)\n+static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry,\n+\t\t\t struct inode dir, struct dentry new_dentry)\n {\n \tstruct smack_known isp;\n \tstruct smk_audit_info ad;\n@@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode old_inode,\n \n /*\n smack_inode_permission - Smack version of permission()\n+ * @idmap: idmap of the mount\n * @inode: the inode in question\n * @mask: the access requested\n \n@@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode old_inode,\n \n Returns 0 if access is permitted, an error code otherwise\n /\n-static int smack_inode_permission(struct inode inode, int mask)\n+static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode,\n+\t\t\t\t int mask)\n {\n \tstruct superblock_smack sbsp = smack_superblock(inode-\u003ei_sb);\n \tstruct smk_audit_info ad;\ndiff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c\nindex d7495efd4a562..c0ae813698ae2 100644\n--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c\n+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c\n@@ -1,18 +1,30 @@\n // SPDX-License-Identifier: GPL-2.0\n+#define _GNU_SOURCE\n \n /\n * Copyright (C) 2020 Google LLC.\n /\n \n #include \u003ctest_progs.h\u003e\n+#include \u003csched.h\u003e\n+#include \u003csignal.h\u003e\n+#include \u003cstring.h\u003e\n+#include \u003csys/stat.h\u003e\n+#include \u003csys/syscall.h\u003e\n #include \u003csys/wait.h\u003e\n #include \u003cunistd.h\u003e\n \n+#include \u003clinux/mount.h\u003e\n+\n #include \"lsm.skel.h\"\n #include \"lsm_tailcall.skel.h\"\n \n char CMD_ARGS[] = {\"true\", NULL};\n \n+enum {\n+\tINODE_IDMAP_ALL = (1U \u003c\u003c 6) - 1,\n+};\n+\n int exec_cmd(int monitored_pid)\n {\n \tint child_pid, child_status;\n@@ -30,6 +42,219 @@ int exec_cmd(int monitored_pid)\n \treturn -EINVAL;\n }\n \n+static ssize_t write_nointr(int fd, const void buf, size_t count)\n+{\n+\tssize_t ret;\n+\n+\tdo {\n+\t\tret = write(fd, buf, count);\n+\t} while (ret \u003c 0 \u0026\u0026 errno == EINTR);\n+\n+\treturn ret;\n+}\n+\n+static int write_file(const char path, const char value)\n+{\n+\tsize_t len = strlen(value);\n+\tint fd, saved_errno = 0;\n+\tssize_t ret;\n+\n+\tfd = open(path, O_WRONLY \| O_CLOEXEC \| O_NOCTTY \| O_NOFOLLOW);\n+\tif (fd \u003c 0)\n+\t\treturn -1;\n+\n+\tret = write_nointr(fd, value, len);\n+\tif (ret \u003c 0)\n+\t\tsaved_errno = errno;\n+\telse if ((size_t)ret != len)\n+\t\tsaved_errno = EIO;\n+\tclose(fd);\n+\tif (saved_errno) {\n+\t\terrno = saved_errno;\n+\t\treturn -1;\n+\t}\n+\treturn 0;\n+}\n+\n+static int write_userns_file(pid_t pid, const char name, const char value)\n+{\n+\tchar path[64];\n+\tint len;\n+\n+\tlen = snprintf(path, sizeof(path), \"/proc/%d/%s\", pid, name);\n+\tif (len \u003c 0 \|\| (size_t)len \u003e= sizeof(path)) {\n+\t\terrno = EOVERFLOW;\n+\t\treturn -1;\n+\t}\n+\n+\treturn write_file(path, value);\n+}\n+\n+static int create_userns_fd(void)\n+{\n+\tchar path[64];\n+\tpid_t pid, waited;\n+\tint fd = -1, len, saved_errno, status;\n+\n+\tpid = fork();\n+\tif (pid \u003c 0)\n+\t\treturn -1;\n+\tif (pid == 0) {\n+\t\tif (unshare(CLONE_NEWUSER))\n+\t\t\t_exit(1);\n+\t\traise(SIGSTOP);\n+\t\t_exit(0);\n+\t}\n+\n+\tdo {\n+\t\twaited = waitpid(pid, \u0026status, WUNTRACED);\n+\t} while (waited \u003c 0 \u0026\u0026 errno == EINTR);\n+\tif (waited != pid)\n+\t\tgoto out;\n+\tif (!WIFSTOPPED(status)) {\n+\t\tpid = -1;\n+\t\tgoto out;\n+\t}\n+\n+\t/ A one-entry map is identity for root but remains distinct from nop_mnt_idmap. /\n+\tif (write_userns_file(pid, \"setgroups\", \"deny\") \u0026\u0026 errno != ENOENT)\n+\t\tgoto out;\n+\tif (write_userns_file(pid, \"uid_map\", \"0 0 1\") \|\|\n+\t write_userns_file(pid, \"gid_map\", \"0 0 1\"))\n+\t\tgoto out;\n+\n+\tlen = snprintf(path, sizeof(path), \"/proc/%d/ns/user\", pid);\n+\tif (len \u003c 0 \|\| (size_t)len \u003e= sizeof(path)) {\n+\t\terrno = EOVERFLOW;\n+\t\tgoto out;\n+\t}\n+\tfd = open(path, O_RDONLY \| O_CLOEXEC);\n+\n+out:\n+\tsaved_errno = errno;\n+\tif (pid \u003e 0) {\n+\t\tkill(pid, SIGKILL);\n+\t\tdo {\n+\t\t\twaited = waitpid(pid, NULL, 0);\n+\t\t} while (waited \u003c 0 \u0026\u0026 errno == EINTR);\n+\t}\n+\terrno = saved_errno;\n+\treturn fd;\n+}\n+\n+static int create_idmapped_tmpfs(void)\n+{\n+\tstruct mount_attr attr = {\n+\t\t.attr_set = MOUNT_ATTR_IDMAP,\n+\t};\n+\tint fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1;\n+\n+\tuserns_fd = create_userns_fd();\n+\tif (userns_fd \u003c 0)\n+\t\tgoto out;\n+\n+\t/ A detached tmpfs avoids relying on the host test directory supporting idmaps. /\n+\tfsfd = syscall(__NR_fsopen, \"tmpfs\", FSOPEN_CLOEXEC);\n+\tif (fsfd \u003c 0)\n+\t\tgoto out;\n+\tif (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0))\n+\t\tgoto out;\n+\n+\tmntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0);\n+\tif (mntfd \u003c 0)\n+\t\tgoto out;\n+\n+\tattr.userns_fd = userns_fd;\n+\tif (syscall(__NR_mount_setattr, mntfd, \"\", AT_EMPTY_PATH, \u0026attr,\n+\t\t sizeof(attr))) {\n+\t\tclose(mntfd);\n+\t\tmntfd = -1;\n+\t}\n+\n+out:\n+\tsaved_errno = errno;\n+\tif (fsfd \u003e= 0)\n+\t\tclose(fsfd);\n+\tif (userns_fd \u003e= 0)\n+\t\tclose(userns_fd);\n+\terrno = saved_errno;\n+\treturn mntfd;\n+}\n+\n+static int exercise_inode_idmap_hooks(int dirfd)\n+{\n+\tint fd = -1, ret = -1;\n+\n+\tfd = openat(dirfd, \"file\", O_CREAT \| O_EXCL \| O_WRONLY \| O_CLOEXEC,\n+\t\t 0600);\n+\tif (!ASSERT_GE(fd, 0, \"create\"))\n+\t\tgoto out;\n+\tclose(fd);\n+\tfd = -1;\n+\n+\tif (!ASSERT_OK(mkdirat(dirfd, \"dir\", 0700), \"mkdir\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(symlinkat(\"target\", dirfd, \"symlink\"), \"symlink\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(linkat(dirfd, \"file\", dirfd, \"link\", 0), \"link\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(mkfifoat(dirfd, \"fifo\", 0600), \"mknod\"))\n+\t\tgoto out;\n+\n+\tret = 0;\n+out:\n+\tif (fd \u003e= 0)\n+\t\tclose(fd);\n+\tunlinkat(dirfd, \"link\", 0);\n+\tunlinkat(dirfd, \"fifo\", 0);\n+\tunlinkat(dirfd, \"symlink\", 0);\n+\tunlinkat(dirfd, \"file\", 0);\n+\tunlinkat(dirfd, \"dir\", AT_REMOVEDIR);\n+\treturn ret;\n+}\n+\n+static int test_lsm_inode_idmap(struct lsm skel)\n+{\n+\tchar tmpdir[] = \"/var/tmp/test_lsm_idmap.XXXXXX\";\n+\t__u32 expected = INODE_IDMAP_ALL;\n+\tint dirfd = -1, idmapped_dirfd = -1;\n+\tint ret = -1;\n+\n+\tif (!ASSERT_OK_PTR(mkdtemp(tmpdir), \"mkdtemp\"))\n+\t\treturn -1;\n+\n+\tdirfd = open(tmpdir, O_RDONLY \| O_DIRECTORY \| O_CLOEXEC);\n+\tif (!ASSERT_GE(dirfd, 0, \"open_tmpdir\"))\n+\t\tgoto out;\n+\n+\tidmapped_dirfd = create_idmapped_tmpfs();\n+\tif (!ASSERT_GE(idmapped_dirfd, 0, \"create_idmapped_tmpfs\"))\n+\t\tgoto out;\n+\n+\tskel-\u003ebss-\u003einode_identity_idmap_seen = 0;\n+\tskel-\u003ebss-\u003einode_idmapped_mount_seen = 0;\n+\n+\tif (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), \"identity_idmap\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd),\n+\t\t \"idmapped_mount\"))\n+\t\tgoto out;\n+\n+\tif (!ASSERT_EQ(skel-\u003ebss-\u003einode_identity_idmap_seen, expected,\n+\t\t \"inode_identity_idmap_seen\"))\n+\t\tgoto out;\n+\tret = ASSERT_EQ(skel-\u003ebss-\u003einode_idmapped_mount_seen, expected,\n+\t\t\t\"inode_idmapped_mount_seen\") ? 0 : -1;\n+\n+out:\n+\tif (idmapped_dirfd \u003e= 0)\n+\t\tclose(idmapped_dirfd);\n+\tif (dirfd \u003e= 0)\n+\t\tclose(dirfd);\n+\trmdir(tmpdir);\n+\treturn ret;\n+}\n+\n static int test_lsm(struct lsm skel)\n {\n \tstruct bpf_link link;\n@@ -53,6 +278,10 @@ static int test_lsm(struct lsm skel)\n \n \tskel-\u003ebss-\u003emonitored_pid = getpid();\n \n+\terr = test_lsm_inode_idmap(skel);\n+\tif (!ASSERT_OK(err, \"test_lsm_inode_idmap\"))\n+\t\treturn err;\n+\n \terr = stack_mprotect();\n \tif (!ASSERT_EQ(err, -1, \"stack_mprotect\") \|\|\n \t !ASSERT_EQ(errno, EPERM, \"stack_mprotect\"))\n@@ -71,6 +300,8 @@ static int test_lsm(struct lsm skel)\n \tskel-\u003ebss-\u003ecopy_test = 0;\n \tskel-\u003ebss-\u003ebprm_count = 0;\n \tskel-\u003ebss-\u003emprotect_count = 0;\n+\tskel-\u003ebss-\u003einode_identity_idmap_seen = 0;\n+\tskel-\u003ebss-\u003einode_idmapped_mount_seen = 0;\n \treturn 0;\n }\n \ndiff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c\nindex 7de173daf27b6..7e32fbddbfadf 100644\n--- a/tools/testing/selftests/bpf/progs/lsm.c\n+++ b/tools/testing/selftests/bpf/progs/lsm.c\n@@ -84,6 +84,85 @@ char _license[] SEC(\"license\") = \"GPL\";\n int monitored_pid = 0;\n int mprotect_count = 0;\n int bprm_count = 0;\n+__u32 inode_identity_idmap_seen = 0;\n+__u32 inode_idmapped_mount_seen = 0;\n+\n+enum {\n+\tINODE_IDMAP_CREATE\t= 1U \u003c\u003c 0,\n+\tINODE_IDMAP_LINK\t= 1U \u003c\u003c 1,\n+\tINODE_IDMAP_SYMLINK\t= 1U \u003c\u003c 2,\n+\tINODE_IDMAP_MKDIR\t= 1U \u003c\u003c 3,\n+\tINODE_IDMAP_MKNOD\t= 1U \u003c\u003c 4,\n+\tINODE_IDMAP_PERMISSION\t= 1U \u003c\u003c 5,\n+};\n+\n+static __always_inline bool is_monitored_idmap(struct mnt_idmap idmap)\n+{\n+\t__u32 pid = bpf_get_current_pid_tgid() \u003e\u003e 32;\n+\n+\treturn monitored_pid == pid \u0026\u0026 idmap;\n+}\n+\n+static __always_inline bool is_identity_idmap(struct mnt_idmap idmap)\n+{\n+\treturn idmap-\u003euid_map.nr_extents == 0 \u0026\u0026\n+\t idmap-\u003egid_map.nr_extents == 0;\n+}\n+\n+static __always_inline int record_inode_idmap(struct mnt_idmap idmap,\n+\t\t\t\t\t __u32 hook, int ret)\n+{\n+\tif (ret \|\| !is_monitored_idmap(idmap))\n+\t\treturn ret;\n+\tif (is_identity_idmap(idmap))\n+\t\tinode_identity_idmap_seen \|= hook;\n+\telse\n+\t\tinode_idmapped_mount_seen \|= hook;\n+\treturn 0;\n+}\n+\n+SEC(\"lsm/inode_create\")\n+int BPF_PROG(test_inode_create, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret);\n+}\n+\n+SEC(\"lsm/inode_link\")\n+int BPF_PROG(test_inode_link, struct mnt_idmap idmap,\n+\t struct dentry old_dentry, struct inode dir,\n+\t struct dentry new_dentry, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_LINK, ret);\n+}\n+\n+SEC(\"lsm/inode_symlink\")\n+int BPF_PROG(test_inode_symlink, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, const char old_name, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret);\n+}\n+\n+SEC(\"lsm/inode_mkdir\")\n+int BPF_PROG(test_inode_mkdir, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret);\n+}\n+\n+SEC(\"lsm/inode_mknod\")\n+int BPF_PROG(test_inode_mknod, struct mnt_idmap idmap, struct inode dir,\n+\t struct dentry dentry, umode_t mode, dev_t dev, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret);\n+}\n+\n+SEC(\"lsm/inode_permission\")\n+int BPF_PROG(test_inode_permission, struct mnt_idmap idmap,\n+\t struct inode inode, int mask, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret);\n+}\n \n SEC(\"lsm/file_mprotect\")\n int BPF_PROG(test_int_hook, struct vm_area_struct *vma,\n" }
2/1	2026/09/02 02:08	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": [ "SECURITY", "BPF_LSM", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "security_inode_permission" ], "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.", "WorthFuzzing": true } Instruction:* You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit e9c28218b2d5e57d772a682e02a587bfa3470b48 Author: syz-cluster <triage@syzkaller.com> Date: Wed Sep 2 02:08:49 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c index fc6611886b3b5..eefe5453b904e 100644 --- a/fs/cachefiles/security.c +++ b/fs/cachefiles/security.c @@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache cache, { int ret; - ret = security_inode_mkdir(d_backing_inode(root), root, 0); + ret = security_inode_mkdir(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) { pr_err("Security denies permission to make dirs: error %d", ret); return ret; } - ret = security_inode_create(d_backing_inode(root), root, 0); + ret = security_inode_create(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) pr_err("Security denies permission to create files: error %d", ret); diff --git a/fs/namei.c b/fs/namei.c index 20a6534ea3eff..99f894f3f7e13 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap idmap, if (unlikely(retval)) return retval; - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } EXPORT_SYMBOL(inode_permission); @@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap id if (unlikely(((inode->i_mode & 0111) != 0111) \|\| !no_acl_inode(inode))) return inode_permission(idmap, inode, mask); - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } /* @@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode, return -EACCES; /* shouldn't it be ENOSYS? / mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(idmap, dir, dentry, mode); if (error) return error; error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di); @@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry dentry, umode_t mode, mode &= S_IALLUGO; mode \|= S_IFREG; - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(&nop_mnt_idmap, dir, dentry, mode); if (error) return error; error = f(dentry, mode, arg); @@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap idmap, if (error) return error; - return security_inode_create(dir->dentry->d_inode, dentry, mode); + return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode); } /* @@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap idmap, struct inode dir, if (error) return error; - error = security_inode_mknod(dir, dentry, mode, dev); + error = security_inode_mknod(idmap, dir, dentry, mode, dev); if (error) return error; @@ -5395,7 +5395,7 @@ struct dentry vfs_mkdir(struct mnt_idmap idmap, struct inode dir, goto err; mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO \| S_ISVTX, S_IFDIR); - error = security_inode_mkdir(dir, dentry, mode); + error = security_inode_mkdir(idmap, dir, dentry, mode); if (error) goto err; @@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap idmap, struct inode dir, if (!dir->i_op->symlink) return -EPERM; - error = security_inode_symlink(dir, dentry, oldname); + error = security_inode_symlink(idmap, dir, dentry, oldname); if (error) return error; @@ -5907,7 +5907,7 @@ int vfs_link(struct dentry old_dentry, struct mnt_idmap idmap, if (S_ISDIR(inode->i_mode)) return -EPERM; - error = security_inode_link(old_dentry, dir, new_dentry); + error = security_inode_link(idmap, old_dentry, dir, new_dentry); if (error) return error; diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec2077..9e49a5bc9ff3c 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode inode, int xattr_count) LSM_HOOK(int, 0, inode_init_security_anon, struct inode inode, const struct qstr name, const struct inode context_inode) -LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap idmap, struct inode inode) -LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +LSM_HOOK(int, 0, inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_symlink, struct inode dir, struct dentry dentry, - const char old_name) -LSM_HOOK(int, 0, inode_mkdir, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) +LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(int, 0, inode_rmdir, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_mknod, struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) LSM_HOOK(int, 0, inode_rename, struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_readlink, struct dentry dentry) LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode, bool rcu) -LSM_HOOK(int, 0, inode_permission, struct inode inode, int mask) +LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask) LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry, struct iattr attr) LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap idmap, diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f8..0f5f20ac10507 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -404,24 +404,28 @@ int security_inode_init_security(struct inode inode, struct inode dir, int security_inode_init_security_anon(struct inode inode, const struct qstr name, const struct inode context_inode); -int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode); -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry); +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry); int security_inode_unlink(struct inode dir, struct dentry dentry); -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name); -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name); +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); int security_inode_rmdir(struct inode dir, struct dentry dentry); -int security_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev); +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev); int security_inode_rename(struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry, unsigned int flags); int security_inode_readlink(struct dentry dentry); int security_inode_follow_link(struct dentry dentry, struct inode inode, bool rcu); -int security_inode_permission(struct inode inode, int mask); +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask); int security_inode_setattr(struct mnt_idmap idmap, struct dentry dentry, struct iattr attr); void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry, @@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode inode, return 0; } -static inline int security_inode_create(struct inode dir, - struct dentry dentry, - umode_t mode) +static inline int security_inode_create(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + umode_t mode) { return 0; } @@ -913,9 +918,10 @@ static inline void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode) { } -static inline int security_inode_link(struct dentry old_dentry, - struct inode dir, - struct dentry new_dentry) +static inline int security_inode_link(struct mnt_idmap idmap, + struct dentry old_dentry, + struct inode dir, + struct dentry new_dentry) { return 0; } @@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode dir, return 0; } -static inline int security_inode_symlink(struct inode dir, - struct dentry dentry, - const char old_name) +static inline int security_inode_symlink(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + const char old_name) { return 0; } -static inline int security_inode_mkdir(struct inode dir, - struct dentry dentry, - int mode) +static inline int security_inode_mkdir(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode) { return 0; } @@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode dir, return 0; } -static inline int security_inode_mknod(struct inode dir, - struct dentry dentry, - int mode, dev_t dev) +static inline int security_inode_mknod(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode, dev_t dev) { return 0; } @@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry dentry, return 0; } -static inline int security_inode_permission(struct inode inode, int mask) +static inline int security_inode_permission(struct mnt_idmap idmap, + struct inode inode, int mask) { return 0; } diff --git a/security/security.c b/security/security.c index 2ee276ab15c5b..a9190da3341dd 100644 --- a/security/security.c +++ b/security/security.c @@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path path) /* * security_inode_create() - Check if creating a file is allowed + * @idmap: idmap of the mount * @dir: the parent directory * @dentry: the file being created * @mode: requested file mode @@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path path) * Return: Returns 0 if permission is granted. / -int security_inode_create(struct inode dir, struct dentry dentry, - umode_t mode) +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_create, dir, dentry, mode); + return call_int_hook(inode_create, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_create); @@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, /* * security_inode_link() - Check if creating a hard link is allowed + * @idmap: idmap of the mount * @old_dentry: existing file * @dir: new parent directory * @new_dentry: new link @@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, * Return: Returns 0 if permission is granted. / -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) return 0; - return call_int_hook(inode_link, old_dentry, dir, new_dentry); + return call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry); } /** @@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) /** * security_inode_symlink() - Check if creating a symbolic link is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: symbolic link * @old_name: existing filename @@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name) +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_symlink, dir, dentry, old_name); + return call_int_hook(inode_symlink, idmap, dir, dentry, old_name); } /** * security_inode_mkdir() - Check if creating a new directory is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new directory * @mode: new directory mode @@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode dir, struct dentry dentry, * * Return: Returns 0 if permission is granted. / -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode) +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mkdir, dir, dentry, mode); + return call_int_hook(inode_mkdir, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_mkdir); @@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) /** * security_inode_mknod() - Check if creating a special file is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new file * @mode: new file mode @@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_mknod(struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mknod, dir, dentry, mode, dev); + return call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev); } /** @@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, /** * security_inode_permission() - Check if accessing an inode is allowed + * @idmap: idmap of the mount * @inode: inode * @mask: access mask * @@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, * * Return: Returns 0 if permission is granted. / -int security_inode_permission(struct inode inode, int mask) +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { if (unlikely(IS_PRIVATE(inode))) return 0; - return call_int_hook(inode_permission, inode, mask); + return call_int_hook(inode_permission, idmap, inode, mask); } /** diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 035aaf113d1da..967984d0af300 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode inode, &ad); } -static int selinux_inode_create(struct inode dir, struct dentry dentry, umode_t mode) +static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { return may_create(dir, dentry, SECCLASS_FILE); } -static int selinux_inode_link(struct dentry old_dentry, struct inode dir, struct dentry new_dentry) +static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { return may_link(dir, old_dentry, MAY_LINK); } @@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_UNLINK); } -static int selinux_inode_symlink(struct inode dir, struct dentry dentry, const char name) +static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char name) { return may_create(dir, dentry, SECCLASS_LNK_FILE); } -static int selinux_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mask) +static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mask) { return may_create(dir, dentry, SECCLASS_DIR); } @@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_RMDIR); } -static int selinux_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev) +static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { return may_create(dir, dentry, inode_mode_to_security_class(mode)); } @@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct tsec, /* * selinux_inode_permission - Check if the current task can access an inode + * @idmap: idmap of the mount * @inode: the inode that is being accessed * @requested: the accesses being requested * * Check if the current task is allowed to access @inode according to * @requested. Returns 0 if allowed, negative values otherwise. / -static int selinux_inode_permission(struct inode inode, int requested) +static int selinux_inode_permission(struct mnt_idmap idmap, + struct inode inode, int requested) { int mask; u32 perms; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8e88ac65fd7fc..a45819d13c0d6 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode inode, struct inode dir, /** * smack_inode_link - Smack check on link + * @idmap: idmap of the mount * @old_dentry: the existing object * @dir: unused * @new_dentry: the new object * * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { struct smack_known isp; struct smk_audit_info ad; @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode old_inode, /** * smack_inode_permission - Smack version of permission() + * @idmap: idmap of the mount * @inode: the inode in question * @mask: the access requested * @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode old_inode, * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_permission(struct inode inode, int mask) +static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { struct superblock_smack sbsp = smack_superblock(inode->i_sb); struct smk_audit_info ad; diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c index d7495efd4a562..c0ae813698ae2 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c @@ -1,18 +1,30 @@ // SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE / * Copyright (C) 2020 Google LLC. / #include <test_progs.h> +#include <sched.h> +#include <signal.h> +#include <string.h> +#include <sys/stat.h> +#include <sys/syscall.h> #include <sys/wait.h> #include <unistd.h> +#include <linux/mount.h> + #include "lsm.skel.h" #include "lsm_tailcall.skel.h" char CMD_ARGS[] = {"true", NULL}; +enum { + INODE_IDMAP_ALL = (1U << 6) - 1, +}; + int exec_cmd(int monitored_pid) { int child_pid, child_status; @@ -30,6 +42,219 @@ int exec_cmd(int monitored_pid) return -EINVAL; } +static ssize_t write_nointr(int fd, const void buf, size_t count) +{ + ssize_t ret; + + do { + ret = write(fd, buf, count); + } while (ret < 0 && errno == EINTR); + + return ret; +} + +static int write_file(const char path, const char value) +{ + size_t len = strlen(value); + int fd, saved_errno = 0; + ssize_t ret; + + fd = open(path, O_WRONLY \| O_CLOEXEC \| O_NOCTTY \| O_NOFOLLOW); + if (fd < 0) + return -1; + + ret = write_nointr(fd, value, len); + if (ret < 0) + saved_errno = errno; + else if ((size_t)ret != len) + saved_errno = EIO; + close(fd); + if (saved_errno) { + errno = saved_errno; + return -1; + } + return 0; +} + +static int write_userns_file(pid_t pid, const char name, const char value) +{ + char path[64]; + int len; + + len = snprintf(path, sizeof(path), "/proc/%d/%s", pid, name); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + return -1; + } + + return write_file(path, value); +} + +static int create_userns_fd(void) +{ + char path[64]; + pid_t pid, waited; + int fd = -1, len, saved_errno, status; + + pid = fork(); + if (pid < 0) + return -1; + if (pid == 0) { + if (unshare(CLONE_NEWUSER)) + _exit(1); + raise(SIGSTOP); + _exit(0); + } + + do { + waited = waitpid(pid, &status, WUNTRACED); + } while (waited < 0 && errno == EINTR); + if (waited != pid) + goto out; + if (!WIFSTOPPED(status)) { + pid = -1; + goto out; + } + + / A one-entry map is identity for root but remains distinct from nop_mnt_idmap. / + if (write_userns_file(pid, "setgroups", "deny") && errno != ENOENT) + goto out; + if (write_userns_file(pid, "uid_map", "0 0 1") \|\| + write_userns_file(pid, "gid_map", "0 0 1")) + goto out; + + len = snprintf(path, sizeof(path), "/proc/%d/ns/user", pid); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + goto out; + } + fd = open(path, O_RDONLY \| O_CLOEXEC); + +out: + saved_errno = errno; + if (pid > 0) { + kill(pid, SIGKILL); + do { + waited = waitpid(pid, NULL, 0); + } while (waited < 0 && errno == EINTR); + } + errno = saved_errno; + return fd; +} + +static int create_idmapped_tmpfs(void) +{ + struct mount_attr attr = { + .attr_set = MOUNT_ATTR_IDMAP, + }; + int fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1; + + userns_fd = create_userns_fd(); + if (userns_fd < 0) + goto out; + + / A detached tmpfs avoids relying on the host test directory supporting idmaps. / + fsfd = syscall(__NR_fsopen, "tmpfs", FSOPEN_CLOEXEC); + if (fsfd < 0) + goto out; + if (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)) + goto out; + + mntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0); + if (mntfd < 0) + goto out; + + attr.userns_fd = userns_fd; + if (syscall(__NR_mount_setattr, mntfd, "", AT_EMPTY_PATH, &attr, + sizeof(attr))) { + close(mntfd); + mntfd = -1; + } + +out: + saved_errno = errno; + if (fsfd >= 0) + close(fsfd); + if (userns_fd >= 0) + close(userns_fd); + errno = saved_errno; + return mntfd; +} + +static int exercise_inode_idmap_hooks(int dirfd) +{ + int fd = -1, ret = -1; + + fd = openat(dirfd, "file", O_CREAT \| O_EXCL \| O_WRONLY \| O_CLOEXEC, + 0600); + if (!ASSERT_GE(fd, 0, "create")) + goto out; + close(fd); + fd = -1; + + if (!ASSERT_OK(mkdirat(dirfd, "dir", 0700), "mkdir")) + goto out; + if (!ASSERT_OK(symlinkat("target", dirfd, "symlink"), "symlink")) + goto out; + if (!ASSERT_OK(linkat(dirfd, "file", dirfd, "link", 0), "link")) + goto out; + if (!ASSERT_OK(mkfifoat(dirfd, "fifo", 0600), "mknod")) + goto out; + + ret = 0; +out: + if (fd >= 0) + close(fd); + unlinkat(dirfd, "link", 0); + unlinkat(dirfd, "fifo", 0); + unlinkat(dirfd, "symlink", 0); + unlinkat(dirfd, "file", 0); + unlinkat(dirfd, "dir", AT_REMOVEDIR); + return ret; +} + +static int test_lsm_inode_idmap(struct lsm skel) +{ + char tmpdir[] = "/var/tmp/test_lsm_idmap.XXXXXX"; + __u32 expected = INODE_IDMAP_ALL; + int dirfd = -1, idmapped_dirfd = -1; + int ret = -1; + + if (!ASSERT_OK_PTR(mkdtemp(tmpdir), "mkdtemp")) + return -1; + + dirfd = open(tmpdir, O_RDONLY \| O_DIRECTORY \| O_CLOEXEC); + if (!ASSERT_GE(dirfd, 0, "open_tmpdir")) + goto out; + + idmapped_dirfd = create_idmapped_tmpfs(); + if (!ASSERT_GE(idmapped_dirfd, 0, "create_idmapped_tmpfs")) + goto out; + + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; + + if (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), "identity_idmap")) + goto out; + if (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd), + "idmapped_mount")) + goto out; + + if (!ASSERT_EQ(skel->bss->inode_identity_idmap_seen, expected, + "inode_identity_idmap_seen")) + goto out; + ret = ASSERT_EQ(skel->bss->inode_idmapped_mount_seen, expected, + "inode_idmapped_mount_seen") ? 0 : -1; + +out: + if (idmapped_dirfd >= 0) + close(idmapped_dirfd); + if (dirfd >= 0) + close(dirfd); + rmdir(tmpdir); + return ret; +} + static int test_lsm(struct lsm skel) { struct bpf_link link; @@ -53,6 +278,10 @@ static int test_lsm(struct lsm skel) skel->bss->monitored_pid = getpid(); + err = test_lsm_inode_idmap(skel); + if (!ASSERT_OK(err, "test_lsm_inode_idmap")) + return err; + err = stack_mprotect(); if (!ASSERT_EQ(err, -1, "stack_mprotect") \|\| !ASSERT_EQ(errno, EPERM, "stack_mprotect")) @@ -71,6 +300,8 @@ static int test_lsm(struct lsm skel) skel->bss->copy_test = 0; skel->bss->bprm_count = 0; skel->bss->mprotect_count = 0; + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; return 0; } diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c index 7de173daf27b6..7e32fbddbfadf 100644 --- a/tools/testing/selftests/bpf/progs/lsm.c +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -84,6 +84,85 @@ char _license[] SEC("license") = "GPL"; int monitored_pid = 0; int mprotect_count = 0; int bprm_count = 0; +__u32 inode_identity_idmap_seen = 0; +__u32 inode_idmapped_mount_seen = 0; + +enum { + INODE_IDMAP_CREATE = 1U << 0, + INODE_IDMAP_LINK = 1U << 1, + INODE_IDMAP_SYMLINK = 1U << 2, + INODE_IDMAP_MKDIR = 1U << 3, + INODE_IDMAP_MKNOD = 1U << 4, + INODE_IDMAP_PERMISSION = 1U << 5, +}; + +static __always_inline bool is_monitored_idmap(struct mnt_idmap idmap) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + + return monitored_pid == pid && idmap; +} + +static __always_inline bool is_identity_idmap(struct mnt_idmap idmap) +{ + return idmap->uid_map.nr_extents == 0 && + idmap->gid_map.nr_extents == 0; +} + +static __always_inline int record_inode_idmap(struct mnt_idmap idmap, + __u32 hook, int ret) +{ + if (ret \|\| !is_monitored_idmap(idmap)) + return ret; + if (is_identity_idmap(idmap)) + inode_identity_idmap_seen \|= hook; + else + inode_idmapped_mount_seen \|= hook; + return 0; +} + +SEC("lsm/inode_create") +int BPF_PROG(test_inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret); +} + +SEC("lsm/inode_link") +int BPF_PROG(test_inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, + struct dentry new_dentry, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_LINK, ret); +} + +SEC("lsm/inode_symlink") +int BPF_PROG(test_inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret); +} + +SEC("lsm/inode_mkdir") +int BPF_PROG(test_inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret); +} + +SEC("lsm/inode_mknod") +int BPF_PROG(test_inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret); +} + +SEC("lsm/inode_permission") +int BPF_PROG(test_inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret); +} SEC("lsm/file_mprotect") int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
3/2	2026/09/02 02:08	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 13564 output: 22 thoughts: 1109 Thoughts: Analyzing the Patch: Worth Fuzzing? Okay, let's break this down. This patch is touching a lot of important areas: `fs/cachefiles/security.c`, `fs/namei.c`, critical include files, and, crucially, the security framework itself, including SELinux, Smack, and even the BPF LSM tests. My initial impression is that this might be a refactoring, introducing the `struct mnt_idmap idmap` parameter to several LSM hooks: `inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, `inode_permission`. First, I need to see if there's any functional* change here, or if this is just plumbing. Scanning `fs/namei.c`, I see `idmap` is getting passed into the `security_inode_` calls correctly. The wrapper functions in `security/security.c` are also updated to handle the `idmap` parameter and pass it on via `call_int_hook(...)`. SELinux and Smack are having their hook signatures updated, but it looks like they aren't using* the `idmap` parameter right now. However, the BPF LSM tests are receiving `idmap` now, which is definitely significant. The critical question: Is this just an API change to support idmapped mounts better (especially for BPF LSM or future LSMs), or does it functionally change security policy behavior? Let's check the guidelines for what's worth fuzzing. I need to make sure this is not just documentation, decorative changes, constant updates, or unreachable code. This definitely isn't documentation, and it isn't just logging. This is modifying LSM hook definitions and the VFS layer. Now, this is getting interesting. LSM hooks are core kernel logic, and the BPF LSM can attach to these hooks and now receives the `idmap` argument. That means a BPF program can now potentially make decisions based on mount ID mapping information, changing the attack surface. This looks like a potential area for security vulnerabilities, so it seems worth fuzzing. I need to double-check, though. I need to use my tools (`grepper`, git log, git show, etc.) to ensure I haven't missed any related changes in other LSMs (AppArmor, Landlock, etc.) or any other areas of the kernel that interact with these hooks. I have to be completely certain before I flag it as not worth fuzzing. I need to make sure I haven't missed anything crucial.
4/2	2026/09/02 02:08	tool	grepper	0m Args: { "Expression": "inode_permission.mnt_idmap" } Results:* { "Output": "drivers/block/ublk_drv.c=5308=static int ublk_char_dev_permission(struct ublk_device ub,\n--\ndrivers/block/ublk_drv.c-5326-\ndrivers/block/ublk_drv.c:5327:\terr = inode_permission(\u0026nop_mnt_idmap,\ndrivers/block/ublk_drv.c-5328-\t\t\td_backing_inode(path.dentry), mask);\n--\nfs/bad_inode.c=86=static int bad_inode_readlink(struct dentry dentry, char __user buffer,\n--\nfs/bad_inode.c-91-\nfs/bad_inode.c:92:static int bad_inode_permission(struct mnt_idmap idmap,\nfs/bad_inode.c-93-\t\t\t\tstruct inode inode, int mask)\n--\nfs/bpf_fs_kfuncs.c=103=static int bpf_xattr_read_permission(const char name, struct inode inode)\n--\nfs/bpf_fs_kfuncs.c-112-\nfs/bpf_fs_kfuncs.c:113:\treturn inode_permission(\u0026nop_mnt_idmap, inode, MAY_READ);\nfs/bpf_fs_kfuncs.c-114-}\n--\nfs/bpf_fs_kfuncs.c=173=static int bpf_xattr_write_permission(const char name, struct inode inode)\n--\nfs/bpf_fs_kfuncs.c-181-\nfs/bpf_fs_kfuncs.c:182:\treturn inode_permission(\u0026nop_mnt_idmap, inode, MAY_WRITE);\nfs/bpf_fs_kfuncs.c-183-}\n--\nfs/btrfs/ioctl.c=2430=static int btrfs_ioctl_defrag(struct file file, void __user argp)\n--\nfs/btrfs/ioctl.c-2460-\t\tif (!capable(CAP_SYS_ADMIN) \u0026\u0026\nfs/btrfs/ioctl.c:2461:\t\t inode_permission(\u0026nop_mnt_idmap, inode, MAY_WRITE)) {\nfs/btrfs/ioctl.c-2462-\t\t\tret = -EPERM;\n--\nfs/configfs/symlink.c=135=int configfs_symlink(struct mnt_idmap idmap, struct inode dir,\n--\nfs/configfs/symlink.c-192-\telse\nfs/configfs/symlink.c:193:\t\tret = inode_permission(\u0026nop_mnt_idmap, dir,\nfs/configfs/symlink.c-194-\t\t\t\t MAY_WRITE \| MAY_EXEC);\n--\nfs/ecryptfs/inode.c=852=ecryptfs_permission(struct mnt_idmap idmap, struct inode inode,\n--\nfs/ecryptfs/inode.c-854-{\nfs/ecryptfs/inode.c:855:\treturn inode_permission(\u0026nop_mnt_idmap,\nfs/ecryptfs/inode.c-856-\t\t\t\tecryptfs_inode_to_lower(inode), mask);\n--\nfs/namei.c=565=EXPORT_SYMBOL(generic_permission);\n--\nfs/namei.c-577- /\nfs/namei.c:578:static inline int do_inode_permission(struct mnt_idmap idmap,\nfs/namei.c-579-\t\t\t\t struct inode inode, int mask)\n--\nfs/namei.c=604=static int sb_permission(struct super_block sb, struct inode inode, int mask)\n--\nfs/namei.c-627- /\nfs/namei.c:628:int inode_permission(struct mnt_idmap idmap,\nfs/namei.c-629-\t\t struct inode inode, int mask)\n--\nfs/namei.c=663=EXPORT_SYMBOL(inode_permission);\n--\nfs/namei.c-682- /\nfs/namei.c:683:static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap idmap,\nfs/namei.c-684-\tstruct inode inode, int mask)\n--\nfs/namei.c=6075=int vfs_rename(struct renamedata rd)\n--\nfs/namei.c-6122-\t\tif (is_dir) {\nfs/namei.c:6123:\t\t\terror = inode_permission(rd-\u003emnt_idmap, source,\nfs/namei.c-6124-\t\t\t\t\t\t MAY_WRITE);\n--\nfs/namei.c-6128-\t\tif ((flags \u0026 RENAME_EXCHANGE) \u0026\u0026 new_is_dir) {\nfs/namei.c:6129:\t\t\terror = inode_permission(rd-\u003emnt_idmap, target,\nfs/namei.c-6130-\t\t\t\t\t\t MAY_WRITE);\n--\nfs/nfsd/nfsfh.c=31=static int nfsd_acceptable(void expv, struct dentry dentry)\n--\nfs/nfsd/nfsfh.c-45-\t\tparent = dget_parent(tdentry);\nfs/nfsd/nfsfh.c:46:\t\terr = inode_permission(\u0026nop_mnt_idmap,\nfs/nfsd/nfsfh.c-47-\t\t\t\t d_inode(parent), MAY_EXEC);\n--\nfs/nfsd/vfs.c=2843=nfsd_permission(struct svc_cred cred, struct svc_export exp,\n--\nfs/nfsd/vfs.c-2902-\t/ This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} /\nfs/nfsd/vfs.c:2903:\terr = inode_permission(\u0026nop_mnt_idmap, inode,\nfs/nfsd/vfs.c-2904-\t\t\t acc \u0026 (MAY_READ \| MAY_WRITE \| MAY_EXEC));\n--\nfs/nfsd/vfs.c-2909-\t (acc \u0026 (NFSD_MAY_OWNER_OVERRIDE \| NFSD_MAY_READ_IF_EXEC))))\nfs/nfsd/vfs.c:2910:\t\terr = inode_permission(\u0026nop_mnt_idmap, inode, MAY_EXEC);\nfs/nfsd/vfs.c-2911-\n--\nfs/ocfs2/refcounttree.c=4355=static inline int ocfs2_may_create(struct inode dir, struct dentry child)\n--\nfs/ocfs2/refcounttree.c-4360-\t\treturn -ENOENT;\nfs/ocfs2/refcounttree.c:4361:\treturn inode_permission(\u0026nop_mnt_idmap, dir, MAY_WRITE \| MAY_EXEC);\nfs/ocfs2/refcounttree.c-4362-}\n--\nfs/ocfs2/refcounttree.c=4372=static int ocfs2_vfs_reflink(struct dentry old_dentry, struct inode dir,\n--\nfs/ocfs2/refcounttree.c-4414-\tif (!preserve) {\nfs/ocfs2/refcounttree.c:4415:\t\terror = inode_permission(\u0026nop_mnt_idmap, inode, MAY_READ);\nfs/ocfs2/refcounttree.c-4416-\t\tif (error)\n--\nfs/open.c=463=static int do_faccessat(int dfd, const char __user filename, int mode, int flags)\n--\nfs/open.c-503-\nfs/open.c:504:\tres = inode_permission(mnt_idmap(path.mnt), inode, mode \| MAY_ACCESS);\nfs/open.c-505-\t/* SuS v2 requires we report a read only fs too /\n--\nfs/overlayfs/inode.c=306=int ovl_permission(struct mnt_idmap idmap,\n--\nfs/overlayfs/inode.c-336-\twith_ovl_creds(inode-\u003ei_sb)\nfs/overlayfs/inode.c:337:\t\treturn inode_permission(mnt_idmap(realpath.mnt), realinode, mask);\nfs/overlayfs/inode.c-338-}\n--\nfs/smb/server/smb2pdu.c=6008=int smb2_query_dir(struct ksmbd_work work)\n--\nfs/smb/server/smb2pdu.c-6061-\tif (!(dir_fp-\u003edaccess \u0026 FILE_LIST_DIRECTORY_LE) \|\|\nfs/smb/server/smb2pdu.c:6062:\t inode_permission(file_mnt_idmap(dir_fp-\u003efilp),\nfs/smb/server/smb2pdu.c-6063-\t\t\t file_inode(dir_fp-\u003efilp),\n--\ninclude/linux/fs.h=2710=int notify_change(struct mnt_idmap , struct dentry ,\ninclude/linux/fs.h-2711-\t\t struct iattr , struct delegated_inode );\ninclude/linux/fs.h:2712:int inode_permission(struct mnt_idmap , struct inode , int);\ninclude/linux/fs.h-2713-int generic_permission(struct mnt_idmap , struct inode , int);\ninclude/linux/fs.h=2714=static inline int file_permission(struct file file, int mask)\ninclude/linux/fs.h-2715-{\ninclude/linux/fs.h:2716:\treturn inode_permission(file_mnt_idmap(file),\ninclude/linux/fs.h-2717-\t\t\t\tfile_inode(file), mask);\n--\ninclude/linux/fs.h=2719=static inline int path_permission(const struct path path, int mask)\ninclude/linux/fs.h-2720-{\ninclude/linux/fs.h:2721:\treturn inode_permission(mnt_idmap(path-\u003emnt),\ninclude/linux/fs.h-2722-\t\t\t\td_inode(path-\u003edentry), mask);\n--\ninclude/linux/lsm_hook_defs.h=140=LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode,\ninclude/linux/lsm_hook_defs.h-141-\t bool rcu)\ninclude/linux/lsm_hook_defs.h:142:LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap,\ninclude/linux/lsm_hook_defs.h-143-\t struct inode inode, int mask)\n--\ninclude/linux/security.h=425=int security_inode_follow_link(struct dentry dentry, struct inode inode,\ninclude/linux/security.h-426-\t\t\t bool rcu);\ninclude/linux/security.h:427:int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\ninclude/linux/security.h-428-\t\t\t int mask);\n--\ninclude/linux/security.h=979=static inline int security_inode_follow_link(struct dentry dentry,\n--\ninclude/linux/security.h-985-\ninclude/linux/security.h:986:static inline int security_inode_permission(struct mnt_idmap idmap,\ninclude/linux/security.h-987-\t\t\t\t\t struct inode inode, int mask)\n--\nipc/mqueue.c=860=static int prepare_open(struct dentry dentry, int oflag, int ro,\n--\nipc/mqueue.c-883-\tacc = oflag2acc[oflag \u0026 O_ACCMODE];\nipc/mqueue.c:884:\treturn inode_permission(\u0026nop_mnt_idmap, d_inode(dentry), acc);\nipc/mqueue.c-885-}\n--\nkernel/bpf/inode.c=611=static struct bpf_prog __get_prog_inode(struct inode inode, enum bpf_prog_type type)\n--\nkernel/bpf/inode.c-613-\tstruct bpf_prog prog;\nkernel/bpf/inode.c:614:\tint ret = inode_permission(\u0026nop_mnt_idmap, inode, MAY_READ);\nkernel/bpf/inode.c-615-\tif (ret)\n--\nkernel/cgroup/cgroup.c=5410=static int cgroup_may_write(const struct cgroup cgrp, struct super_block sb)\n--\nkernel/cgroup/cgroup.c-5420-\nkernel/cgroup/cgroup.c:5421:\tret = inode_permission(\u0026nop_mnt_idmap, inode, MAY_WRITE);\nkernel/cgroup/cgroup.c-5422-\tiput(inode);\n--\nsecurity/security.c=1822=int security_inode_follow_link(struct dentry dentry, struct inode inode,\n--\nsecurity/security.c-1844- /\nsecurity/security.c:1845:int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\nsecurity/security.c-1846-\t\t\t int mask)\n--\nsecurity/selinux/hooks.c=3223=static inline void task_avdcache_update(struct task_security_struct tsec,\n--\nsecurity/selinux/hooks.c-3250- /\nsecurity/selinux/hooks.c:3251:static int selinux_inode_permission(struct mnt_idmap idmap,\nsecurity/selinux/hooks.c-3252-\t\t\t\t struct inode inode, int requested)\n--\nsecurity/smack/smack_lsm.c=1203=static int smack_inode_rename(struct inode old_inode,\n--\nsecurity/smack/smack_lsm.c-1237- /\nsecurity/smack/smack_lsm.c:1238:static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode,\nsecurity/smack/smack_lsm.c-1239-\t\t\t\t int mask)\n--\ntools/testing/selftests/bpf/progs/lsm.c=160=SEC(\"lsm/inode_permission\")\ntools/testing/selftests/bpf/progs/lsm.c:161:int BPF_PROG(test_inode_permission, struct mnt_idmap idmap,\ntools/testing/selftests/bpf/progs/lsm.c-162-\t struct inode *inode, int mask, int ret)\n" }
5/2	2026/09/02 02:08	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 19040 output: 20 thoughts: 114 Thoughts: Analyzing the Impact of the IDMAP Structure in LSM Hooks Okay, here's the situation: I need to understand how these recent changes impact the security module implementations. Specifically, I'm focusing on the updates to the LSM hooks. The core hooks I'm looking at are `security_inode_permission`, `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, and `security_inode_mknod`. The key change is the introduction of `struct mnt_idmap idmap` being passed down from the VFS. This is significant because it directly affects how we handle identity mapping within the LSM. Now, the important part: the fact that BPF LSM hooks also* have access to this `idmap` is crucial. This is a game changer for BPF-based security policies. BPF already gives us fine-grained control, but having the ID map available opens up even more possibilities for context-aware security enforcement, especially when dealing with namespaced file systems and user ID mapping scenarios. So, where do I go from here? Time to dig into the kernel configuration files. I'll need to check `security/Kconfig` and `fs/Kconfig` to see the relevant configuration options that control these features and ensure I'm aware of the dependencies and potential implications on different security configurations. This will help me understand how this `idmap` integration can be enabled or disabled and how it will impact the interaction with different security modules. This is likely going to open up some interesting new attack surfaces, and I'll need to do some focused research to understand how best to approach them.
6/2	2026/09/02 02:09	tool	grepper	0m Args: { "Expression": "config BPF_LSM" } Results: { "Output": "kernel/bpf/Kconfig=90=source \"kernel/bpf/preload/Kconfig\"\nkernel/bpf/Kconfig-91-\nkernel/bpf/Kconfig:92:config BPF_LSM\nkernel/bpf/Kconfig-93-\tbool \"Enable BPF LSM Instrumentation\"\n" }
7/2	2026/09/02 02:09	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 19617 output: 34 thoughts: 19 Thoughts: Here's my take on the situation: Investigating BPF Configuration Okay, so I need to dig into the BPF configuration. My initial thought is to zero in on `kernel/bpf/Kconfig`. I'm going to start around line 92. Hopefully, that will give me a good entry point to understand how things are set up and perhaps identify any potential issues or areas for further exploration within the BPF configuration options. Let's see what we can find there.
8/2	2026/09/02 02:09	tool	read-file	0m Args: { "File": "kernel/bpf/Kconfig", "FirstLine": 80, "LineCount": 40 } Results: { "Contents": " 80:\t\t still reenable it by setting it to 0 later on, or permanently\n 81:\t\t disable it by setting it to 1 (from which no other transition to\n 82:\t\t 0 is possible anymore).\n 83:\t\n 84:\t\t Unprivileged BPF could be used to exploit certain potential\n 85:\t\t speculative execution side-channel vulnerabilities on unmitigated\n 86:\t\t affected hardware.\n 87:\t\n 88:\t\t If you are unsure how to answer this question, answer Y.\n 89:\t\n 90:\tsource \"kernel/bpf/preload/Kconfig\"\n 91:\t\n 92:\tconfig BPF_LSM\n 93:\t\tbool \"Enable BPF LSM Instrumentation\"\n 94:\t\tdepends on BPF_EVENTS\n 95:\t\tdepends on BPF_SYSCALL\n 96:\t\tdepends on SECURITY\n 97:\t\tdepends on BPF_JIT\n 98:\t\thelp\n 99:\t\t Enables instrumentation of the security hooks with BPF programs for\n 100:\t\t implementing dynamic MAC and Audit Policies.\n 101:\t\n 102:\t\t If you are unsure how to answer this question, answer N.\n 103:\t\n 104:\tendmenu # \"BPF subsystem\"\n" }
9/2	2026/09/02 02:09	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20119 output: 16 thoughts: 33 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Examining LSM Configuration Options Alright, time to get down to brass tacks. I need to get a clear picture of the current Linux Security Modules (LSM) configurations available within this kernel. My first instinct, as always, is to dive straight into the heart of the matter – `security/Kconfig`. This is where all the interesting LSM settings reside, right? I expect to find the usual suspects defined in there. I'm thinking I'll be looking for the standard LSM configurations: the master `SECURITY` switch, of course. Then, I'll be particularly interested in the specifics. I'll expect to see `SECURITY_SELINUX`, `SECURITY_SMACK`, and whatever else is being supported or considered for this kernel build. This is where the decisions regarding the security posture of this kernel are ultimately made, and I need to see exactly where we stand.
10/2	2026/09/02 02:09	tool	grepper	0m Args: { "Expression": "config SECURITY" } Results: { "Output": "security/Kconfig=8=source \"security/keys/Kconfig\"\nsecurity/Kconfig-9-\nsecurity/Kconfig:10:config SECURITY_DMESG_RESTRICT\nsecurity/Kconfig-11-\tbool \"Restrict unprivileged access to the kernel syslog\"\n--\nsecurity/Kconfig=52=config MSEAL_SYSTEM_MAPPINGS\n--\nsecurity/Kconfig-72-\nsecurity/Kconfig:73:config SECURITY\nsecurity/Kconfig-74-\tbool \"Enable different security models\"\n--\nsecurity/Kconfig=86=config HAS_SECURITY_AUDIT\n--\nsecurity/Kconfig-90-\nsecurity/Kconfig:91:config SECURITYFS\nsecurity/Kconfig-92-\tbool \"Enable the securityfs filesystem\"\n--\nsecurity/Kconfig-98-\nsecurity/Kconfig:99:config SECURITY_NETWORK\nsecurity/Kconfig-100-\tbool \"Socket and Networking Security Hooks\"\n--\nsecurity/Kconfig-107-\nsecurity/Kconfig:108:config SECURITY_INFINIBAND\nsecurity/Kconfig-109-\tbool \"Infiniband Security Hooks\"\n--\nsecurity/Kconfig-116-\nsecurity/Kconfig:117:config SECURITY_NETWORK_XFRM\nsecurity/Kconfig-118-\tbool \"XFRM (IPSec) Networking Security Hooks\"\n--\nsecurity/Kconfig-129-\nsecurity/Kconfig:130:config SECURITY_PATH\nsecurity/Kconfig-131-\tbool \"Security hooks for pathname based access control\"\n--\nsecurity/Kconfig=268=config LSM\n--\nsecurity/Kconfig-284-\nsecurity/Kconfig:285:config SECURITY_COMMONCAP_KUNIT_TEST\nsecurity/Kconfig-286-\tbool \"Build KUnit tests for commoncap\" if !KUNIT_ALL_TESTS\n--\nsecurity/apparmor/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/apparmor/Kconfig:2:config SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-3-\tbool \"AppArmor support\"\n--\nsecurity/apparmor/Kconfig-17-\nsecurity/apparmor/Kconfig:18:config SECURITY_APPARMOR_DEBUG\nsecurity/apparmor/Kconfig-19-\tbool \"Build AppArmor with debug code\"\n--\nsecurity/apparmor/Kconfig-27-\nsecurity/apparmor/Kconfig:28:config SECURITY_APPARMOR_DEBUG_ASSERTS\nsecurity/apparmor/Kconfig-29-\tbool \"Build AppArmor with debugging asserts\"\n--\nsecurity/apparmor/Kconfig-37-\nsecurity/apparmor/Kconfig:38:config SECURITY_APPARMOR_DEBUG_MESSAGES\nsecurity/apparmor/Kconfig-39-\tbool \"Debug messages enabled by default\"\n--\nsecurity/apparmor/Kconfig-46-\nsecurity/apparmor/Kconfig:47:config SECURITY_APPARMOR_INTROSPECT_POLICY\nsecurity/apparmor/Kconfig-48-\tbool \"Allow loaded policy to be introspected\"\n--\nsecurity/apparmor/Kconfig-58-\nsecurity/apparmor/Kconfig:59:config SECURITY_APPARMOR_HASH\nsecurity/apparmor/Kconfig-60-\tbool \"Enable introspection of sha256 hashes for loaded profiles\"\n--\nsecurity/apparmor/Kconfig-70-\nsecurity/apparmor/Kconfig:71:config SECURITY_APPARMOR_HASH_DEFAULT\nsecurity/apparmor/Kconfig-72- bool \"Enable policy hash introspection by default\"\n--\nsecurity/apparmor/Kconfig-83-\nsecurity/apparmor/Kconfig:84:config SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/Kconfig-85-\tbool \"Allow exporting the raw binary policy\"\n--\nsecurity/apparmor/Kconfig-95-\nsecurity/apparmor/Kconfig:96:config SECURITY_APPARMOR_COMPRESSED_POLICY\nsecurity/apparmor/Kconfig-97-\tbool \"Allow loading policy in a compressed format\"\n--\nsecurity/apparmor/Kconfig-107-\nsecurity/apparmor/Kconfig:108:config SECURITY_APPARMOR_PARANOID_LOAD\nsecurity/apparmor/Kconfig-109-\tbool \"Perform full verification of loaded policy\"\n--\nsecurity/apparmor/Kconfig-118-\nsecurity/apparmor/Kconfig:119:config SECURITY_APPARMOR_KUNIT_TEST\nsecurity/apparmor/Kconfig-120-\ttristate \"Build KUnit tests for policy_unpack.c\" if !KUNIT_ALL_TESTS\n--\nsecurity/ipe/Kconfig-5-\nsecurity/ipe/Kconfig:6:menuconfig SECURITY_IPE\nsecurity/ipe/Kconfig-7-\tbool \"Integrity Policy Enforcement (IPE)\"\n--\nsecurity/ipe/Kconfig=98=endmenu\nsecurity/ipe/Kconfig-99-\nsecurity/ipe/Kconfig:100:config SECURITY_IPE_KUNIT_TEST\nsecurity/ipe/Kconfig-101-\tbool \"Build KUnit tests for IPE\" if !KUNIT_ALL_TESTS\n--\nsecurity/landlock/Kconfig-2-\nsecurity/landlock/Kconfig:3:config SECURITY_LANDLOCK\nsecurity/landlock/Kconfig-4-\tbool \"Landlock support\"\n--\nsecurity/landlock/Kconfig-23-\nsecurity/landlock/Kconfig:24:config SECURITY_LANDLOCK_LOG\nsecurity/landlock/Kconfig-25-\tbool\n--\nsecurity/landlock/Kconfig-28-\nsecurity/landlock/Kconfig:29:config SECURITY_LANDLOCK_KUNIT_TEST\nsecurity/landlock/Kconfig-30-\tbool \"KUnit tests for Landlock\" if !KUNIT_ALL_TESTS\n--\nsecurity/loadpin/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/loadpin/Kconfig:2:config SECURITY_LOADPIN\nsecurity/loadpin/Kconfig-3-\tbool \"Pin load of kernel files (modules, fw, etc) to one filesystem\"\n--\nsecurity/loadpin/Kconfig-13-\nsecurity/loadpin/Kconfig:14:config SECURITY_LOADPIN_ENFORCE\nsecurity/loadpin/Kconfig-15-\tbool \"Enforce LoadPin at boot\"\n--\nsecurity/loadpin/Kconfig-24-\nsecurity/loadpin/Kconfig:25:config SECURITY_LOADPIN_VERITY\nsecurity/loadpin/Kconfig-26-\tbool \"Allow reading files from certain other filesystems that use dm-verity\"\n--\nsecurity/lockdown/Kconfig:1:config SECURITY_LOCKDOWN_LSM\nsecurity/lockdown/Kconfig-2-\tbool \"Basic module for enforcing kernel lockdown\"\n--\nsecurity/lockdown/Kconfig-8-\nsecurity/lockdown/Kconfig:9:config SECURITY_LOCKDOWN_LSM_EARLY\nsecurity/lockdown/Kconfig-10-\tbool \"Enable lockdown LSM early in init\"\n--\nsecurity/safesetid/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/safesetid/Kconfig:2:config SECURITY_SAFESETID\nsecurity/safesetid/Kconfig-3- bool \"Gate setid transitions to limit CAP_SET{U/G}ID capabilities\"\n--\nsecurity/selinux/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/selinux/Kconfig:2:config SECURITY_SELINUX\nsecurity/selinux/Kconfig-3-\tbool \"SELinux Support\"\n--\nsecurity/selinux/Kconfig-11-\nsecurity/selinux/Kconfig:12:config SECURITY_SELINUX_BOOTPARAM\nsecurity/selinux/Kconfig-13-\tbool \"SELinux boot parameter\"\n--\nsecurity/selinux/Kconfig-25-\nsecurity/selinux/Kconfig:26:config SECURITY_SELINUX_DEVELOP\nsecurity/selinux/Kconfig-27-\tbool \"SELinux Development Support\"\n--\nsecurity/selinux/Kconfig-39-\nsecurity/selinux/Kconfig:40:config SECURITY_SELINUX_AVC_STATS\nsecurity/selinux/Kconfig-41-\tbool \"SELinux AVC Statistics\"\n--\nsecurity/selinux/Kconfig-48-\nsecurity/selinux/Kconfig:49:config SECURITY_SELINUX_SIDTAB_HASH_BITS\nsecurity/selinux/Kconfig-50-\tint \"SELinux sidtab hashtable size\"\n--\nsecurity/selinux/Kconfig-60-\nsecurity/selinux/Kconfig:61:config SECURITY_SELINUX_SID2STR_CACHE_SIZE\nsecurity/selinux/Kconfig-62-\tint \"SELinux SID to context string translation cache size\"\n--\nsecurity/selinux/Kconfig-71-\nsecurity/selinux/Kconfig:72:config SECURITY_SELINUX_AVC_HASH_BITS\nsecurity/selinux/Kconfig-73-\tint \"SELinux avc hashtable size\"\n--\nsecurity/selinux/Kconfig-82-\nsecurity/selinux/Kconfig:83:config SECURITY_SELINUX_DEBUG\nsecurity/selinux/Kconfig-84-\tbool \"SELinux kernel debugging support\"\n--\nsecurity/smack/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/smack/Kconfig:2:config SECURITY_SMACK\nsecurity/smack/Kconfig-3-\tbool \"Simplified Mandatory Access Control Kernel Support\"\n--\nsecurity/smack/Kconfig-15-\nsecurity/smack/Kconfig:16:config SECURITY_SMACK_BRINGUP\nsecurity/smack/Kconfig-17-\tbool \"Reporting on access granted by Smack rules\"\n--\nsecurity/smack/Kconfig-33-\nsecurity/smack/Kconfig:34:config SECURITY_SMACK_NETFILTER\nsecurity/smack/Kconfig-35-\tbool \"Packet marking using secmarks for netfilter\"\n--\nsecurity/smack/Kconfig-44-\nsecurity/smack/Kconfig:45:config SECURITY_SMACK_APPEND_SIGNALS\nsecurity/smack/Kconfig-46-\tbool \"Treat delivering signals as an append operation\"\n--\nsecurity/tomoyo/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/tomoyo/Kconfig:2:config SECURITY_TOMOYO\nsecurity/tomoyo/Kconfig-3-\tbool \"TOMOYO Linux Support\"\n--\nsecurity/tomoyo/Kconfig-15-\nsecurity/tomoyo/Kconfig:16:config SECURITY_TOMOYO_MAX_ACCEPT_ENTRY\nsecurity/tomoyo/Kconfig-17-\tint \"Default maximal count for learning mode\"\n--\nsecurity/tomoyo/Kconfig-28-\nsecurity/tomoyo/Kconfig:29:config SECURITY_TOMOYO_MAX_AUDIT_LOG\nsecurity/tomoyo/Kconfig-30-\tint \"Default maximal count for audit log\"\n--\nsecurity/tomoyo/Kconfig-39-\nsecurity/tomoyo/Kconfig:40:config SECURITY_TOMOYO_OMIT_USERSPACE_LOADER\nsecurity/tomoyo/Kconfig-41-\tbool \"Activate without calling userspace policy loader.\"\n--\nsecurity/tomoyo/Kconfig-55-\nsecurity/tomoyo/Kconfig:56:config SECURITY_TOMOYO_POLICY_LOADER\nsecurity/tomoyo/Kconfig-57-\tstring \"Location of userspace policy loader\"\n--\nsecurity/tomoyo/Kconfig-65-\nsecurity/tomoyo/Kconfig:66:config SECURITY_TOMOYO_ACTIVATION_TRIGGER\nsecurity/tomoyo/Kconfig-67-\tstring \"Trigger for calling userspace policy loader\"\n--\nsecurity/tomoyo/Kconfig-76-\nsecurity/tomoyo/Kconfig:77:config SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING\nsecurity/tomoyo/Kconfig-78-\tbool \"Use insecure built-in settings for fuzzing tests.\"\n--\nsecurity/yama/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/yama/Kconfig:2:config SECURITY_YAMA\nsecurity/yama/Kconfig-3-\tbool \"Yama support\"\n" }
11/2	2026/09/02 02:09	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23389 output: 18 thoughts: 13 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Examining the Cachefiles Kconfig Alright, let's dive in. My immediate thought is, "Okay, `fs/cachefiles/Kconfig` – right, that's where the configuration options for the cachefiles filesystem are defined." I need to understand what's controllable at compile time. What features can be enabled or disabled? Are there any dependencies on other kernel subsystems that I should be aware of, like specific cryptographic algorithms or namespace capabilities? I'm thinking, "I need to look for the core features first." What are the critical booleans that dictate whether the cachefiles code is even included in the build? Then, I should scan for any further options that allow a fine-grained tuning of the cache's behavior. I will probably look for any default settings that catch my eye, or potential performance tunables. Maybe some options for debugging that will come in handy. I know the Kconfig syntax well, so I'll be quickly looking for the usual suspects: `bool`, `tristate`, `int`, and `string` types. Dependencies and conditional compilation, and the general structure of the file is what I'm looking for. Let's see what we can find.
12/2	2026/09/02 02:09	tool	grepper	0m Args: { "Expression": "config CACHEFILES" } Results: { "Output": "fs/cachefiles/Kconfig-2-\nfs/cachefiles/Kconfig:3:config CACHEFILES\nfs/cachefiles/Kconfig-4-\ttristate \"Filesystem caching on files\"\n--\nfs/cachefiles/Kconfig-13-\nfs/cachefiles/Kconfig:14:config CACHEFILES_DEBUG\nfs/cachefiles/Kconfig-15-\tbool \"Debug CacheFiles\"\n--\nfs/cachefiles/Kconfig-22-\nfs/cachefiles/Kconfig:23:config CACHEFILES_ERROR_INJECTION\nfs/cachefiles/Kconfig-24-\tbool \"Provide error injection for cachefiles\"\n" }
13/2	2026/09/02 02:09	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23861 output: 209 thoughts: 1282 Thoughts: Analysis of Potential Fuzzing Target Okay, let's break this down. This patch is adding a `mnt_idmap` parameter to a bunch of critical security-related VFS hooks: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_permission`. It's also updating the VFS callers and the LSM implementations themselves, including BPF selftests. The question is, is this worth fuzzing? Based on the criteria, we need to determine if it modifies "reachable core kernel logic." Yes, absolutely. This touches core VFS functions (`inode_permission`, `vfs_create`, `vfs_mkdir`, etc.) and LSM hook wrappers (`security_inode_`). These are entry points directly accessible from user-space via system calls like `open`, `mkdir`, and others. That makes it a good candidate. Now, let's identify the 'FocusSymbols'. I need to be careful not to include generic hot-path functions. We want non-static, non-inlined API entrypoints. That means we should exclude things like `inode_permission` (which is practically called on every file access). So the focus symbols are: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod` and `security_inode_permission` because those are called at creation time. Next, the required kernel configurations. We'll need `SECURITY` to enable the security infrastructure and LSM hooks. `BPF_LSM` is also required because it leverages the `idmap` argument, and then either `SECURITY_SELINUX` or `SECURITY_SMACK` for a practical LSM. The `BPF_LSM` dependency needs `BPF_EVENTS`, `BPF_SYSCALL`, `SECURITY`, `BPF_JIT`. So, the configurations required are `SECURITY`, `BPF_LSM`, and either `SECURITY_SELINUX` or `SECURITY_SMACK`. Let's keep it simple and just list `SECURITY`, `BPF_LSM`, `SECURITY_SELINUX`, and `SECURITY_SMACK`. Now, for `set-results`: WorthFuzzing: True, definitely. * Reasoning: This patch extends VFS LSM hooks and their callers to propagate mount idmappings (`struct mnt_idmap idmap`). This allows security modules (including BPF LSM, SELinux, Smack) to perform permissions checks aware of idmapped mounts. These changes modify core VFS and security subsystem interfaces and are reachable from userspace filesystem operations. FocusSymbols: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, `security_inode_permission`. * EnableConfigs: `SECURITY`, `BPF_LSM`, `SECURITY_SELINUX`, `SECURITY_SMACK`. That should be it!
14/2	2026/09/02 02:09	tool	set-results	0m Args: { "EnableConfigs": [ "SECURITY", "BPF_LSM", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "security_inode_permission" ], "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.", "WorthFuzzing": true } Results:* { "EnableConfigs": [ "SECURITY", "BPF_LSM", "SECURITY_SELINUX", "SECURITY_SMACK", "CACHEFILES" ], "FocusSymbols": [ "security_inode_create", "security_inode_link", "security_inode_symlink", "security_inode_mkdir", "security_inode_mknod", "security_inode_permission" ], "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap *idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.", "WorthFuzzing": true }
15/1	2026/09/02 02:09	action	If	0m Args: { "WorthFuzzing": true } Results: null
16/2	2026/09/02 02:09	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.", "NeedsKMSAN": false } Instruction:* You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit e9c28218b2d5e57d772a682e02a587bfa3470b48 Author: syz-cluster <triage@syzkaller.com> Date: Wed Sep 2 02:08:49 2026 +0000 syz-cluster: applied patch under review diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c index fc6611886b3b5..eefe5453b904e 100644 --- a/fs/cachefiles/security.c +++ b/fs/cachefiles/security.c @@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache cache, { int ret; - ret = security_inode_mkdir(d_backing_inode(root), root, 0); + ret = security_inode_mkdir(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) { pr_err("Security denies permission to make dirs: error %d", ret); return ret; } - ret = security_inode_create(d_backing_inode(root), root, 0); + ret = security_inode_create(&nop_mnt_idmap, d_backing_inode(root), root, 0); if (ret < 0) pr_err("Security denies permission to create files: error %d", ret); diff --git a/fs/namei.c b/fs/namei.c index 20a6534ea3eff..99f894f3f7e13 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap idmap, if (unlikely(retval)) return retval; - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } EXPORT_SYMBOL(inode_permission); @@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap id if (unlikely(((inode->i_mode & 0111) != 0111) \|\| !no_acl_inode(inode))) return inode_permission(idmap, inode, mask); - return security_inode_permission(inode, mask); + return security_inode_permission(idmap, inode, mask); } /* @@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode, return -EACCES; /* shouldn't it be ENOSYS? / mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(idmap, dir, dentry, mode); if (error) return error; error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di); @@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry dentry, umode_t mode, mode &= S_IALLUGO; mode \|= S_IFREG; - error = security_inode_create(dir, dentry, mode); + error = security_inode_create(&nop_mnt_idmap, dir, dentry, mode); if (error) return error; error = f(dentry, mode, arg); @@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap idmap, if (error) return error; - return security_inode_create(dir->dentry->d_inode, dentry, mode); + return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode); } /* @@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap idmap, struct inode dir, if (error) return error; - error = security_inode_mknod(dir, dentry, mode, dev); + error = security_inode_mknod(idmap, dir, dentry, mode, dev); if (error) return error; @@ -5395,7 +5395,7 @@ struct dentry vfs_mkdir(struct mnt_idmap idmap, struct inode dir, goto err; mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO \| S_ISVTX, S_IFDIR); - error = security_inode_mkdir(dir, dentry, mode); + error = security_inode_mkdir(idmap, dir, dentry, mode); if (error) goto err; @@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap idmap, struct inode dir, if (!dir->i_op->symlink) return -EPERM; - error = security_inode_symlink(dir, dentry, oldname); + error = security_inode_symlink(idmap, dir, dentry, oldname); if (error) return error; @@ -5907,7 +5907,7 @@ int vfs_link(struct dentry old_dentry, struct mnt_idmap idmap, if (S_ISDIR(inode->i_mode)) return -EPERM; - error = security_inode_link(old_dentry, dir, new_dentry); + error = security_inode_link(idmap, old_dentry, dir, new_dentry); if (error) return error; diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 65c9609ec2077..9e49a5bc9ff3c 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode inode, int xattr_count) LSM_HOOK(int, 0, inode_init_security_anon, struct inode inode, const struct qstr name, const struct inode context_inode) -LSM_HOOK(int, 0, inode_create, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap idmap, struct inode inode) -LSM_HOOK(int, 0, inode_link, struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +LSM_HOOK(int, 0, inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_unlink, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_symlink, struct inode dir, struct dentry dentry, - const char old_name) -LSM_HOOK(int, 0, inode_mkdir, struct inode dir, struct dentry dentry, - umode_t mode) +LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) +LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) LSM_HOOK(int, 0, inode_rmdir, struct inode dir, struct dentry dentry) -LSM_HOOK(int, 0, inode_mknod, struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) LSM_HOOK(int, 0, inode_rename, struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry) LSM_HOOK(int, 0, inode_readlink, struct dentry dentry) LSM_HOOK(int, 0, inode_follow_link, struct dentry dentry, struct inode inode, bool rcu) -LSM_HOOK(int, 0, inode_permission, struct inode inode, int mask) +LSM_HOOK(int, 0, inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask) LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap idmap, struct dentry dentry, struct iattr attr) LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap idmap, diff --git a/include/linux/security.h b/include/linux/security.h index 153e9043058f8..0f5f20ac10507 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -404,24 +404,28 @@ int security_inode_init_security(struct inode inode, struct inode dir, int security_inode_init_security_anon(struct inode inode, const struct qstr name, const struct inode context_inode); -int security_inode_create(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode); -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry); +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry); int security_inode_unlink(struct inode dir, struct dentry dentry); -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name); -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode); +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name); +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode); int security_inode_rmdir(struct inode dir, struct dentry dentry); -int security_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev); +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev); int security_inode_rename(struct inode old_dir, struct dentry old_dentry, struct inode new_dir, struct dentry new_dentry, unsigned int flags); int security_inode_readlink(struct dentry dentry); int security_inode_follow_link(struct dentry dentry, struct inode inode, bool rcu); -int security_inode_permission(struct inode inode, int mask); +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask); int security_inode_setattr(struct mnt_idmap idmap, struct dentry dentry, struct iattr attr); void security_inode_post_setattr(struct mnt_idmap idmap, struct dentry dentry, @@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode inode, return 0; } -static inline int security_inode_create(struct inode dir, - struct dentry dentry, - umode_t mode) +static inline int security_inode_create(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + umode_t mode) { return 0; } @@ -913,9 +918,10 @@ static inline void security_inode_post_create_tmpfile(struct mnt_idmap idmap, struct inode inode) { } -static inline int security_inode_link(struct dentry old_dentry, - struct inode dir, - struct dentry new_dentry) +static inline int security_inode_link(struct mnt_idmap idmap, + struct dentry old_dentry, + struct inode dir, + struct dentry new_dentry) { return 0; } @@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode dir, return 0; } -static inline int security_inode_symlink(struct inode dir, - struct dentry dentry, - const char old_name) +static inline int security_inode_symlink(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + const char old_name) { return 0; } -static inline int security_inode_mkdir(struct inode dir, - struct dentry dentry, - int mode) +static inline int security_inode_mkdir(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode) { return 0; } @@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode dir, return 0; } -static inline int security_inode_mknod(struct inode dir, - struct dentry dentry, - int mode, dev_t dev) +static inline int security_inode_mknod(struct mnt_idmap idmap, + struct inode dir, + struct dentry dentry, + int mode, dev_t dev) { return 0; } @@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry dentry, return 0; } -static inline int security_inode_permission(struct inode inode, int mask) +static inline int security_inode_permission(struct mnt_idmap idmap, + struct inode inode, int mask) { return 0; } diff --git a/security/security.c b/security/security.c index 2ee276ab15c5b..a9190da3341dd 100644 --- a/security/security.c +++ b/security/security.c @@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path path) /* * security_inode_create() - Check if creating a file is allowed + * @idmap: idmap of the mount * @dir: the parent directory * @dentry: the file being created * @mode: requested file mode @@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path path) * Return: Returns 0 if permission is granted. / -int security_inode_create(struct inode dir, struct dentry dentry, - umode_t mode) +int security_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_create, dir, dentry, mode); + return call_int_hook(inode_create, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_create); @@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, /* * security_inode_link() - Check if creating a hard link is allowed + * @idmap: idmap of the mount * @old_dentry: existing file * @dir: new parent directory * @new_dentry: new link @@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap idmap, * Return: Returns 0 if permission is granted. / -int security_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +int security_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) return 0; - return call_int_hook(inode_link, old_dentry, dir, new_dentry); + return call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry); } /** @@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) /** * security_inode_symlink() - Check if creating a symbolic link is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: symbolic link * @old_name: existing filename @@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_symlink(struct inode dir, struct dentry dentry, - const char old_name) +int security_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_symlink, dir, dentry, old_name); + return call_int_hook(inode_symlink, idmap, dir, dentry, old_name); } /** * security_inode_mkdir() - Check if creating a new directory is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new directory * @mode: new directory mode @@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode dir, struct dentry dentry, * * Return: Returns 0 if permission is granted. / -int security_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mode) +int security_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mkdir, dir, dentry, mode); + return call_int_hook(inode_mkdir, idmap, dir, dentry, mode); } EXPORT_SYMBOL_GPL(security_inode_mkdir); @@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) /** * security_inode_mknod() - Check if creating a special file is allowed + * @idmap: idmap of the mount * @dir: parent directory * @dentry: new file * @mode: new file mode @@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode dir, struct dentry dentry) * * Return: Returns 0 if permission is granted. / -int security_inode_mknod(struct inode dir, struct dentry dentry, - umode_t mode, dev_t dev) +int security_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { if (unlikely(IS_PRIVATE(dir))) return 0; - return call_int_hook(inode_mknod, dir, dentry, mode, dev); + return call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev); } /** @@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, /** * security_inode_permission() - Check if accessing an inode is allowed + * @idmap: idmap of the mount * @inode: inode * @mask: access mask * @@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry dentry, struct inode inode, * * Return: Returns 0 if permission is granted. / -int security_inode_permission(struct inode inode, int mask) +int security_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { if (unlikely(IS_PRIVATE(inode))) return 0; - return call_int_hook(inode_permission, inode, mask); + return call_int_hook(inode_permission, idmap, inode, mask); } /** diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 035aaf113d1da..967984d0af300 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode inode, &ad); } -static int selinux_inode_create(struct inode dir, struct dentry dentry, umode_t mode) +static int selinux_inode_create(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode) { return may_create(dir, dentry, SECCLASS_FILE); } -static int selinux_inode_link(struct dentry old_dentry, struct inode dir, struct dentry new_dentry) +static int selinux_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { return may_link(dir, old_dentry, MAY_LINK); } @@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_UNLINK); } -static int selinux_inode_symlink(struct inode dir, struct dentry dentry, const char name) +static int selinux_inode_symlink(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char name) { return may_create(dir, dentry, SECCLASS_LNK_FILE); } -static int selinux_inode_mkdir(struct inode dir, struct dentry dentry, umode_t mask) +static int selinux_inode_mkdir(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mask) { return may_create(dir, dentry, SECCLASS_DIR); } @@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode dir, struct dentry dentry) return may_link(dir, dentry, MAY_RMDIR); } -static int selinux_inode_mknod(struct inode dir, struct dentry dentry, umode_t mode, dev_t dev) +static int selinux_inode_mknod(struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev) { return may_create(dir, dentry, inode_mode_to_security_class(mode)); } @@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct tsec, /* * selinux_inode_permission - Check if the current task can access an inode + * @idmap: idmap of the mount * @inode: the inode that is being accessed * @requested: the accesses being requested * * Check if the current task is allowed to access @inode according to * @requested. Returns 0 if allowed, negative values otherwise. / -static int selinux_inode_permission(struct inode inode, int requested) +static int selinux_inode_permission(struct mnt_idmap idmap, + struct inode inode, int requested) { int mask; u32 perms; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8e88ac65fd7fc..a45819d13c0d6 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode inode, struct inode dir, /** * smack_inode_link - Smack check on link + * @idmap: idmap of the mount * @old_dentry: the existing object * @dir: unused * @new_dentry: the new object * * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_link(struct dentry old_dentry, struct inode dir, - struct dentry new_dentry) +static int smack_inode_link(struct mnt_idmap idmap, struct dentry old_dentry, + struct inode dir, struct dentry new_dentry) { struct smack_known isp; struct smk_audit_info ad; @@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode old_inode, /** * smack_inode_permission - Smack version of permission() + * @idmap: idmap of the mount * @inode: the inode in question * @mask: the access requested * @@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode old_inode, * Returns 0 if access is permitted, an error code otherwise / -static int smack_inode_permission(struct inode inode, int mask) +static int smack_inode_permission(struct mnt_idmap idmap, struct inode inode, + int mask) { struct superblock_smack sbsp = smack_superblock(inode->i_sb); struct smk_audit_info ad; diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c index d7495efd4a562..c0ae813698ae2 100644 --- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c @@ -1,18 +1,30 @@ // SPDX-License-Identifier: GPL-2.0 +#define _GNU_SOURCE / * Copyright (C) 2020 Google LLC. / #include <test_progs.h> +#include <sched.h> +#include <signal.h> +#include <string.h> +#include <sys/stat.h> +#include <sys/syscall.h> #include <sys/wait.h> #include <unistd.h> +#include <linux/mount.h> + #include "lsm.skel.h" #include "lsm_tailcall.skel.h" char CMD_ARGS[] = {"true", NULL}; +enum { + INODE_IDMAP_ALL = (1U << 6) - 1, +}; + int exec_cmd(int monitored_pid) { int child_pid, child_status; @@ -30,6 +42,219 @@ int exec_cmd(int monitored_pid) return -EINVAL; } +static ssize_t write_nointr(int fd, const void buf, size_t count) +{ + ssize_t ret; + + do { + ret = write(fd, buf, count); + } while (ret < 0 && errno == EINTR); + + return ret; +} + +static int write_file(const char path, const char value) +{ + size_t len = strlen(value); + int fd, saved_errno = 0; + ssize_t ret; + + fd = open(path, O_WRONLY \| O_CLOEXEC \| O_NOCTTY \| O_NOFOLLOW); + if (fd < 0) + return -1; + + ret = write_nointr(fd, value, len); + if (ret < 0) + saved_errno = errno; + else if ((size_t)ret != len) + saved_errno = EIO; + close(fd); + if (saved_errno) { + errno = saved_errno; + return -1; + } + return 0; +} + +static int write_userns_file(pid_t pid, const char name, const char value) +{ + char path[64]; + int len; + + len = snprintf(path, sizeof(path), "/proc/%d/%s", pid, name); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + return -1; + } + + return write_file(path, value); +} + +static int create_userns_fd(void) +{ + char path[64]; + pid_t pid, waited; + int fd = -1, len, saved_errno, status; + + pid = fork(); + if (pid < 0) + return -1; + if (pid == 0) { + if (unshare(CLONE_NEWUSER)) + _exit(1); + raise(SIGSTOP); + _exit(0); + } + + do { + waited = waitpid(pid, &status, WUNTRACED); + } while (waited < 0 && errno == EINTR); + if (waited != pid) + goto out; + if (!WIFSTOPPED(status)) { + pid = -1; + goto out; + } + + / A one-entry map is identity for root but remains distinct from nop_mnt_idmap. / + if (write_userns_file(pid, "setgroups", "deny") && errno != ENOENT) + goto out; + if (write_userns_file(pid, "uid_map", "0 0 1") \|\| + write_userns_file(pid, "gid_map", "0 0 1")) + goto out; + + len = snprintf(path, sizeof(path), "/proc/%d/ns/user", pid); + if (len < 0 \|\| (size_t)len >= sizeof(path)) { + errno = EOVERFLOW; + goto out; + } + fd = open(path, O_RDONLY \| O_CLOEXEC); + +out: + saved_errno = errno; + if (pid > 0) { + kill(pid, SIGKILL); + do { + waited = waitpid(pid, NULL, 0); + } while (waited < 0 && errno == EINTR); + } + errno = saved_errno; + return fd; +} + +static int create_idmapped_tmpfs(void) +{ + struct mount_attr attr = { + .attr_set = MOUNT_ATTR_IDMAP, + }; + int fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1; + + userns_fd = create_userns_fd(); + if (userns_fd < 0) + goto out; + + / A detached tmpfs avoids relying on the host test directory supporting idmaps. / + fsfd = syscall(__NR_fsopen, "tmpfs", FSOPEN_CLOEXEC); + if (fsfd < 0) + goto out; + if (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)) + goto out; + + mntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0); + if (mntfd < 0) + goto out; + + attr.userns_fd = userns_fd; + if (syscall(__NR_mount_setattr, mntfd, "", AT_EMPTY_PATH, &attr, + sizeof(attr))) { + close(mntfd); + mntfd = -1; + } + +out: + saved_errno = errno; + if (fsfd >= 0) + close(fsfd); + if (userns_fd >= 0) + close(userns_fd); + errno = saved_errno; + return mntfd; +} + +static int exercise_inode_idmap_hooks(int dirfd) +{ + int fd = -1, ret = -1; + + fd = openat(dirfd, "file", O_CREAT \| O_EXCL \| O_WRONLY \| O_CLOEXEC, + 0600); + if (!ASSERT_GE(fd, 0, "create")) + goto out; + close(fd); + fd = -1; + + if (!ASSERT_OK(mkdirat(dirfd, "dir", 0700), "mkdir")) + goto out; + if (!ASSERT_OK(symlinkat("target", dirfd, "symlink"), "symlink")) + goto out; + if (!ASSERT_OK(linkat(dirfd, "file", dirfd, "link", 0), "link")) + goto out; + if (!ASSERT_OK(mkfifoat(dirfd, "fifo", 0600), "mknod")) + goto out; + + ret = 0; +out: + if (fd >= 0) + close(fd); + unlinkat(dirfd, "link", 0); + unlinkat(dirfd, "fifo", 0); + unlinkat(dirfd, "symlink", 0); + unlinkat(dirfd, "file", 0); + unlinkat(dirfd, "dir", AT_REMOVEDIR); + return ret; +} + +static int test_lsm_inode_idmap(struct lsm skel) +{ + char tmpdir[] = "/var/tmp/test_lsm_idmap.XXXXXX"; + __u32 expected = INODE_IDMAP_ALL; + int dirfd = -1, idmapped_dirfd = -1; + int ret = -1; + + if (!ASSERT_OK_PTR(mkdtemp(tmpdir), "mkdtemp")) + return -1; + + dirfd = open(tmpdir, O_RDONLY \| O_DIRECTORY \| O_CLOEXEC); + if (!ASSERT_GE(dirfd, 0, "open_tmpdir")) + goto out; + + idmapped_dirfd = create_idmapped_tmpfs(); + if (!ASSERT_GE(idmapped_dirfd, 0, "create_idmapped_tmpfs")) + goto out; + + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; + + if (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), "identity_idmap")) + goto out; + if (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd), + "idmapped_mount")) + goto out; + + if (!ASSERT_EQ(skel->bss->inode_identity_idmap_seen, expected, + "inode_identity_idmap_seen")) + goto out; + ret = ASSERT_EQ(skel->bss->inode_idmapped_mount_seen, expected, + "inode_idmapped_mount_seen") ? 0 : -1; + +out: + if (idmapped_dirfd >= 0) + close(idmapped_dirfd); + if (dirfd >= 0) + close(dirfd); + rmdir(tmpdir); + return ret; +} + static int test_lsm(struct lsm skel) { struct bpf_link link; @@ -53,6 +278,10 @@ static int test_lsm(struct lsm skel) skel->bss->monitored_pid = getpid(); + err = test_lsm_inode_idmap(skel); + if (!ASSERT_OK(err, "test_lsm_inode_idmap")) + return err; + err = stack_mprotect(); if (!ASSERT_EQ(err, -1, "stack_mprotect") \|\| !ASSERT_EQ(errno, EPERM, "stack_mprotect")) @@ -71,6 +300,8 @@ static int test_lsm(struct lsm skel) skel->bss->copy_test = 0; skel->bss->bprm_count = 0; skel->bss->mprotect_count = 0; + skel->bss->inode_identity_idmap_seen = 0; + skel->bss->inode_idmapped_mount_seen = 0; return 0; } diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c index 7de173daf27b6..7e32fbddbfadf 100644 --- a/tools/testing/selftests/bpf/progs/lsm.c +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -84,6 +84,85 @@ char _license[] SEC("license") = "GPL"; int monitored_pid = 0; int mprotect_count = 0; int bprm_count = 0; +__u32 inode_identity_idmap_seen = 0; +__u32 inode_idmapped_mount_seen = 0; + +enum { + INODE_IDMAP_CREATE = 1U << 0, + INODE_IDMAP_LINK = 1U << 1, + INODE_IDMAP_SYMLINK = 1U << 2, + INODE_IDMAP_MKDIR = 1U << 3, + INODE_IDMAP_MKNOD = 1U << 4, + INODE_IDMAP_PERMISSION = 1U << 5, +}; + +static __always_inline bool is_monitored_idmap(struct mnt_idmap idmap) +{ + __u32 pid = bpf_get_current_pid_tgid() >> 32; + + return monitored_pid == pid && idmap; +} + +static __always_inline bool is_identity_idmap(struct mnt_idmap idmap) +{ + return idmap->uid_map.nr_extents == 0 && + idmap->gid_map.nr_extents == 0; +} + +static __always_inline int record_inode_idmap(struct mnt_idmap idmap, + __u32 hook, int ret) +{ + if (ret \|\| !is_monitored_idmap(idmap)) + return ret; + if (is_identity_idmap(idmap)) + inode_identity_idmap_seen \|= hook; + else + inode_idmapped_mount_seen \|= hook; + return 0; +} + +SEC("lsm/inode_create") +int BPF_PROG(test_inode_create, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret); +} + +SEC("lsm/inode_link") +int BPF_PROG(test_inode_link, struct mnt_idmap idmap, + struct dentry old_dentry, struct inode dir, + struct dentry new_dentry, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_LINK, ret); +} + +SEC("lsm/inode_symlink") +int BPF_PROG(test_inode_symlink, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, const char old_name, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret); +} + +SEC("lsm/inode_mkdir") +int BPF_PROG(test_inode_mkdir, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret); +} + +SEC("lsm/inode_mknod") +int BPF_PROG(test_inode_mknod, struct mnt_idmap idmap, struct inode dir, + struct dentry dentry, umode_t mode, dev_t dev, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret); +} + +SEC("lsm/inode_permission") +int BPF_PROG(test_inode_permission, struct mnt_idmap idmap, + struct inode inode, int mask, int ret) +{ + return record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret); +} SEC("lsm/file_mprotect") int BPF_PROG(test_int_hook, struct vm_area_struct *vma,
17/3	2026/09/02 02:09	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 13561 output: 19 thoughts: 482 Thoughts: Analyzing the Patch for LSM Hook Integration Okay, let's dive into this patch. The commit message simply indicates it's a patch under review related to syz-cluster. I'm seeing changes across a few core areas: `fs/cachefiles/security.c`, `fs/namei.c`, a couple of include files (`linux/lsm_hook_defs.h` and `linux/security.h`), and the `security` directory itself with `security.c`, `selinux/hooks.c`, and `smack/smack_lsm.c`. I'm also seeing a change in the bpf selftests. What immediately catches my eye is that this patch is passing a `struct mnt_idmap *idmap` down into a handful of LSM hooks. Specifically, the following are being modified to accept the `idmap`: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_permission`. Taking a closer look at the impacted LSM implementations, I see a pattern. SELinuX (`selinux_inode_...`) and Smack (`smack_inode_...`) are being updated to simply accept the new `idmap` parameter to match the function prototype; it's a straight-forward addition to their signatures. In `fs/cachefiles/security.c`, it's passing `&nop_mnt_idmap`, which makes sense. `fs/namei.c` seems to be passing either the `idmap` or `&nop_mnt_idmap` as well. The bpf selftests are also being updated to handle the new hook signatures. My immediate next thought is to verify that these are the only LSM implementations affected and that there are no uninitialized memory risks. Let me quickly run a `grep` to ensure no other LSM hooks or callers are lurking that might have been missed. We need to be exhaustive here to ensure we aren't introducing unintended consequences.
18/3	2026/09/02 02:09	tool	grepper	0m Args: { "Expression": "security_inode_create" } Results: { "Output": "fs/cachefiles/security.c=49=static int cachefiles_check_cache_dir(struct cachefiles_cache cache,\n--\nfs/cachefiles/security.c-60-\nfs/cachefiles/security.c:61:\tret = security_inode_create(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\nfs/cachefiles/security.c-62-\tif (ret \u003c 0)\n--\nfs/namei.c=4177=int vfs_create(struct mnt_idmap idmap, struct dentry dentry, umode_t mode,\n--\nfs/namei.c-4190-\tmode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);\nfs/namei.c:4191:\terror = security_inode_create(idmap, dir, dentry, mode);\nfs/namei.c-4192-\tif (error)\n--\nfs/namei.c=4204=int vfs_mkobj(struct dentry dentry, umode_t mode,\n--\nfs/namei.c-4214-\tmode \|= S_IFREG;\nfs/namei.c:4215:\terror = security_inode_create(\u0026nop_mnt_idmap, dir, dentry, mode);\nfs/namei.c-4216-\tif (error)\n--\nfs/namei.c=4315=static int may_o_create(struct mnt_idmap idmap,\n--\nfs/namei.c-4330-\nfs/namei.c:4331:\treturn security_inode_create(idmap, dir-\u003edentry-\u003ed_inode, dentry, mode);\nfs/namei.c-4332-}\n--\ninclude/linux/security.h=404=int security_inode_init_security_anon(struct inode inode,\n--\ninclude/linux/security.h-406-\t\t\t\t const struct inode context_inode);\ninclude/linux/security.h:407:int security_inode_create(struct mnt_idmap idmap, struct inode dir,\ninclude/linux/security.h-408-\t\t\t struct dentry dentry, umode_t mode);\n--\ninclude/linux/security.h=902=static inline int security_inode_init_security_anon(struct inode inode,\n--\ninclude/linux/security.h-908-\ninclude/linux/security.h:909:static inline int security_inode_create(struct mnt_idmap idmap,\ninclude/linux/security.h-910-\t\t\t\t\tstruct inode dir,\n--\nsecurity/security.c=1609=int security_path_chroot(const struct path path)\n--\nsecurity/security.c-1615-/*\nsecurity/security.c:1616: security_inode_create() - Check if creating a file is allowed\nsecurity/security.c-1617- * @idmap: idmap of the mount\n--\nsecurity/security.c-1625- /\nsecurity/security.c:1626:int security_inode_create(struct mnt_idmap idmap, struct inode dir,\nsecurity/security.c-1627-\t\t\t struct dentry dentry, umode_t mode)\n--\nsecurity/security.c-1632-}\nsecurity/security.c:1633:EXPORT_SYMBOL_GPL(security_inode_create);\nsecurity/security.c-1634-\n" }
19/3	2026/09/02 02:09	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 15420 output: 25 thoughts: 84 Thoughts: My Security-Focused Review Okay, time to methodically dig into this security aspect. I need to refresh my understanding of how this particular system handles inode permissions and creation. My focus right now is on the core security mechanisms. First, I'm going to quickly audit the standard LSM hooks that are likely involved: specifically, `security_inode_permission`, `security_inode_link`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_symlink`. That seems like a good starting point. But I also need to think more broadly. Are there any other LSM implementations active on this system? I need to be aware of potentially conflicting or overlapping behaviors from things like AppArmor, Landlock, Tomoyo, or any other custom LSMs that might have been deployed. That's critical. I'm going to search across the other LSMs for relevant hooks, focusing on `inode_permission` or `inode_create`. Finding the intersection of these implementations is the key to understanding the full security picture here. I can't afford to miss a single layer.
20/3	2026/09/02 02:09	tool	grepper	0m Args: { "Expression": "inode_permission", "PathPrefix": "security/" } Results: { "Output": "security/security.c=1225=static void inode_free_by_rcu(struct rcu_head head)\n--\nsecurity/security.c-1241- security_inode_free(), @inode may still be referenced in a VFS path walk\nsecurity/security.c:1242: * and calls to security_inode_permission() may be made during, or after,\nsecurity/security.c-1243- * a call to security_inode_free(). For this reason the inode-\u003ei_security\nsecurity/security.c-1244- * field is released via a call_rcu() callback and any LSMs which need to\nsecurity/security.c:1245: * retain inode state for use in security_inode_permission() should only\nsecurity/security.c-1246- * release that state in the inode_free_security_rcu() LSM hook callback.\n--\nsecurity/security.c=1822=int security_inode_follow_link(struct dentry dentry, struct inode inode,\n--\nsecurity/security.c-1830-/*\nsecurity/security.c:1831: security_inode_permission() - Check if accessing an inode is allowed\nsecurity/security.c-1832- * @idmap: idmap of the mount\n--\nsecurity/security.c-1844- /\nsecurity/security.c:1845:int security_inode_permission(struct mnt_idmap idmap, struct inode inode,\nsecurity/security.c-1846-\t\t\t int mask)\n--\nsecurity/security.c-1849-\t\treturn 0;\nsecurity/security.c:1850:\treturn call_int_hook(inode_permission, idmap, inode, mask);\nsecurity/security.c-1851-}\n--\nsecurity/security.c=2727=int security_file_receive(struct file file)\n--\nsecurity/security.c-2736- * Save open-time permission checking state for later use upon file_permission,\nsecurity/security.c:2737: * and recheck access if anything has changed since inode_permission.\nsecurity/security.c-2738- \n--\nsecurity/selinux/hooks.c=3130=static int selinux_inode_follow_link(struct dentry dentry, struct inode inode,\n--\nsecurity/selinux/hooks.c-3145-\nsecurity/selinux/hooks.c:3146:static noinline int audit_inode_permission(struct inode inode,\nsecurity/selinux/hooks.c-3147-\t\t\t\t\t u32 perms, u32 audited, u32 denied,\n--\nsecurity/selinux/hooks.c=3223=static inline void task_avdcache_update(struct task_security_struct tsec,\n--\nsecurity/selinux/hooks.c-3242-/\nsecurity/selinux/hooks.c:3243: selinux_inode_permission - Check if the current task can access an inode\nsecurity/selinux/hooks.c-3244- * @idmap: idmap of the mount\n--\nsecurity/selinux/hooks.c-3250- /\nsecurity/selinux/hooks.c:3251:static int selinux_inode_permission(struct mnt_idmap idmap,\nsecurity/selinux/hooks.c-3252-\t\t\t\t struct inode inode, int requested)\n--\nsecurity/selinux/hooks.c-3299-\nsecurity/selinux/hooks.c:3300:\trc2 = audit_inode_permission(inode, perms, audited, denied, rc);\nsecurity/selinux/hooks.c-3301-\tif (rc2)\n--\nsecurity/selinux/hooks.c=4263=static int selinux_file_open(struct file file)\n--\nsecurity/selinux/hooks.c-4280-\t * Since the inode label or policy seqno may have changed\nsecurity/selinux/hooks.c:4281:\t * between the selinux_inode_permission check and the saving\nsecurity/selinux/hooks.c-4282-\t * of state above, recheck that access is still permitted.\n--\nsecurity/selinux/hooks.c=7567=static struct security_hook_list selinux_hooks[] __ro_after_init = {\n--\nsecurity/selinux/hooks.c-7617-\tLSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),\nsecurity/selinux/hooks.c:7618:\tLSM_HOOK_INIT(inode_permission, selinux_inode_permission),\nsecurity/selinux/hooks.c-7619-\tLSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),\n--\nsecurity/smack/smack_lsm.c=1020=static int smack_inode_init_security(struct inode inode, struct inode dir,\n--\nsecurity/smack/smack_lsm.c-1033-\t * UNIX domain sockets use lower level socket data. Let\nsecurity/smack/smack_lsm.c:1034:\t * UDS inode have fixed * label to keep smack_inode_permission() calm\nsecurity/smack/smack_lsm.c-1035-\t * when called from unix_find_bsd()\n--\nsecurity/smack/smack_lsm.c=1203=static int smack_inode_rename(struct inode old_inode,\n--\nsecurity/smack/smack_lsm.c-1228-/\nsecurity/smack/smack_lsm.c:1229: smack_inode_permission - Smack version of permission()\nsecurity/smack/smack_lsm.c-1230- * @idmap: idmap of the mount\n--\nsecurity/smack/smack_lsm.c-1237- /\nsecurity/smack/smack_lsm.c:1238:static int smack_inode_permission(struct mnt_idmap idmap, struct inode *inode,\nsecurity/smack/smack_lsm.c-1239-\t\t\t\t int mask)\n--\nsecurity/smack/smack_lsm.c=5158=static struct security_hook_list smack_hooks[] __ro_after_init = {\n--\nsecurity/smack/smack_lsm.c-5180-\tLSM_HOOK_INIT(inode_rename, smack_inode_rename),\nsecurity/smack/smack_lsm.c:5181:\tLSM_HOOK_INIT(inode_permission, smack_inode_permission),\nsecurity/smack/smack_lsm.c-5182-\tLSM_HOOK_INIT(inode_setattr, smack_inode_setattr),\n" }
21/3	2026/09/02 02:09	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 17497 output: 204 thoughts: 709 Thoughts: KMSAN Assessment: No Need for Dedicated Fuzzing Alright, let's break this down. My initial assessment is that this patch is a refactor, primarily concerning the propagation of the `struct mnt_idmap idmap` through several inode LSM hooks and their corresponding callers. My thought process is clear: First, the patch modifies the signatures of the inode LSM hooks—`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`—to include the `idmap` parameter. The VFS callers in `fs/namei.c` and `fs/cachefiles/security.c` are updated to correctly pass the `idmap` (or `&nop_mnt_idmap`) into the relevant security wrappers. This change also extends to implementations such as SELinux, Smack and LSM BPF which also update to accommodate the new parameter. I've got to consider if any uninitialized memory risks are involved, so I go through a mental checklist: 1. Kernel-to-userspace data transfer:* Nothing new is exposed or copied to userspace. No changes to `copy_to_user`, `put_user`, netlink, or ioctl are happening here. 2. Conditional logic and uninitialized variables: The `idmap` pointer being passed around is a valid pointer originating from VFS callers, or the safe `&nop_mnt_idmap`. I'm not seeing any scenarios where conditional logic depends on an uninitialized variable. 3. Complex data structure allocation and initialization: No new allocations or complex data structure initializations are introduced in the kernel's code path. 4. Bounds checks or other logic that could expose uninitialized memory: There's no manipulation of memory, bounds checks, or logic that would allow reading uninitialized memory. Based on this, KMSAN is unlikely to identify any issues. This is because the patch is primarily changing function signatures to propagate an existing parameter, not introducing new memory access patterns that KMSAN excels at catching. Any potential issues would likely manifest as null pointer dereferences or incorrect pointers which are types of memory errors that KASAN (Kernel Address Sanitizer) is well-equipped to detect. KMSAN is great for catching uninitialized memory access, which isn't present here. Therefore, the `NeedsKMSAN` flag is `false`. Now, I'll solidify the reasoning: * The patch's core function is extending LSM hooks with the `struct mnt_idmap idmap` parameter. No new memory allocations, heap/stack buffers, or uninitialized variables are introduced. * No kernel-to-user memory copy operations or interactions are modified or added. * The change is about plumbing an existing pointer (`idmap` / `&nop_mnt_idmap`). * Any potential bugs would likely be pointer-related, and standard KASAN and kernel fault handling would catch them. * Thus, there's no risk of uninitialized memory issues or information leaks, and no dedicated KMSAN fuzzing is necessary. I'm satisfied with this analysis, and now I'll call the `set-results` tool.
22/3	2026/09/02 02:09	tool	set-results	0m Args: { "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.", "NeedsKMSAN": false } Results:* { "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap *idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.", "NeedsKMSAN": false }

{
  "EnableConfigs": [
    "SECURITY",
    "BPF_LSM",
    "SECURITY_SELINUX",
    "SECURITY_SMACK",
    "CACHEFILES"
  ],
  "FocusSymbols": [
    "security_inode_create",
    "security_inode_link",
    "security_inode_symlink",
    "security_inode_mkdir",
    "security_inode_mknod",
    "security_inode_permission"
  ],
  "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap *idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap *idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit e9c28218b2d5e57d772a682e02a587bfa3470b48\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Sep 2 02:08:49 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c\nindex fc6611886b3b5..eefe5453b904e 100644\n--- a/fs/cachefiles/security.c\n+++ b/fs/cachefiles/security.c\n@@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,\n {\n \tint ret;\n \n-\tret = security_inode_mkdir(d_backing_inode(root), root, 0);\n+\tret = security_inode_mkdir(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\n \tif (ret \u003c 0) {\n \t\tpr_err(\"Security denies permission to make dirs: error %d\",\n \t\t       ret);\n \t\treturn ret;\n \t}\n \n-\tret = security_inode_create(d_backing_inode(root), root, 0);\n+\tret = security_inode_create(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\n \tif (ret \u003c 0)\n \t\tpr_err(\"Security denies permission to create files: error %d\",\n \t\t       ret);\ndiff --git a/fs/namei.c b/fs/namei.c\nindex 20a6534ea3eff..99f894f3f7e13 100644\n--- a/fs/namei.c\n+++ b/fs/namei.c\n@@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap *idmap,\n \tif (unlikely(retval))\n \t\treturn retval;\n \n-\treturn security_inode_permission(inode, mask);\n+\treturn security_inode_permission(idmap, inode, mask);\n }\n EXPORT_SYMBOL(inode_permission);\n \n@@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap *id\n \tif (unlikely(((inode-\u003ei_mode \u0026 0111) != 0111) || !no_acl_inode(inode)))\n \t\treturn inode_permission(idmap, inode, mask);\n \n-\treturn security_inode_permission(inode, mask);\n+\treturn security_inode_permission(idmap, inode, mask);\n }\n \n /**\n@@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap *idmap, struct dentry *dentry, umode_t mode,\n \t\treturn -EACCES;\t/* shouldn't it be ENOSYS? */\n \n \tmode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);\n-\terror = security_inode_create(dir, dentry, mode);\n+\terror = security_inode_create(idmap, dir, dentry, mode);\n \tif (error)\n \t\treturn error;\n \terror = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di);\n@@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry *dentry, umode_t mode,\n \n \tmode \u0026= S_IALLUGO;\n \tmode |= S_IFREG;\n-\terror = security_inode_create(dir, dentry, mode);\n+\terror = security_inode_create(\u0026nop_mnt_idmap, dir, dentry, mode);\n \tif (error)\n \t\treturn error;\n \terror = f(dentry, mode, arg);\n@@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap *idmap,\n \tif (error)\n \t\treturn error;\n \n-\treturn security_inode_create(dir-\u003edentry-\u003ed_inode, dentry, mode);\n+\treturn security_inode_create(idmap, dir-\u003edentry-\u003ed_inode, dentry, mode);\n }\n \n /**\n@@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir,\n \tif (error)\n \t\treturn error;\n \n-\terror = security_inode_mknod(dir, dentry, mode, dev);\n+\terror = security_inode_mknod(idmap, dir, dentry, mode, dev);\n \tif (error)\n \t\treturn error;\n \n@@ -5395,7 +5395,7 @@ struct dentry *vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,\n \t\tgoto err;\n \n \tmode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, S_IFDIR);\n-\terror = security_inode_mkdir(dir, dentry, mode);\n+\terror = security_inode_mkdir(idmap, dir, dentry, mode);\n \tif (error)\n \t\tgoto err;\n \n@@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,\n \tif (!dir-\u003ei_op-\u003esymlink)\n \t\treturn -EPERM;\n \n-\terror = security_inode_symlink(dir, dentry, oldname);\n+\terror = security_inode_symlink(idmap, dir, dentry, oldname);\n \tif (error)\n \t\treturn error;\n \n@@ -5907,7 +5907,7 @@ int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap,\n \tif (S_ISDIR(inode-\u003ei_mode))\n \t\treturn -EPERM;\n \n-\terror = security_inode_link(old_dentry, dir, new_dentry);\n+\terror = security_inode_link(idmap, old_dentry, dir, new_dentry);\n \tif (error)\n \t\treturn error;\n \ndiff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h\nindex 65c9609ec2077..9e49a5bc9ff3c 100644\n--- a/include/linux/lsm_hook_defs.h\n+++ b/include/linux/lsm_hook_defs.h\n@@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,\n \t int *xattr_count)\n LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,\n \t const struct qstr *name, const struct inode *context_inode)\n-LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,\n-\t umode_t mode)\n+LSM_HOOK(int, 0, inode_create, struct mnt_idmap *idmap, struct inode *dir,\n+\t struct dentry *dentry, umode_t mode)\n LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,\n \t struct inode *inode)\n-LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,\n-\t struct dentry *new_dentry)\n+LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap,\n+\t struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)\n LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)\n-LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,\n-\t const char *old_name)\n-LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,\n-\t umode_t mode)\n+LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir,\n+\t struct dentry *dentry, const char *old_name)\n+LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,\n+\t struct dentry *dentry, umode_t mode)\n LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)\n-LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,\n-\t umode_t mode, dev_t dev)\n+LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir,\n+\t struct dentry *dentry, umode_t mode, dev_t dev)\n LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,\n \t struct inode *new_dir, struct dentry *new_dentry)\n LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)\n LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,\n \t bool rcu)\n-LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)\n+LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,\n+\t struct inode *inode, int mask)\n LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,\n \t struct iattr *attr)\n LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,\ndiff --git a/include/linux/security.h b/include/linux/security.h\nindex 153e9043058f8..0f5f20ac10507 100644\n--- a/include/linux/security.h\n+++ b/include/linux/security.h\n@@ -404,24 +404,28 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,\n int security_inode_init_security_anon(struct inode *inode,\n \t\t\t\t      const struct qstr *name,\n \t\t\t\t      const struct inode *context_inode);\n-int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);\n+int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t  struct dentry *dentry, umode_t mode);\n void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,\n \t\t\t\t\tstruct inode *inode);\n-int security_inode_link(struct dentry *old_dentry, struct inode *dir,\n-\t\t\t struct dentry *new_dentry);\n+int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,\n+\t\t\tstruct inode *dir, struct dentry *new_dentry);\n int security_inode_unlink(struct inode *dir, struct dentry *dentry);\n-int security_inode_symlink(struct inode *dir, struct dentry *dentry,\n-\t\t\t   const char *old_name);\n-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);\n+int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t   struct dentry *dentry, const char *old_name);\n+int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t struct dentry *dentry, umode_t mode);\n int security_inode_rmdir(struct inode *dir, struct dentry *dentry);\n-int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);\n+int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t struct dentry *dentry, umode_t mode, dev_t dev);\n int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,\n \t\t\t  struct inode *new_dir, struct dentry *new_dentry,\n \t\t\t  unsigned int flags);\n int security_inode_readlink(struct dentry *dentry);\n int security_inode_follow_link(struct dentry *dentry, struct inode *inode,\n \t\t\t       bool rcu);\n-int security_inode_permission(struct inode *inode, int mask);\n+int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\n+\t\t\t      int mask);\n int security_inode_setattr(struct mnt_idmap *idmap,\n \t\t\t   struct dentry *dentry, struct iattr *attr);\n void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,\n@@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode *inode,\n \treturn 0;\n }\n \n-static inline int security_inode_create(struct inode *dir,\n-\t\t\t\t\t struct dentry *dentry,\n-\t\t\t\t\t umode_t mode)\n+static inline int security_inode_create(struct mnt_idmap *idmap,\n+\t\t\t\t\tstruct inode *dir,\n+\t\t\t\t\tstruct dentry *dentry,\n+\t\t\t\t\tumode_t mode)\n {\n \treturn 0;\n }\n@@ -913,9 +918,10 @@ static inline void\n security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)\n { }\n \n-static inline int security_inode_link(struct dentry *old_dentry,\n-\t\t\t\t       struct inode *dir,\n-\t\t\t\t       struct dentry *new_dentry)\n+static inline int security_inode_link(struct mnt_idmap *idmap,\n+\t\t\t\t      struct dentry *old_dentry,\n+\t\t\t\t      struct inode *dir,\n+\t\t\t\t      struct dentry *new_dentry)\n {\n \treturn 0;\n }\n@@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode *dir,\n \treturn 0;\n }\n \n-static inline int security_inode_symlink(struct inode *dir,\n-\t\t\t\t\t  struct dentry *dentry,\n-\t\t\t\t\t  const char *old_name)\n+static inline int security_inode_symlink(struct mnt_idmap *idmap,\n+\t\t\t\t\t struct inode *dir,\n+\t\t\t\t\t struct dentry *dentry,\n+\t\t\t\t\t const char *old_name)\n {\n \treturn 0;\n }\n \n-static inline int security_inode_mkdir(struct inode *dir,\n-\t\t\t\t\tstruct dentry *dentry,\n-\t\t\t\t\tint mode)\n+static inline int security_inode_mkdir(struct mnt_idmap *idmap,\n+\t\t\t\t       struct inode *dir,\n+\t\t\t\t       struct dentry *dentry,\n+\t\t\t\t       int mode)\n {\n \treturn 0;\n }\n@@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode *dir,\n \treturn 0;\n }\n \n-static inline int security_inode_mknod(struct inode *dir,\n-\t\t\t\t\tstruct dentry *dentry,\n-\t\t\t\t\tint mode, dev_t dev)\n+static inline int security_inode_mknod(struct mnt_idmap *idmap,\n+\t\t\t\t       struct inode *dir,\n+\t\t\t\t       struct dentry *dentry,\n+\t\t\t\t       int mode, dev_t dev)\n {\n \treturn 0;\n }\n@@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry *dentry,\n \treturn 0;\n }\n \n-static inline int security_inode_permission(struct inode *inode, int mask)\n+static inline int security_inode_permission(struct mnt_idmap *idmap,\n+\t\t\t\t\t    struct inode *inode, int mask)\n {\n \treturn 0;\n }\ndiff --git a/security/security.c b/security/security.c\nindex 2ee276ab15c5b..a9190da3341dd 100644\n--- a/security/security.c\n+++ b/security/security.c\n@@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path *path)\n \n /**\n  * security_inode_create() - Check if creating a file is allowed\n+ * @idmap: idmap of the mount\n  * @dir: the parent directory\n  * @dentry: the file being created\n  * @mode: requested file mode\n@@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path *path)\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_inode_create(struct inode *dir, struct dentry *dentry,\n-\t\t\t  umode_t mode)\n+int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t  struct dentry *dentry, umode_t mode)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_create, dir, dentry, mode);\n+\treturn call_int_hook(inode_create, idmap, dir, dentry, mode);\n }\n EXPORT_SYMBOL_GPL(security_inode_create);\n \n@@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,\n \n /**\n  * security_inode_link() - Check if creating a hard link is allowed\n+ * @idmap: idmap of the mount\n  * @old_dentry: existing file\n  * @dir: new parent directory\n  * @new_dentry: new link\n@@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_inode_link(struct dentry *old_dentry, struct inode *dir,\n-\t\t\tstruct dentry *new_dentry)\n+int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,\n+\t\t\tstruct inode *dir, struct dentry *new_dentry)\n {\n \tif (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))\n \t\treturn 0;\n-\treturn call_int_hook(inode_link, old_dentry, dir, new_dentry);\n+\treturn call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry);\n }\n \n /**\n@@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry)\n \n /**\n  * security_inode_symlink() - Check if creating a symbolic link is allowed\n+ * @idmap: idmap of the mount\n  * @dir: parent directory\n  * @dentry: symbolic link\n  * @old_name: existing filename\n@@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry)\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_inode_symlink(struct inode *dir, struct dentry *dentry,\n-\t\t\t   const char *old_name)\n+int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t   struct dentry *dentry, const char *old_name)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_symlink, dir, dentry, old_name);\n+\treturn call_int_hook(inode_symlink, idmap, dir, dentry, old_name);\n }\n \n /**\n  * security_inode_mkdir() - Check if creating a new directory is allowed\n+ * @idmap: idmap of the mount\n  * @dir: parent directory\n  * @dentry: new directory\n  * @mode: new directory mode\n@@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode *dir, struct dentry *dentry,\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)\n+int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t struct dentry *dentry, umode_t mode)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_mkdir, dir, dentry, mode);\n+\treturn call_int_hook(inode_mkdir, idmap, dir, dentry, mode);\n }\n EXPORT_SYMBOL_GPL(security_inode_mkdir);\n \n@@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)\n \n /**\n  * security_inode_mknod() - Check if creating a special file is allowed\n+ * @idmap: idmap of the mount\n  * @dir: parent directory\n  * @dentry: new file\n  * @mode: new file mode\n@@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_inode_mknod(struct inode *dir, struct dentry *dentry,\n-\t\t\t umode_t mode, dev_t dev)\n+int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t struct dentry *dentry, umode_t mode, dev_t dev)\n {\n \tif (unlikely(IS_PRIVATE(dir)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_mknod, dir, dentry, mode, dev);\n+\treturn call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev);\n }\n \n /**\n@@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,\n \n /**\n  * security_inode_permission() - Check if accessing an inode is allowed\n+ * @idmap: idmap of the mount\n  * @inode: inode\n  * @mask: access mask\n  *\n@@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,\n  *\n  * Return: Returns 0 if permission is granted.\n  */\n-int security_inode_permission(struct inode *inode, int mask)\n+int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\n+\t\t\t      int mask)\n {\n \tif (unlikely(IS_PRIVATE(inode)))\n \t\treturn 0;\n-\treturn call_int_hook(inode_permission, inode, mask);\n+\treturn call_int_hook(inode_permission, idmap, inode, mask);\n }\n \n /**\ndiff --git a/security/selinux/hooks.c b/security/selinux/hooks.c\nindex 035aaf113d1da..967984d0af300 100644\n--- a/security/selinux/hooks.c\n+++ b/security/selinux/hooks.c\n@@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode *inode,\n \t\t\t    \u0026ad);\n }\n \n-static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)\n+static int selinux_inode_create(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t\tstruct dentry *dentry, umode_t mode)\n {\n \treturn may_create(dir, dentry, SECCLASS_FILE);\n }\n \n-static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)\n+static int selinux_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,\n+\t\t\t      struct inode *dir, struct dentry *new_dentry)\n {\n \treturn may_link(dir, old_dentry, MAY_LINK);\n }\n@@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)\n \treturn may_link(dir, dentry, MAY_UNLINK);\n }\n \n-static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)\n+static int selinux_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t\t struct dentry *dentry, const char *name)\n {\n \treturn may_create(dir, dentry, SECCLASS_LNK_FILE);\n }\n \n-static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)\n+static int selinux_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t       struct dentry *dentry, umode_t mask)\n {\n \treturn may_create(dir, dentry, SECCLASS_DIR);\n }\n@@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)\n \treturn may_link(dir, dentry, MAY_RMDIR);\n }\n \n-static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)\n+static int selinux_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,\n+\t\t\t       struct dentry *dentry, umode_t mode, dev_t dev)\n {\n \treturn may_create(dir, dentry, inode_mode_to_security_class(mode));\n }\n@@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct *tsec,\n \n /**\n  * selinux_inode_permission - Check if the current task can access an inode\n+ * @idmap: idmap of the mount\n  * @inode: the inode that is being accessed\n  * @requested: the accesses being requested\n  *\n  * Check if the current task is allowed to access @inode according to\n  * @requested.  Returns 0 if allowed, negative values otherwise.\n  */\n-static int selinux_inode_permission(struct inode *inode, int requested)\n+static int selinux_inode_permission(struct mnt_idmap *idmap,\n+\t\t\t\t    struct inode *inode, int requested)\n {\n \tint mask;\n \tu32 perms;\ndiff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c\nindex 8e88ac65fd7fc..a45819d13c0d6 100644\n--- a/security/smack/smack_lsm.c\n+++ b/security/smack/smack_lsm.c\n@@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,\n \n /**\n  * smack_inode_link - Smack check on link\n+ * @idmap: idmap of the mount\n  * @old_dentry: the existing object\n  * @dir: unused\n  * @new_dentry: the new object\n  *\n  * Returns 0 if access is permitted, an error code otherwise\n  */\n-static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,\n-\t\t\t    struct dentry *new_dentry)\n+static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,\n+\t\t\t    struct inode *dir, struct dentry *new_dentry)\n {\n \tstruct smack_known *isp;\n \tstruct smk_audit_info ad;\n@@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,\n \n /**\n  * smack_inode_permission - Smack version of permission()\n+ * @idmap: idmap of the mount\n  * @inode: the inode in question\n  * @mask: the access requested\n  *\n@@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,\n  *\n  * Returns 0 if access is permitted, an error code otherwise\n  */\n-static int smack_inode_permission(struct inode *inode, int mask)\n+static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\n+\t\t\t\t  int mask)\n {\n \tstruct superblock_smack *sbsp = smack_superblock(inode-\u003ei_sb);\n \tstruct smk_audit_info ad;\ndiff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c\nindex d7495efd4a562..c0ae813698ae2 100644\n--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c\n+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c\n@@ -1,18 +1,30 @@\n // SPDX-License-Identifier: GPL-2.0\n+#define _GNU_SOURCE\n \n /*\n  * Copyright (C) 2020 Google LLC.\n  */\n \n #include \u003ctest_progs.h\u003e\n+#include \u003csched.h\u003e\n+#include \u003csignal.h\u003e\n+#include \u003cstring.h\u003e\n+#include \u003csys/stat.h\u003e\n+#include \u003csys/syscall.h\u003e\n #include \u003csys/wait.h\u003e\n #include \u003cunistd.h\u003e\n \n+#include \u003clinux/mount.h\u003e\n+\n #include \"lsm.skel.h\"\n #include \"lsm_tailcall.skel.h\"\n \n char *CMD_ARGS[] = {\"true\", NULL};\n \n+enum {\n+\tINODE_IDMAP_ALL = (1U \u003c\u003c 6) - 1,\n+};\n+\n int exec_cmd(int *monitored_pid)\n {\n \tint child_pid, child_status;\n@@ -30,6 +42,219 @@ int exec_cmd(int *monitored_pid)\n \treturn -EINVAL;\n }\n \n+static ssize_t write_nointr(int fd, const void *buf, size_t count)\n+{\n+\tssize_t ret;\n+\n+\tdo {\n+\t\tret = write(fd, buf, count);\n+\t} while (ret \u003c 0 \u0026\u0026 errno == EINTR);\n+\n+\treturn ret;\n+}\n+\n+static int write_file(const char *path, const char *value)\n+{\n+\tsize_t len = strlen(value);\n+\tint fd, saved_errno = 0;\n+\tssize_t ret;\n+\n+\tfd = open(path, O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW);\n+\tif (fd \u003c 0)\n+\t\treturn -1;\n+\n+\tret = write_nointr(fd, value, len);\n+\tif (ret \u003c 0)\n+\t\tsaved_errno = errno;\n+\telse if ((size_t)ret != len)\n+\t\tsaved_errno = EIO;\n+\tclose(fd);\n+\tif (saved_errno) {\n+\t\terrno = saved_errno;\n+\t\treturn -1;\n+\t}\n+\treturn 0;\n+}\n+\n+static int write_userns_file(pid_t pid, const char *name, const char *value)\n+{\n+\tchar path[64];\n+\tint len;\n+\n+\tlen = snprintf(path, sizeof(path), \"/proc/%d/%s\", pid, name);\n+\tif (len \u003c 0 || (size_t)len \u003e= sizeof(path)) {\n+\t\terrno = EOVERFLOW;\n+\t\treturn -1;\n+\t}\n+\n+\treturn write_file(path, value);\n+}\n+\n+static int create_userns_fd(void)\n+{\n+\tchar path[64];\n+\tpid_t pid, waited;\n+\tint fd = -1, len, saved_errno, status;\n+\n+\tpid = fork();\n+\tif (pid \u003c 0)\n+\t\treturn -1;\n+\tif (pid == 0) {\n+\t\tif (unshare(CLONE_NEWUSER))\n+\t\t\t_exit(1);\n+\t\traise(SIGSTOP);\n+\t\t_exit(0);\n+\t}\n+\n+\tdo {\n+\t\twaited = waitpid(pid, \u0026status, WUNTRACED);\n+\t} while (waited \u003c 0 \u0026\u0026 errno == EINTR);\n+\tif (waited != pid)\n+\t\tgoto out;\n+\tif (!WIFSTOPPED(status)) {\n+\t\tpid = -1;\n+\t\tgoto out;\n+\t}\n+\n+\t/* A one-entry map is identity for root but remains distinct from nop_mnt_idmap. */\n+\tif (write_userns_file(pid, \"setgroups\", \"deny\") \u0026\u0026 errno != ENOENT)\n+\t\tgoto out;\n+\tif (write_userns_file(pid, \"uid_map\", \"0 0 1\") ||\n+\t    write_userns_file(pid, \"gid_map\", \"0 0 1\"))\n+\t\tgoto out;\n+\n+\tlen = snprintf(path, sizeof(path), \"/proc/%d/ns/user\", pid);\n+\tif (len \u003c 0 || (size_t)len \u003e= sizeof(path)) {\n+\t\terrno = EOVERFLOW;\n+\t\tgoto out;\n+\t}\n+\tfd = open(path, O_RDONLY | O_CLOEXEC);\n+\n+out:\n+\tsaved_errno = errno;\n+\tif (pid \u003e 0) {\n+\t\tkill(pid, SIGKILL);\n+\t\tdo {\n+\t\t\twaited = waitpid(pid, NULL, 0);\n+\t\t} while (waited \u003c 0 \u0026\u0026 errno == EINTR);\n+\t}\n+\terrno = saved_errno;\n+\treturn fd;\n+}\n+\n+static int create_idmapped_tmpfs(void)\n+{\n+\tstruct mount_attr attr = {\n+\t\t.attr_set = MOUNT_ATTR_IDMAP,\n+\t};\n+\tint fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1;\n+\n+\tuserns_fd = create_userns_fd();\n+\tif (userns_fd \u003c 0)\n+\t\tgoto out;\n+\n+\t/* A detached tmpfs avoids relying on the host test directory supporting idmaps. */\n+\tfsfd = syscall(__NR_fsopen, \"tmpfs\", FSOPEN_CLOEXEC);\n+\tif (fsfd \u003c 0)\n+\t\tgoto out;\n+\tif (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0))\n+\t\tgoto out;\n+\n+\tmntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0);\n+\tif (mntfd \u003c 0)\n+\t\tgoto out;\n+\n+\tattr.userns_fd = userns_fd;\n+\tif (syscall(__NR_mount_setattr, mntfd, \"\", AT_EMPTY_PATH, \u0026attr,\n+\t\t    sizeof(attr))) {\n+\t\tclose(mntfd);\n+\t\tmntfd = -1;\n+\t}\n+\n+out:\n+\tsaved_errno = errno;\n+\tif (fsfd \u003e= 0)\n+\t\tclose(fsfd);\n+\tif (userns_fd \u003e= 0)\n+\t\tclose(userns_fd);\n+\terrno = saved_errno;\n+\treturn mntfd;\n+}\n+\n+static int exercise_inode_idmap_hooks(int dirfd)\n+{\n+\tint fd = -1, ret = -1;\n+\n+\tfd = openat(dirfd, \"file\", O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC,\n+\t\t    0600);\n+\tif (!ASSERT_GE(fd, 0, \"create\"))\n+\t\tgoto out;\n+\tclose(fd);\n+\tfd = -1;\n+\n+\tif (!ASSERT_OK(mkdirat(dirfd, \"dir\", 0700), \"mkdir\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(symlinkat(\"target\", dirfd, \"symlink\"), \"symlink\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(linkat(dirfd, \"file\", dirfd, \"link\", 0), \"link\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(mkfifoat(dirfd, \"fifo\", 0600), \"mknod\"))\n+\t\tgoto out;\n+\n+\tret = 0;\n+out:\n+\tif (fd \u003e= 0)\n+\t\tclose(fd);\n+\tunlinkat(dirfd, \"link\", 0);\n+\tunlinkat(dirfd, \"fifo\", 0);\n+\tunlinkat(dirfd, \"symlink\", 0);\n+\tunlinkat(dirfd, \"file\", 0);\n+\tunlinkat(dirfd, \"dir\", AT_REMOVEDIR);\n+\treturn ret;\n+}\n+\n+static int test_lsm_inode_idmap(struct lsm *skel)\n+{\n+\tchar tmpdir[] = \"/var/tmp/test_lsm_idmap.XXXXXX\";\n+\t__u32 expected = INODE_IDMAP_ALL;\n+\tint dirfd = -1, idmapped_dirfd = -1;\n+\tint ret = -1;\n+\n+\tif (!ASSERT_OK_PTR(mkdtemp(tmpdir), \"mkdtemp\"))\n+\t\treturn -1;\n+\n+\tdirfd = open(tmpdir, O_RDONLY | O_DIRECTORY | O_CLOEXEC);\n+\tif (!ASSERT_GE(dirfd, 0, \"open_tmpdir\"))\n+\t\tgoto out;\n+\n+\tidmapped_dirfd = create_idmapped_tmpfs();\n+\tif (!ASSERT_GE(idmapped_dirfd, 0, \"create_idmapped_tmpfs\"))\n+\t\tgoto out;\n+\n+\tskel-\u003ebss-\u003einode_identity_idmap_seen = 0;\n+\tskel-\u003ebss-\u003einode_idmapped_mount_seen = 0;\n+\n+\tif (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), \"identity_idmap\"))\n+\t\tgoto out;\n+\tif (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd),\n+\t\t       \"idmapped_mount\"))\n+\t\tgoto out;\n+\n+\tif (!ASSERT_EQ(skel-\u003ebss-\u003einode_identity_idmap_seen, expected,\n+\t\t       \"inode_identity_idmap_seen\"))\n+\t\tgoto out;\n+\tret = ASSERT_EQ(skel-\u003ebss-\u003einode_idmapped_mount_seen, expected,\n+\t\t\t\"inode_idmapped_mount_seen\") ? 0 : -1;\n+\n+out:\n+\tif (idmapped_dirfd \u003e= 0)\n+\t\tclose(idmapped_dirfd);\n+\tif (dirfd \u003e= 0)\n+\t\tclose(dirfd);\n+\trmdir(tmpdir);\n+\treturn ret;\n+}\n+\n static int test_lsm(struct lsm *skel)\n {\n \tstruct bpf_link *link;\n@@ -53,6 +278,10 @@ static int test_lsm(struct lsm *skel)\n \n \tskel-\u003ebss-\u003emonitored_pid = getpid();\n \n+\terr = test_lsm_inode_idmap(skel);\n+\tif (!ASSERT_OK(err, \"test_lsm_inode_idmap\"))\n+\t\treturn err;\n+\n \terr = stack_mprotect();\n \tif (!ASSERT_EQ(err, -1, \"stack_mprotect\") ||\n \t    !ASSERT_EQ(errno, EPERM, \"stack_mprotect\"))\n@@ -71,6 +300,8 @@ static int test_lsm(struct lsm *skel)\n \tskel-\u003ebss-\u003ecopy_test = 0;\n \tskel-\u003ebss-\u003ebprm_count = 0;\n \tskel-\u003ebss-\u003emprotect_count = 0;\n+\tskel-\u003ebss-\u003einode_identity_idmap_seen = 0;\n+\tskel-\u003ebss-\u003einode_idmapped_mount_seen = 0;\n \treturn 0;\n }\n \ndiff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c\nindex 7de173daf27b6..7e32fbddbfadf 100644\n--- a/tools/testing/selftests/bpf/progs/lsm.c\n+++ b/tools/testing/selftests/bpf/progs/lsm.c\n@@ -84,6 +84,85 @@ char _license[] SEC(\"license\") = \"GPL\";\n int monitored_pid = 0;\n int mprotect_count = 0;\n int bprm_count = 0;\n+__u32 inode_identity_idmap_seen = 0;\n+__u32 inode_idmapped_mount_seen = 0;\n+\n+enum {\n+\tINODE_IDMAP_CREATE\t= 1U \u003c\u003c 0,\n+\tINODE_IDMAP_LINK\t= 1U \u003c\u003c 1,\n+\tINODE_IDMAP_SYMLINK\t= 1U \u003c\u003c 2,\n+\tINODE_IDMAP_MKDIR\t= 1U \u003c\u003c 3,\n+\tINODE_IDMAP_MKNOD\t= 1U \u003c\u003c 4,\n+\tINODE_IDMAP_PERMISSION\t= 1U \u003c\u003c 5,\n+};\n+\n+static __always_inline bool is_monitored_idmap(struct mnt_idmap *idmap)\n+{\n+\t__u32 pid = bpf_get_current_pid_tgid() \u003e\u003e 32;\n+\n+\treturn monitored_pid == pid \u0026\u0026 idmap;\n+}\n+\n+static __always_inline bool is_identity_idmap(struct mnt_idmap *idmap)\n+{\n+\treturn idmap-\u003euid_map.nr_extents == 0 \u0026\u0026\n+\t       idmap-\u003egid_map.nr_extents == 0;\n+}\n+\n+static __always_inline int record_inode_idmap(struct mnt_idmap *idmap,\n+\t\t\t\t\t      __u32 hook, int ret)\n+{\n+\tif (ret || !is_monitored_idmap(idmap))\n+\t\treturn ret;\n+\tif (is_identity_idmap(idmap))\n+\t\tinode_identity_idmap_seen |= hook;\n+\telse\n+\t\tinode_idmapped_mount_seen |= hook;\n+\treturn 0;\n+}\n+\n+SEC(\"lsm/inode_create\")\n+int BPF_PROG(test_inode_create, struct mnt_idmap *idmap, struct inode *dir,\n+\t     struct dentry *dentry, umode_t mode, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret);\n+}\n+\n+SEC(\"lsm/inode_link\")\n+int BPF_PROG(test_inode_link, struct mnt_idmap *idmap,\n+\t     struct dentry *old_dentry, struct inode *dir,\n+\t     struct dentry *new_dentry, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_LINK, ret);\n+}\n+\n+SEC(\"lsm/inode_symlink\")\n+int BPF_PROG(test_inode_symlink, struct mnt_idmap *idmap, struct inode *dir,\n+\t     struct dentry *dentry, const char *old_name, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret);\n+}\n+\n+SEC(\"lsm/inode_mkdir\")\n+int BPF_PROG(test_inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,\n+\t     struct dentry *dentry, umode_t mode, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret);\n+}\n+\n+SEC(\"lsm/inode_mknod\")\n+int BPF_PROG(test_inode_mknod, struct mnt_idmap *idmap, struct inode *dir,\n+\t     struct dentry *dentry, umode_t mode, dev_t dev, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret);\n+}\n+\n+SEC(\"lsm/inode_permission\")\n+int BPF_PROG(test_inode_permission, struct mnt_idmap *idmap,\n+\t     struct inode *inode, int mask, int ret)\n+{\n+\treturn record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret);\n+}\n \n SEC(\"lsm/file_mprotect\")\n int BPF_PROG(test_int_hook, struct vm_area_struct *vma,\n"
}

{
  "EnableConfigs": [
    "SECURITY",
    "BPF_LSM",
    "SECURITY_SELINUX",
    "SECURITY_SMACK",
    "CACHEFILES"
  ],
  "FocusSymbols": [
    "security_inode_create",
    "security_inode_link",
    "security_inode_symlink",
    "security_inode_mkdir",
    "security_inode_mknod",
    "security_inode_permission"
  ],
  "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap *idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e9c28218b2d5e57d772a682e02a587bfa3470b48
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Sep 2 02:08:49 2026 +0000

    syz-cluster: applied patch under review

diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
index fc6611886b3b5..eefe5453b904e 100644
--- a/fs/cachefiles/security.c
+++ b/fs/cachefiles/security.c
@@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
 {
 	int ret;
 
-	ret = security_inode_mkdir(d_backing_inode(root), root, 0);
+	ret = security_inode_mkdir(&nop_mnt_idmap, d_backing_inode(root), root, 0);
 	if (ret < 0) {
 		pr_err("Security denies permission to make dirs: error %d",
 		       ret);
 		return ret;
 	}
 
-	ret = security_inode_create(d_backing_inode(root), root, 0);
+	ret = security_inode_create(&nop_mnt_idmap, d_backing_inode(root), root, 0);
 	if (ret < 0)
 		pr_err("Security denies permission to create files: error %d",
 		       ret);
diff --git a/fs/namei.c b/fs/namei.c
index 20a6534ea3eff..99f894f3f7e13 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap *idmap,
 	if (unlikely(retval))
 		return retval;
 
-	return security_inode_permission(inode, mask);
+	return security_inode_permission(idmap, inode, mask);
 }
 EXPORT_SYMBOL(inode_permission);
 
@@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap *id
 	if (unlikely(((inode->i_mode & 0111) != 0111) || !no_acl_inode(inode)))
 		return inode_permission(idmap, inode, mask);
 
-	return security_inode_permission(inode, mask);
+	return security_inode_permission(idmap, inode, mask);
 }
 
 /**
@@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap *idmap, struct dentry *dentry, umode_t mode,
 		return -EACCES;	/* shouldn't it be ENOSYS? */
 
 	mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);
-	error = security_inode_create(dir, dentry, mode);
+	error = security_inode_create(idmap, dir, dentry, mode);
 	if (error)
 		return error;
 	error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di);
@@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry *dentry, umode_t mode,
 
 	mode &= S_IALLUGO;
 	mode |= S_IFREG;
-	error = security_inode_create(dir, dentry, mode);
+	error = security_inode_create(&nop_mnt_idmap, dir, dentry, mode);
 	if (error)
 		return error;
 	error = f(dentry, mode, arg);
@@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap *idmap,
 	if (error)
 		return error;
 
-	return security_inode_create(dir->dentry->d_inode, dentry, mode);
+	return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode);
 }
 
 /**
@@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
 	if (error)
 		return error;
 
-	error = security_inode_mknod(dir, dentry, mode, dev);
+	error = security_inode_mknod(idmap, dir, dentry, mode, dev);
 	if (error)
 		return error;
 
@@ -5395,7 +5395,7 @@ struct dentry *vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
 		goto err;
 
 	mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, S_IFDIR);
-	error = security_inode_mkdir(dir, dentry, mode);
+	error = security_inode_mkdir(idmap, dir, dentry, mode);
 	if (error)
 		goto err;
 
@@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
 	if (!dir->i_op->symlink)
 		return -EPERM;
 
-	error = security_inode_symlink(dir, dentry, oldname);
+	error = security_inode_symlink(idmap, dir, dentry, oldname);
 	if (error)
 		return error;
 
@@ -5907,7 +5907,7 @@ int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap,
 	if (S_ISDIR(inode->i_mode))
 		return -EPERM;
 
-	error = security_inode_link(old_dentry, dir, new_dentry);
+	error = security_inode_link(idmap, old_dentry, dir, new_dentry);
 	if (error)
 		return error;
 
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 65c9609ec2077..9e49a5bc9ff3c 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
 	 int *xattr_count)
 LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
 	 const struct qstr *name, const struct inode *context_inode)
-LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
-	 umode_t mode)
+LSM_HOOK(int, 0, inode_create, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, umode_t mode)
 LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
 	 struct inode *inode)
-LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
-	 struct dentry *new_dentry)
+LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap,
+	 struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
 LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
-LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,
-	 const char *old_name)
-LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,
-	 umode_t mode)
+LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, const char *old_name)
+LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, umode_t mode)
 LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)
-LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,
-	 umode_t mode, dev_t dev)
+LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, umode_t mode, dev_t dev)
 LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,
 	 struct inode *new_dir, struct dentry *new_dentry)
 LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)
 LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
 	 bool rcu)
-LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
+LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,
+	 struct inode *inode, int mask)
 LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,
 	 struct iattr *attr)
 LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
diff --git a/include/linux/security.h b/include/linux/security.h
index 153e9043058f8..0f5f20ac10507 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -404,24 +404,28 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
 int security_inode_init_security_anon(struct inode *inode,
 				      const struct qstr *name,
 				      const struct inode *context_inode);
-int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
+int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+			  struct dentry *dentry, umode_t mode);
 void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
 					struct inode *inode);
-int security_inode_link(struct dentry *old_dentry, struct inode *dir,
-			 struct dentry *new_dentry);
+int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			struct inode *dir, struct dentry *new_dentry);
 int security_inode_unlink(struct inode *dir, struct dentry *dentry);
-int security_inode_symlink(struct inode *dir, struct dentry *dentry,
-			   const char *old_name);
-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
+int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+			   struct dentry *dentry, const char *old_name);
+int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode);
 int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
-int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
+int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode, dev_t dev);
 int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
 			  struct inode *new_dir, struct dentry *new_dentry,
 			  unsigned int flags);
 int security_inode_readlink(struct dentry *dentry);
 int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
 			       bool rcu);
-int security_inode_permission(struct inode *inode, int mask);
+int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+			      int mask);
 int security_inode_setattr(struct mnt_idmap *idmap,
 			   struct dentry *dentry, struct iattr *attr);
 void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
@@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode *inode,
 	return 0;
 }
 
-static inline int security_inode_create(struct inode *dir,
-					 struct dentry *dentry,
-					 umode_t mode)
+static inline int security_inode_create(struct mnt_idmap *idmap,
+					struct inode *dir,
+					struct dentry *dentry,
+					umode_t mode)
 {
 	return 0;
 }
@@ -913,9 +918,10 @@ static inline void
 security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
 { }
 
-static inline int security_inode_link(struct dentry *old_dentry,
-				       struct inode *dir,
-				       struct dentry *new_dentry)
+static inline int security_inode_link(struct mnt_idmap *idmap,
+				      struct dentry *old_dentry,
+				      struct inode *dir,
+				      struct dentry *new_dentry)
 {
 	return 0;
 }
@@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode *dir,
 	return 0;
 }
 
-static inline int security_inode_symlink(struct inode *dir,
-					  struct dentry *dentry,
-					  const char *old_name)
+static inline int security_inode_symlink(struct mnt_idmap *idmap,
+					 struct inode *dir,
+					 struct dentry *dentry,
+					 const char *old_name)
 {
 	return 0;
 }
 
-static inline int security_inode_mkdir(struct inode *dir,
-					struct dentry *dentry,
-					int mode)
+static inline int security_inode_mkdir(struct mnt_idmap *idmap,
+				       struct inode *dir,
+				       struct dentry *dentry,
+				       int mode)
 {
 	return 0;
 }
@@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode *dir,
 	return 0;
 }
 
-static inline int security_inode_mknod(struct inode *dir,
-					struct dentry *dentry,
-					int mode, dev_t dev)
+static inline int security_inode_mknod(struct mnt_idmap *idmap,
+				       struct inode *dir,
+				       struct dentry *dentry,
+				       int mode, dev_t dev)
 {
 	return 0;
 }
@@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry *dentry,
 	return 0;
 }
 
-static inline int security_inode_permission(struct inode *inode, int mask)
+static inline int security_inode_permission(struct mnt_idmap *idmap,
+					    struct inode *inode, int mask)
 {
 	return 0;
 }
diff --git a/security/security.c b/security/security.c
index 2ee276ab15c5b..a9190da3341dd 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path *path)
 
 /**
  * security_inode_create() - Check if creating a file is allowed
+ * @idmap: idmap of the mount
  * @dir: the parent directory
  * @dentry: the file being created
  * @mode: requested file mode
@@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path *path)
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_create(struct inode *dir, struct dentry *dentry,
-			  umode_t mode)
+int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+			  struct dentry *dentry, umode_t mode)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_create, dir, dentry, mode);
+	return call_int_hook(inode_create, idmap, dir, dentry, mode);
 }
 EXPORT_SYMBOL_GPL(security_inode_create);
 
@@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
 
 /**
  * security_inode_link() - Check if creating a hard link is allowed
+ * @idmap: idmap of the mount
  * @old_dentry: existing file
  * @dir: new parent directory
  * @new_dentry: new link
@@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_link(struct dentry *old_dentry, struct inode *dir,
-			struct dentry *new_dentry)
+int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			struct inode *dir, struct dentry *new_dentry)
 {
 	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
 		return 0;
-	return call_int_hook(inode_link, old_dentry, dir, new_dentry);
+	return call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry);
 }
 
 /**
@@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry)
 
 /**
  * security_inode_symlink() - Check if creating a symbolic link is allowed
+ * @idmap: idmap of the mount
  * @dir: parent directory
  * @dentry: symbolic link
  * @old_name: existing filename
@@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry)
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_symlink(struct inode *dir, struct dentry *dentry,
-			   const char *old_name)
+int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+			   struct dentry *dentry, const char *old_name)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_symlink, dir, dentry, old_name);
+	return call_int_hook(inode_symlink, idmap, dir, dentry, old_name);
 }
 
 /**
  * security_inode_mkdir() - Check if creating a new directory is allowed
+ * @idmap: idmap of the mount
  * @dir: parent directory
  * @dentry: new directory
  * @mode: new directory mode
@@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode *dir, struct dentry *dentry,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_mkdir, dir, dentry, mode);
+	return call_int_hook(inode_mkdir, idmap, dir, dentry, mode);
 }
 EXPORT_SYMBOL_GPL(security_inode_mkdir);
 
@@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
 
 /**
  * security_inode_mknod() - Check if creating a special file is allowed
+ * @idmap: idmap of the mount
  * @dir: parent directory
  * @dentry: new file
  * @mode: new file mode
@@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_mknod(struct inode *dir, struct dentry *dentry,
-			 umode_t mode, dev_t dev)
+int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode, dev_t dev)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_mknod, dir, dentry, mode, dev);
+	return call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev);
 }
 
 /**
@@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
 
 /**
  * security_inode_permission() - Check if accessing an inode is allowed
+ * @idmap: idmap of the mount
  * @inode: inode
  * @mask: access mask
  *
@@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_permission(struct inode *inode, int mask)
+int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+			      int mask)
 {
 	if (unlikely(IS_PRIVATE(inode)))
 		return 0;
-	return call_int_hook(inode_permission, inode, mask);
+	return call_int_hook(inode_permission, idmap, inode, mask);
 }
 
 /**
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 035aaf113d1da..967984d0af300 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode *inode,
 			    &ad);
 }
 
-static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int selinux_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+				struct dentry *dentry, umode_t mode)
 {
 	return may_create(dir, dentry, SECCLASS_FILE);
 }
 
-static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
+static int selinux_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			      struct inode *dir, struct dentry *new_dentry)
 {
 	return may_link(dir, old_dentry, MAY_LINK);
 }
@@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
 	return may_link(dir, dentry, MAY_UNLINK);
 }
 
-static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
+static int selinux_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+				 struct dentry *dentry, const char *name)
 {
 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
 }
 
-static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
+static int selinux_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+			       struct dentry *dentry, umode_t mask)
 {
 	return may_create(dir, dentry, SECCLASS_DIR);
 }
@@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
 	return may_link(dir, dentry, MAY_RMDIR);
 }
 
-static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
+static int selinux_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+			       struct dentry *dentry, umode_t mode, dev_t dev)
 {
 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
 }
@@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct *tsec,
 
 /**
  * selinux_inode_permission - Check if the current task can access an inode
+ * @idmap: idmap of the mount
  * @inode: the inode that is being accessed
  * @requested: the accesses being requested
  *
  * Check if the current task is allowed to access @inode according to
  * @requested.  Returns 0 if allowed, negative values otherwise.
  */
-static int selinux_inode_permission(struct inode *inode, int requested)
+static int selinux_inode_permission(struct mnt_idmap *idmap,
+				    struct inode *inode, int requested)
 {
 	int mask;
 	u32 perms;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 8e88ac65fd7fc..a45819d13c0d6 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
 
 /**
  * smack_inode_link - Smack check on link
+ * @idmap: idmap of the mount
  * @old_dentry: the existing object
  * @dir: unused
  * @new_dentry: the new object
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
-			    struct dentry *new_dentry)
+static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			    struct inode *dir, struct dentry *new_dentry)
 {
 	struct smack_known *isp;
 	struct smk_audit_info ad;
@@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,
 
 /**
  * smack_inode_permission - Smack version of permission()
+ * @idmap: idmap of the mount
  * @inode: the inode in question
  * @mask: the access requested
  *
@@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_permission(struct inode *inode, int mask)
+static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+				  int mask)
 {
 	struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
 	struct smk_audit_info ad;
diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
index d7495efd4a562..c0ae813698ae2 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
@@ -1,18 +1,30 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 
 /*
  * Copyright (C) 2020 Google LLC.
  */
 
 #include <test_progs.h>
+#include <sched.h>
+#include <signal.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
+#include <linux/mount.h>
+
 #include "lsm.skel.h"
 #include "lsm_tailcall.skel.h"
 
 char *CMD_ARGS[] = {"true", NULL};
 
+enum {
+	INODE_IDMAP_ALL = (1U << 6) - 1,
+};
+
 int exec_cmd(int *monitored_pid)
 {
 	int child_pid, child_status;
@@ -30,6 +42,219 @@ int exec_cmd(int *monitored_pid)
 	return -EINVAL;
 }
 
+static ssize_t write_nointr(int fd, const void *buf, size_t count)
+{
+	ssize_t ret;
+
+	do {
+		ret = write(fd, buf, count);
+	} while (ret < 0 && errno == EINTR);
+
+	return ret;
+}
+
+static int write_file(const char *path, const char *value)
+{
+	size_t len = strlen(value);
+	int fd, saved_errno = 0;
+	ssize_t ret;
+
+	fd = open(path, O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW);
+	if (fd < 0)
+		return -1;
+
+	ret = write_nointr(fd, value, len);
+	if (ret < 0)
+		saved_errno = errno;
+	else if ((size_t)ret != len)
+		saved_errno = EIO;
+	close(fd);
+	if (saved_errno) {
+		errno = saved_errno;
+		return -1;
+	}
+	return 0;
+}
+
+static int write_userns_file(pid_t pid, const char *name, const char *value)
+{
+	char path[64];
+	int len;
+
+	len = snprintf(path, sizeof(path), "/proc/%d/%s", pid, name);
+	if (len < 0 || (size_t)len >= sizeof(path)) {
+		errno = EOVERFLOW;
+		return -1;
+	}
+
+	return write_file(path, value);
+}
+
+static int create_userns_fd(void)
+{
+	char path[64];
+	pid_t pid, waited;
+	int fd = -1, len, saved_errno, status;
+
+	pid = fork();
+	if (pid < 0)
+		return -1;
+	if (pid == 0) {
+		if (unshare(CLONE_NEWUSER))
+			_exit(1);
+		raise(SIGSTOP);
+		_exit(0);
+	}
+
+	do {
+		waited = waitpid(pid, &status, WUNTRACED);
+	} while (waited < 0 && errno == EINTR);
+	if (waited != pid)
+		goto out;
+	if (!WIFSTOPPED(status)) {
+		pid = -1;
+		goto out;
+	}
+
+	/* A one-entry map is identity for root but remains distinct from nop_mnt_idmap. */
+	if (write_userns_file(pid, "setgroups", "deny") && errno != ENOENT)
+		goto out;
+	if (write_userns_file(pid, "uid_map", "0 0 1") ||
+	    write_userns_file(pid, "gid_map", "0 0 1"))
+		goto out;
+
+	len = snprintf(path, sizeof(path), "/proc/%d/ns/user", pid);
+	if (len < 0 || (size_t)len >= sizeof(path)) {
+		errno = EOVERFLOW;
+		goto out;
+	}
+	fd = open(path, O_RDONLY | O_CLOEXEC);
+
+out:
+	saved_errno = errno;
+	if (pid > 0) {
+		kill(pid, SIGKILL);
+		do {
+			waited = waitpid(pid, NULL, 0);
+		} while (waited < 0 && errno == EINTR);
+	}
+	errno = saved_errno;
+	return fd;
+}
+
+static int create_idmapped_tmpfs(void)
+{
+	struct mount_attr attr = {
+		.attr_set = MOUNT_ATTR_IDMAP,
+	};
+	int fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1;
+
+	userns_fd = create_userns_fd();
+	if (userns_fd < 0)
+		goto out;
+
+	/* A detached tmpfs avoids relying on the host test directory supporting idmaps. */
+	fsfd = syscall(__NR_fsopen, "tmpfs", FSOPEN_CLOEXEC);
+	if (fsfd < 0)
+		goto out;
+	if (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0))
+		goto out;
+
+	mntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0);
+	if (mntfd < 0)
+		goto out;
+
+	attr.userns_fd = userns_fd;
+	if (syscall(__NR_mount_setattr, mntfd, "", AT_EMPTY_PATH, &attr,
+		    sizeof(attr))) {
+		close(mntfd);
+		mntfd = -1;
+	}
+
+out:
+	saved_errno = errno;
+	if (fsfd >= 0)
+		close(fsfd);
+	if (userns_fd >= 0)
+		close(userns_fd);
+	errno = saved_errno;
+	return mntfd;
+}
+
+static int exercise_inode_idmap_hooks(int dirfd)
+{
+	int fd = -1, ret = -1;
+
+	fd = openat(dirfd, "file", O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC,
+		    0600);
+	if (!ASSERT_GE(fd, 0, "create"))
+		goto out;
+	close(fd);
+	fd = -1;
+
+	if (!ASSERT_OK(mkdirat(dirfd, "dir", 0700), "mkdir"))
+		goto out;
+	if (!ASSERT_OK(symlinkat("target", dirfd, "symlink"), "symlink"))
+		goto out;
+	if (!ASSERT_OK(linkat(dirfd, "file", dirfd, "link", 0), "link"))
+		goto out;
+	if (!ASSERT_OK(mkfifoat(dirfd, "fifo", 0600), "mknod"))
+		goto out;
+
+	ret = 0;
+out:
+	if (fd >= 0)
+		close(fd);
+	unlinkat(dirfd, "link", 0);
+	unlinkat(dirfd, "fifo", 0);
+	unlinkat(dirfd, "symlink", 0);
+	unlinkat(dirfd, "file", 0);
+	unlinkat(dirfd, "dir", AT_REMOVEDIR);
+	return ret;
+}
+
+static int test_lsm_inode_idmap(struct lsm *skel)
+{
+	char tmpdir[] = "/var/tmp/test_lsm_idmap.XXXXXX";
+	__u32 expected = INODE_IDMAP_ALL;
+	int dirfd = -1, idmapped_dirfd = -1;
+	int ret = -1;
+
+	if (!ASSERT_OK_PTR(mkdtemp(tmpdir), "mkdtemp"))
+		return -1;
+
+	dirfd = open(tmpdir, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+	if (!ASSERT_GE(dirfd, 0, "open_tmpdir"))
+		goto out;
+
+	idmapped_dirfd = create_idmapped_tmpfs();
+	if (!ASSERT_GE(idmapped_dirfd, 0, "create_idmapped_tmpfs"))
+		goto out;
+
+	skel->bss->inode_identity_idmap_seen = 0;
+	skel->bss->inode_idmapped_mount_seen = 0;
+
+	if (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), "identity_idmap"))
+		goto out;
+	if (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd),
+		       "idmapped_mount"))
+		goto out;
+
+	if (!ASSERT_EQ(skel->bss->inode_identity_idmap_seen, expected,
+		       "inode_identity_idmap_seen"))
+		goto out;
+	ret = ASSERT_EQ(skel->bss->inode_idmapped_mount_seen, expected,
+			"inode_idmapped_mount_seen") ? 0 : -1;
+
+out:
+	if (idmapped_dirfd >= 0)
+		close(idmapped_dirfd);
+	if (dirfd >= 0)
+		close(dirfd);
+	rmdir(tmpdir);
+	return ret;
+}
+
 static int test_lsm(struct lsm *skel)
 {
 	struct bpf_link *link;
@@ -53,6 +278,10 @@ static int test_lsm(struct lsm *skel)
 
 	skel->bss->monitored_pid = getpid();
 
+	err = test_lsm_inode_idmap(skel);
+	if (!ASSERT_OK(err, "test_lsm_inode_idmap"))
+		return err;
+
 	err = stack_mprotect();
 	if (!ASSERT_EQ(err, -1, "stack_mprotect") ||
 	    !ASSERT_EQ(errno, EPERM, "stack_mprotect"))
@@ -71,6 +300,8 @@ static int test_lsm(struct lsm *skel)
 	skel->bss->copy_test = 0;
 	skel->bss->bprm_count = 0;
 	skel->bss->mprotect_count = 0;
+	skel->bss->inode_identity_idmap_seen = 0;
+	skel->bss->inode_idmapped_mount_seen = 0;
 	return 0;
 }
 
diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c
index 7de173daf27b6..7e32fbddbfadf 100644
--- a/tools/testing/selftests/bpf/progs/lsm.c
+++ b/tools/testing/selftests/bpf/progs/lsm.c
@@ -84,6 +84,85 @@ char _license[] SEC("license") = "GPL";
 int monitored_pid = 0;
 int mprotect_count = 0;
 int bprm_count = 0;
+__u32 inode_identity_idmap_seen = 0;
+__u32 inode_idmapped_mount_seen = 0;
+
+enum {
+	INODE_IDMAP_CREATE	= 1U << 0,
+	INODE_IDMAP_LINK	= 1U << 1,
+	INODE_IDMAP_SYMLINK	= 1U << 2,
+	INODE_IDMAP_MKDIR	= 1U << 3,
+	INODE_IDMAP_MKNOD	= 1U << 4,
+	INODE_IDMAP_PERMISSION	= 1U << 5,
+};
+
+static __always_inline bool is_monitored_idmap(struct mnt_idmap *idmap)
+{
+	__u32 pid = bpf_get_current_pid_tgid() >> 32;
+
+	return monitored_pid == pid && idmap;
+}
+
+static __always_inline bool is_identity_idmap(struct mnt_idmap *idmap)
+{
+	return idmap->uid_map.nr_extents == 0 &&
+	       idmap->gid_map.nr_extents == 0;
+}
+
+static __always_inline int record_inode_idmap(struct mnt_idmap *idmap,
+					      __u32 hook, int ret)
+{
+	if (ret || !is_monitored_idmap(idmap))
+		return ret;
+	if (is_identity_idmap(idmap))
+		inode_identity_idmap_seen |= hook;
+	else
+		inode_idmapped_mount_seen |= hook;
+	return 0;
+}
+
+SEC("lsm/inode_create")
+int BPF_PROG(test_inode_create, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, umode_t mode, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret);
+}
+
+SEC("lsm/inode_link")
+int BPF_PROG(test_inode_link, struct mnt_idmap *idmap,
+	     struct dentry *old_dentry, struct inode *dir,
+	     struct dentry *new_dentry, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_LINK, ret);
+}
+
+SEC("lsm/inode_symlink")
+int BPF_PROG(test_inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, const char *old_name, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret);
+}
+
+SEC("lsm/inode_mkdir")
+int BPF_PROG(test_inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, umode_t mode, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret);
+}
+
+SEC("lsm/inode_mknod")
+int BPF_PROG(test_inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, umode_t mode, dev_t dev, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret);
+}
+
+SEC("lsm/inode_permission")
+int BPF_PROG(test_inode_permission, struct mnt_idmap *idmap,
+	     struct inode *inode, int mask, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret);
+}
 
 SEC("lsm/file_mprotect")
 int BPF_PROG(test_int_hook, struct vm_area_struct *vma,

							input: 13564
							output: 22
							thoughts: 1109

**Analyzing the Patch: Worth Fuzzing?**

Okay, let's break this down. This patch is touching a lot of important areas: `fs/cachefiles/security.c`, `fs/namei.c`, critical include files, and, crucially, the security framework itself, including SELinux, Smack, and even the BPF LSM tests. My initial impression is that this *might* be a refactoring, introducing the `struct mnt_idmap *idmap` parameter to several LSM hooks: `inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, `inode_permission`.

First, I need to see if there's any *functional* change here, or if this is just plumbing. Scanning `fs/namei.c`, I see `idmap` is getting passed into the `security_inode_*` calls correctly. The wrapper functions in `security/security.c` are also updated to handle the `idmap` parameter and pass it on via `call_int_hook(...)`. SELinux and Smack are having their hook signatures updated, but it looks like they aren't *using* the `idmap` parameter right now. However, the BPF LSM tests are *receiving* `idmap` now, which is definitely significant.

The critical question: Is this just an API change to support idmapped mounts better (especially for BPF LSM or future LSMs), or does it *functionally* change security policy behavior?

Let's check the guidelines for what's worth fuzzing. I need to make sure this is not just documentation, decorative changes, constant updates, or unreachable code. This definitely *isn't* documentation, and it isn't just logging. This is modifying LSM hook definitions and the VFS layer.

Now, this is getting interesting. LSM hooks are core kernel logic, and the BPF LSM *can* attach to these hooks and now receives the `idmap` argument. That means a BPF program can now potentially make decisions based on mount ID mapping information, changing the attack surface.

This looks like a potential area for security vulnerabilities, so it *seems* worth fuzzing. I need to double-check, though. I need to use my tools (`grepper`, git log, git show, etc.) to ensure I haven't missed any related changes in other LSMs (AppArmor, Landlock, etc.) or any other areas of the kernel that interact with these hooks. I have to be completely certain before I flag it as not worth fuzzing. I need to make sure I haven't missed anything crucial.

{
  "Expression": "inode_permission.*mnt_idmap"
}

{
  "Output": "drivers/block/ublk_drv.c=5308=static int ublk_char_dev_permission(struct ublk_device *ub,\n--\ndrivers/block/ublk_drv.c-5326-\ndrivers/block/ublk_drv.c:5327:\terr = inode_permission(\u0026nop_mnt_idmap,\ndrivers/block/ublk_drv.c-5328-\t\t\td_backing_inode(path.dentry), mask);\n--\nfs/bad_inode.c=86=static int bad_inode_readlink(struct dentry *dentry, char __user *buffer,\n--\nfs/bad_inode.c-91-\nfs/bad_inode.c:92:static int bad_inode_permission(struct mnt_idmap *idmap,\nfs/bad_inode.c-93-\t\t\t\tstruct inode *inode, int mask)\n--\nfs/bpf_fs_kfuncs.c=103=static int bpf_xattr_read_permission(const char *name, struct inode *inode)\n--\nfs/bpf_fs_kfuncs.c-112-\nfs/bpf_fs_kfuncs.c:113:\treturn inode_permission(\u0026nop_mnt_idmap, inode, MAY_READ);\nfs/bpf_fs_kfuncs.c-114-}\n--\nfs/bpf_fs_kfuncs.c=173=static int bpf_xattr_write_permission(const char *name, struct inode *inode)\n--\nfs/bpf_fs_kfuncs.c-181-\nfs/bpf_fs_kfuncs.c:182:\treturn inode_permission(\u0026nop_mnt_idmap, inode, MAY_WRITE);\nfs/bpf_fs_kfuncs.c-183-}\n--\nfs/btrfs/ioctl.c=2430=static int btrfs_ioctl_defrag(struct file *file, void __user *argp)\n--\nfs/btrfs/ioctl.c-2460-\t\tif (!capable(CAP_SYS_ADMIN) \u0026\u0026\nfs/btrfs/ioctl.c:2461:\t\t    inode_permission(\u0026nop_mnt_idmap, inode, MAY_WRITE)) {\nfs/btrfs/ioctl.c-2462-\t\t\tret = -EPERM;\n--\nfs/configfs/symlink.c=135=int configfs_symlink(struct mnt_idmap *idmap, struct inode *dir,\n--\nfs/configfs/symlink.c-192-\telse\nfs/configfs/symlink.c:193:\t\tret = inode_permission(\u0026nop_mnt_idmap, dir,\nfs/configfs/symlink.c-194-\t\t\t\t       MAY_WRITE | MAY_EXEC);\n--\nfs/ecryptfs/inode.c=852=ecryptfs_permission(struct mnt_idmap *idmap, struct inode *inode,\n--\nfs/ecryptfs/inode.c-854-{\nfs/ecryptfs/inode.c:855:\treturn inode_permission(\u0026nop_mnt_idmap,\nfs/ecryptfs/inode.c-856-\t\t\t\tecryptfs_inode_to_lower(inode), mask);\n--\nfs/namei.c=565=EXPORT_SYMBOL(generic_permission);\n--\nfs/namei.c-577- */\nfs/namei.c:578:static inline int do_inode_permission(struct mnt_idmap *idmap,\nfs/namei.c-579-\t\t\t\t      struct inode *inode, int mask)\n--\nfs/namei.c=604=static int sb_permission(struct super_block *sb, struct inode *inode, int mask)\n--\nfs/namei.c-627- */\nfs/namei.c:628:int inode_permission(struct mnt_idmap *idmap,\nfs/namei.c-629-\t\t     struct inode *inode, int mask)\n--\nfs/namei.c=663=EXPORT_SYMBOL(inode_permission);\n--\nfs/namei.c-682- */\nfs/namei.c:683:static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap *idmap,\nfs/namei.c-684-\tstruct inode *inode, int mask)\n--\nfs/namei.c=6075=int vfs_rename(struct renamedata *rd)\n--\nfs/namei.c-6122-\t\tif (is_dir) {\nfs/namei.c:6123:\t\t\terror = inode_permission(rd-\u003emnt_idmap, source,\nfs/namei.c-6124-\t\t\t\t\t\t MAY_WRITE);\n--\nfs/namei.c-6128-\t\tif ((flags \u0026 RENAME_EXCHANGE) \u0026\u0026 new_is_dir) {\nfs/namei.c:6129:\t\t\terror = inode_permission(rd-\u003emnt_idmap, target,\nfs/namei.c-6130-\t\t\t\t\t\t MAY_WRITE);\n--\nfs/nfsd/nfsfh.c=31=static int nfsd_acceptable(void *expv, struct dentry *dentry)\n--\nfs/nfsd/nfsfh.c-45-\t\tparent = dget_parent(tdentry);\nfs/nfsd/nfsfh.c:46:\t\terr = inode_permission(\u0026nop_mnt_idmap,\nfs/nfsd/nfsfh.c-47-\t\t\t\t       d_inode(parent), MAY_EXEC);\n--\nfs/nfsd/vfs.c=2843=nfsd_permission(struct svc_cred *cred, struct svc_export *exp,\n--\nfs/nfsd/vfs.c-2902-\t/* This assumes  NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */\nfs/nfsd/vfs.c:2903:\terr = inode_permission(\u0026nop_mnt_idmap, inode,\nfs/nfsd/vfs.c-2904-\t\t\t       acc \u0026 (MAY_READ | MAY_WRITE | MAY_EXEC));\n--\nfs/nfsd/vfs.c-2909-\t      (acc \u0026 (NFSD_MAY_OWNER_OVERRIDE | NFSD_MAY_READ_IF_EXEC))))\nfs/nfsd/vfs.c:2910:\t\terr = inode_permission(\u0026nop_mnt_idmap, inode, MAY_EXEC);\nfs/nfsd/vfs.c-2911-\n--\nfs/ocfs2/refcounttree.c=4355=static inline int ocfs2_may_create(struct inode *dir, struct dentry *child)\n--\nfs/ocfs2/refcounttree.c-4360-\t\treturn -ENOENT;\nfs/ocfs2/refcounttree.c:4361:\treturn inode_permission(\u0026nop_mnt_idmap, dir, MAY_WRITE | MAY_EXEC);\nfs/ocfs2/refcounttree.c-4362-}\n--\nfs/ocfs2/refcounttree.c=4372=static int ocfs2_vfs_reflink(struct dentry *old_dentry, struct inode *dir,\n--\nfs/ocfs2/refcounttree.c-4414-\tif (!preserve) {\nfs/ocfs2/refcounttree.c:4415:\t\terror = inode_permission(\u0026nop_mnt_idmap, inode, MAY_READ);\nfs/ocfs2/refcounttree.c-4416-\t\tif (error)\n--\nfs/open.c=463=static int do_faccessat(int dfd, const char __user *filename, int mode, int flags)\n--\nfs/open.c-503-\nfs/open.c:504:\tres = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS);\nfs/open.c-505-\t/* SuS v2 requires we report a read only fs too */\n--\nfs/overlayfs/inode.c=306=int ovl_permission(struct mnt_idmap *idmap,\n--\nfs/overlayfs/inode.c-336-\twith_ovl_creds(inode-\u003ei_sb)\nfs/overlayfs/inode.c:337:\t\treturn inode_permission(mnt_idmap(realpath.mnt), realinode, mask);\nfs/overlayfs/inode.c-338-}\n--\nfs/smb/server/smb2pdu.c=6008=int smb2_query_dir(struct ksmbd_work *work)\n--\nfs/smb/server/smb2pdu.c-6061-\tif (!(dir_fp-\u003edaccess \u0026 FILE_LIST_DIRECTORY_LE) ||\nfs/smb/server/smb2pdu.c:6062:\t    inode_permission(file_mnt_idmap(dir_fp-\u003efilp),\nfs/smb/server/smb2pdu.c-6063-\t\t\t     file_inode(dir_fp-\u003efilp),\n--\ninclude/linux/fs.h=2710=int notify_change(struct mnt_idmap *, struct dentry *,\ninclude/linux/fs.h-2711-\t\t  struct iattr *, struct delegated_inode *);\ninclude/linux/fs.h:2712:int inode_permission(struct mnt_idmap *, struct inode *, int);\ninclude/linux/fs.h-2713-int generic_permission(struct mnt_idmap *, struct inode *, int);\ninclude/linux/fs.h=2714=static inline int file_permission(struct file *file, int mask)\ninclude/linux/fs.h-2715-{\ninclude/linux/fs.h:2716:\treturn inode_permission(file_mnt_idmap(file),\ninclude/linux/fs.h-2717-\t\t\t\tfile_inode(file), mask);\n--\ninclude/linux/fs.h=2719=static inline int path_permission(const struct path *path, int mask)\ninclude/linux/fs.h-2720-{\ninclude/linux/fs.h:2721:\treturn inode_permission(mnt_idmap(path-\u003emnt),\ninclude/linux/fs.h-2722-\t\t\t\td_inode(path-\u003edentry), mask);\n--\ninclude/linux/lsm_hook_defs.h=140=LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,\ninclude/linux/lsm_hook_defs.h-141-\t bool rcu)\ninclude/linux/lsm_hook_defs.h:142:LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,\ninclude/linux/lsm_hook_defs.h-143-\t struct inode *inode, int mask)\n--\ninclude/linux/security.h=425=int security_inode_follow_link(struct dentry *dentry, struct inode *inode,\ninclude/linux/security.h-426-\t\t\t       bool rcu);\ninclude/linux/security.h:427:int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\ninclude/linux/security.h-428-\t\t\t      int mask);\n--\ninclude/linux/security.h=979=static inline int security_inode_follow_link(struct dentry *dentry,\n--\ninclude/linux/security.h-985-\ninclude/linux/security.h:986:static inline int security_inode_permission(struct mnt_idmap *idmap,\ninclude/linux/security.h-987-\t\t\t\t\t    struct inode *inode, int mask)\n--\nipc/mqueue.c=860=static int prepare_open(struct dentry *dentry, int oflag, int ro,\n--\nipc/mqueue.c-883-\tacc = oflag2acc[oflag \u0026 O_ACCMODE];\nipc/mqueue.c:884:\treturn inode_permission(\u0026nop_mnt_idmap, d_inode(dentry), acc);\nipc/mqueue.c-885-}\n--\nkernel/bpf/inode.c=611=static struct bpf_prog *__get_prog_inode(struct inode *inode, enum bpf_prog_type type)\n--\nkernel/bpf/inode.c-613-\tstruct bpf_prog *prog;\nkernel/bpf/inode.c:614:\tint ret = inode_permission(\u0026nop_mnt_idmap, inode, MAY_READ);\nkernel/bpf/inode.c-615-\tif (ret)\n--\nkernel/cgroup/cgroup.c=5410=static int cgroup_may_write(const struct cgroup *cgrp, struct super_block *sb)\n--\nkernel/cgroup/cgroup.c-5420-\nkernel/cgroup/cgroup.c:5421:\tret = inode_permission(\u0026nop_mnt_idmap, inode, MAY_WRITE);\nkernel/cgroup/cgroup.c-5422-\tiput(inode);\n--\nsecurity/security.c=1822=int security_inode_follow_link(struct dentry *dentry, struct inode *inode,\n--\nsecurity/security.c-1844- */\nsecurity/security.c:1845:int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\nsecurity/security.c-1846-\t\t\t      int mask)\n--\nsecurity/selinux/hooks.c=3223=static inline void task_avdcache_update(struct task_security_struct *tsec,\n--\nsecurity/selinux/hooks.c-3250- */\nsecurity/selinux/hooks.c:3251:static int selinux_inode_permission(struct mnt_idmap *idmap,\nsecurity/selinux/hooks.c-3252-\t\t\t\t    struct inode *inode, int requested)\n--\nsecurity/smack/smack_lsm.c=1203=static int smack_inode_rename(struct inode *old_inode,\n--\nsecurity/smack/smack_lsm.c-1237- */\nsecurity/smack/smack_lsm.c:1238:static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\nsecurity/smack/smack_lsm.c-1239-\t\t\t\t  int mask)\n--\ntools/testing/selftests/bpf/progs/lsm.c=160=SEC(\"lsm/inode_permission\")\ntools/testing/selftests/bpf/progs/lsm.c:161:int BPF_PROG(test_inode_permission, struct mnt_idmap *idmap,\ntools/testing/selftests/bpf/progs/lsm.c-162-\t     struct inode *inode, int mask, int ret)\n"
}

							input: 19040
							output: 20
							thoughts: 114

**Analyzing the Impact of the IDMAP Structure in LSM Hooks**

Okay, here's the situation: I need to understand how these recent changes impact the security module implementations. Specifically, I'm focusing on the updates to the LSM hooks. The core hooks I'm looking at are `security_inode_permission`, `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, and `security_inode_mknod`. The key change is the introduction of `struct mnt_idmap *idmap` being passed down from the VFS. This is significant because it directly affects how we handle identity mapping within the LSM.

Now, the important part: the fact that BPF LSM hooks *also* have access to this `idmap` is crucial. This is a game changer for BPF-based security policies. BPF already gives us fine-grained control, but having the ID map available opens up even more possibilities for context-aware security enforcement, especially when dealing with namespaced file systems and user ID mapping scenarios.

So, where do I go from here? Time to dig into the kernel configuration files. I'll need to check `security/Kconfig` and `fs/Kconfig` to see the relevant configuration options that control these features and ensure I'm aware of the dependencies and potential implications on different security configurations. This will help me understand how this `idmap` integration can be enabled or disabled and how it will impact the interaction with different security modules. This is likely going to open up some interesting new attack surfaces, and I'll need to do some focused research to understand how best to approach them.

{
  "Expression": "config BPF_LSM"
}

{
  "Output": "kernel/bpf/Kconfig=90=source \"kernel/bpf/preload/Kconfig\"\nkernel/bpf/Kconfig-91-\nkernel/bpf/Kconfig:92:config BPF_LSM\nkernel/bpf/Kconfig-93-\tbool \"Enable BPF LSM Instrumentation\"\n"
}

							input: 19617
							output: 34
							thoughts: 19

Here's my take on the situation:

**Investigating BPF Configuration**

Okay, so I need to dig into the BPF configuration. My initial thought is to zero in on `kernel/bpf/Kconfig`. I'm going to start around line 92. Hopefully, that will give me a good entry point to understand how things are set up and perhaps identify any potential issues or areas for further exploration within the BPF configuration options. Let's see what we can find there.

{
  "File": "kernel/bpf/Kconfig",
  "FirstLine": 80,
  "LineCount": 40
}

{
  "Contents": "  80:\t\t  still reenable it by setting it to 0 later on, or permanently\n  81:\t\t  disable it by setting it to 1 (from which no other transition to\n  82:\t\t  0 is possible anymore).\n  83:\t\n  84:\t\t  Unprivileged BPF could be used to exploit certain potential\n  85:\t\t  speculative execution side-channel vulnerabilities on unmitigated\n  86:\t\t  affected hardware.\n  87:\t\n  88:\t\t  If you are unsure how to answer this question, answer Y.\n  89:\t\n  90:\tsource \"kernel/bpf/preload/Kconfig\"\n  91:\t\n  92:\tconfig BPF_LSM\n  93:\t\tbool \"Enable BPF LSM Instrumentation\"\n  94:\t\tdepends on BPF_EVENTS\n  95:\t\tdepends on BPF_SYSCALL\n  96:\t\tdepends on SECURITY\n  97:\t\tdepends on BPF_JIT\n  98:\t\thelp\n  99:\t\t  Enables instrumentation of the security hooks with BPF programs for\n 100:\t\t  implementing dynamic MAC and Audit Policies.\n 101:\t\n 102:\t\t  If you are unsure how to answer this question, answer N.\n 103:\t\n 104:\tendmenu # \"BPF subsystem\"\n"
}

							input: 20119
							output: 16
							thoughts: 33

Okay, here's my take on those thoughts, tailored for an expert audience:

**Examining LSM Configuration Options**

Alright, time to get down to brass tacks. I need to get a clear picture of the current Linux Security Modules (LSM) configurations available within this kernel. My first instinct, as always, is to dive straight into the heart of the matter – `security/Kconfig`. This is where all the interesting LSM settings reside, right? I expect to find the usual suspects defined in there. I'm thinking I'll be looking for the standard LSM configurations: the master `SECURITY` switch, of course. Then, I'll be particularly interested in the specifics. I'll expect to see `SECURITY_SELINUX`, `SECURITY_SMACK`, and whatever else is being supported or considered for this kernel build. This is where the decisions regarding the security posture of this kernel are ultimately made, and I need to see exactly where we stand.

{
  "Expression": "config SECURITY"
}

{
  "Output": "security/Kconfig=8=source \"security/keys/Kconfig\"\nsecurity/Kconfig-9-\nsecurity/Kconfig:10:config SECURITY_DMESG_RESTRICT\nsecurity/Kconfig-11-\tbool \"Restrict unprivileged access to the kernel syslog\"\n--\nsecurity/Kconfig=52=config MSEAL_SYSTEM_MAPPINGS\n--\nsecurity/Kconfig-72-\nsecurity/Kconfig:73:config SECURITY\nsecurity/Kconfig-74-\tbool \"Enable different security models\"\n--\nsecurity/Kconfig=86=config HAS_SECURITY_AUDIT\n--\nsecurity/Kconfig-90-\nsecurity/Kconfig:91:config SECURITYFS\nsecurity/Kconfig-92-\tbool \"Enable the securityfs filesystem\"\n--\nsecurity/Kconfig-98-\nsecurity/Kconfig:99:config SECURITY_NETWORK\nsecurity/Kconfig-100-\tbool \"Socket and Networking Security Hooks\"\n--\nsecurity/Kconfig-107-\nsecurity/Kconfig:108:config SECURITY_INFINIBAND\nsecurity/Kconfig-109-\tbool \"Infiniband Security Hooks\"\n--\nsecurity/Kconfig-116-\nsecurity/Kconfig:117:config SECURITY_NETWORK_XFRM\nsecurity/Kconfig-118-\tbool \"XFRM (IPSec) Networking Security Hooks\"\n--\nsecurity/Kconfig-129-\nsecurity/Kconfig:130:config SECURITY_PATH\nsecurity/Kconfig-131-\tbool \"Security hooks for pathname based access control\"\n--\nsecurity/Kconfig=268=config LSM\n--\nsecurity/Kconfig-284-\nsecurity/Kconfig:285:config SECURITY_COMMONCAP_KUNIT_TEST\nsecurity/Kconfig-286-\tbool \"Build KUnit tests for commoncap\" if !KUNIT_ALL_TESTS\n--\nsecurity/apparmor/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/apparmor/Kconfig:2:config SECURITY_APPARMOR\nsecurity/apparmor/Kconfig-3-\tbool \"AppArmor support\"\n--\nsecurity/apparmor/Kconfig-17-\nsecurity/apparmor/Kconfig:18:config SECURITY_APPARMOR_DEBUG\nsecurity/apparmor/Kconfig-19-\tbool \"Build AppArmor with debug code\"\n--\nsecurity/apparmor/Kconfig-27-\nsecurity/apparmor/Kconfig:28:config SECURITY_APPARMOR_DEBUG_ASSERTS\nsecurity/apparmor/Kconfig-29-\tbool \"Build AppArmor with debugging asserts\"\n--\nsecurity/apparmor/Kconfig-37-\nsecurity/apparmor/Kconfig:38:config SECURITY_APPARMOR_DEBUG_MESSAGES\nsecurity/apparmor/Kconfig-39-\tbool \"Debug messages enabled by default\"\n--\nsecurity/apparmor/Kconfig-46-\nsecurity/apparmor/Kconfig:47:config SECURITY_APPARMOR_INTROSPECT_POLICY\nsecurity/apparmor/Kconfig-48-\tbool \"Allow loaded policy to be introspected\"\n--\nsecurity/apparmor/Kconfig-58-\nsecurity/apparmor/Kconfig:59:config SECURITY_APPARMOR_HASH\nsecurity/apparmor/Kconfig-60-\tbool \"Enable introspection of sha256 hashes for loaded profiles\"\n--\nsecurity/apparmor/Kconfig-70-\nsecurity/apparmor/Kconfig:71:config SECURITY_APPARMOR_HASH_DEFAULT\nsecurity/apparmor/Kconfig-72-       bool \"Enable policy hash introspection by default\"\n--\nsecurity/apparmor/Kconfig-83-\nsecurity/apparmor/Kconfig:84:config SECURITY_APPARMOR_EXPORT_BINARY\nsecurity/apparmor/Kconfig-85-\tbool \"Allow exporting the raw binary policy\"\n--\nsecurity/apparmor/Kconfig-95-\nsecurity/apparmor/Kconfig:96:config SECURITY_APPARMOR_COMPRESSED_POLICY\nsecurity/apparmor/Kconfig-97-\tbool \"Allow loading policy in a compressed format\"\n--\nsecurity/apparmor/Kconfig-107-\nsecurity/apparmor/Kconfig:108:config SECURITY_APPARMOR_PARANOID_LOAD\nsecurity/apparmor/Kconfig-109-\tbool \"Perform full verification of loaded policy\"\n--\nsecurity/apparmor/Kconfig-118-\nsecurity/apparmor/Kconfig:119:config SECURITY_APPARMOR_KUNIT_TEST\nsecurity/apparmor/Kconfig-120-\ttristate \"Build KUnit tests for policy_unpack.c\" if !KUNIT_ALL_TESTS\n--\nsecurity/ipe/Kconfig-5-\nsecurity/ipe/Kconfig:6:menuconfig SECURITY_IPE\nsecurity/ipe/Kconfig-7-\tbool \"Integrity Policy Enforcement (IPE)\"\n--\nsecurity/ipe/Kconfig=98=endmenu\nsecurity/ipe/Kconfig-99-\nsecurity/ipe/Kconfig:100:config SECURITY_IPE_KUNIT_TEST\nsecurity/ipe/Kconfig-101-\tbool \"Build KUnit tests for IPE\" if !KUNIT_ALL_TESTS\n--\nsecurity/landlock/Kconfig-2-\nsecurity/landlock/Kconfig:3:config SECURITY_LANDLOCK\nsecurity/landlock/Kconfig-4-\tbool \"Landlock support\"\n--\nsecurity/landlock/Kconfig-23-\nsecurity/landlock/Kconfig:24:config SECURITY_LANDLOCK_LOG\nsecurity/landlock/Kconfig-25-\tbool\n--\nsecurity/landlock/Kconfig-28-\nsecurity/landlock/Kconfig:29:config SECURITY_LANDLOCK_KUNIT_TEST\nsecurity/landlock/Kconfig-30-\tbool \"KUnit tests for Landlock\" if !KUNIT_ALL_TESTS\n--\nsecurity/loadpin/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/loadpin/Kconfig:2:config SECURITY_LOADPIN\nsecurity/loadpin/Kconfig-3-\tbool \"Pin load of kernel files (modules, fw, etc) to one filesystem\"\n--\nsecurity/loadpin/Kconfig-13-\nsecurity/loadpin/Kconfig:14:config SECURITY_LOADPIN_ENFORCE\nsecurity/loadpin/Kconfig-15-\tbool \"Enforce LoadPin at boot\"\n--\nsecurity/loadpin/Kconfig-24-\nsecurity/loadpin/Kconfig:25:config SECURITY_LOADPIN_VERITY\nsecurity/loadpin/Kconfig-26-\tbool \"Allow reading files from certain other filesystems that use dm-verity\"\n--\nsecurity/lockdown/Kconfig:1:config SECURITY_LOCKDOWN_LSM\nsecurity/lockdown/Kconfig-2-\tbool \"Basic module for enforcing kernel lockdown\"\n--\nsecurity/lockdown/Kconfig-8-\nsecurity/lockdown/Kconfig:9:config SECURITY_LOCKDOWN_LSM_EARLY\nsecurity/lockdown/Kconfig-10-\tbool \"Enable lockdown LSM early in init\"\n--\nsecurity/safesetid/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/safesetid/Kconfig:2:config SECURITY_SAFESETID\nsecurity/safesetid/Kconfig-3-        bool \"Gate setid transitions to limit CAP_SET{U/G}ID capabilities\"\n--\nsecurity/selinux/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/selinux/Kconfig:2:config SECURITY_SELINUX\nsecurity/selinux/Kconfig-3-\tbool \"SELinux Support\"\n--\nsecurity/selinux/Kconfig-11-\nsecurity/selinux/Kconfig:12:config SECURITY_SELINUX_BOOTPARAM\nsecurity/selinux/Kconfig-13-\tbool \"SELinux boot parameter\"\n--\nsecurity/selinux/Kconfig-25-\nsecurity/selinux/Kconfig:26:config SECURITY_SELINUX_DEVELOP\nsecurity/selinux/Kconfig-27-\tbool \"SELinux Development Support\"\n--\nsecurity/selinux/Kconfig-39-\nsecurity/selinux/Kconfig:40:config SECURITY_SELINUX_AVC_STATS\nsecurity/selinux/Kconfig-41-\tbool \"SELinux AVC Statistics\"\n--\nsecurity/selinux/Kconfig-48-\nsecurity/selinux/Kconfig:49:config SECURITY_SELINUX_SIDTAB_HASH_BITS\nsecurity/selinux/Kconfig-50-\tint \"SELinux sidtab hashtable size\"\n--\nsecurity/selinux/Kconfig-60-\nsecurity/selinux/Kconfig:61:config SECURITY_SELINUX_SID2STR_CACHE_SIZE\nsecurity/selinux/Kconfig-62-\tint \"SELinux SID to context string translation cache size\"\n--\nsecurity/selinux/Kconfig-71-\nsecurity/selinux/Kconfig:72:config SECURITY_SELINUX_AVC_HASH_BITS\nsecurity/selinux/Kconfig-73-\tint \"SELinux avc hashtable size\"\n--\nsecurity/selinux/Kconfig-82-\nsecurity/selinux/Kconfig:83:config SECURITY_SELINUX_DEBUG\nsecurity/selinux/Kconfig-84-\tbool \"SELinux kernel debugging support\"\n--\nsecurity/smack/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/smack/Kconfig:2:config SECURITY_SMACK\nsecurity/smack/Kconfig-3-\tbool \"Simplified Mandatory Access Control Kernel Support\"\n--\nsecurity/smack/Kconfig-15-\nsecurity/smack/Kconfig:16:config SECURITY_SMACK_BRINGUP\nsecurity/smack/Kconfig-17-\tbool \"Reporting on access granted by Smack rules\"\n--\nsecurity/smack/Kconfig-33-\nsecurity/smack/Kconfig:34:config SECURITY_SMACK_NETFILTER\nsecurity/smack/Kconfig-35-\tbool \"Packet marking using secmarks for netfilter\"\n--\nsecurity/smack/Kconfig-44-\nsecurity/smack/Kconfig:45:config SECURITY_SMACK_APPEND_SIGNALS\nsecurity/smack/Kconfig-46-\tbool \"Treat delivering signals as an append operation\"\n--\nsecurity/tomoyo/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/tomoyo/Kconfig:2:config SECURITY_TOMOYO\nsecurity/tomoyo/Kconfig-3-\tbool \"TOMOYO Linux Support\"\n--\nsecurity/tomoyo/Kconfig-15-\nsecurity/tomoyo/Kconfig:16:config SECURITY_TOMOYO_MAX_ACCEPT_ENTRY\nsecurity/tomoyo/Kconfig-17-\tint \"Default maximal count for learning mode\"\n--\nsecurity/tomoyo/Kconfig-28-\nsecurity/tomoyo/Kconfig:29:config SECURITY_TOMOYO_MAX_AUDIT_LOG\nsecurity/tomoyo/Kconfig-30-\tint \"Default maximal count for audit log\"\n--\nsecurity/tomoyo/Kconfig-39-\nsecurity/tomoyo/Kconfig:40:config SECURITY_TOMOYO_OMIT_USERSPACE_LOADER\nsecurity/tomoyo/Kconfig-41-\tbool \"Activate without calling userspace policy loader.\"\n--\nsecurity/tomoyo/Kconfig-55-\nsecurity/tomoyo/Kconfig:56:config SECURITY_TOMOYO_POLICY_LOADER\nsecurity/tomoyo/Kconfig-57-\tstring \"Location of userspace policy loader\"\n--\nsecurity/tomoyo/Kconfig-65-\nsecurity/tomoyo/Kconfig:66:config SECURITY_TOMOYO_ACTIVATION_TRIGGER\nsecurity/tomoyo/Kconfig-67-\tstring \"Trigger for calling userspace policy loader\"\n--\nsecurity/tomoyo/Kconfig-76-\nsecurity/tomoyo/Kconfig:77:config SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING\nsecurity/tomoyo/Kconfig-78-\tbool \"Use insecure built-in settings for fuzzing tests.\"\n--\nsecurity/yama/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nsecurity/yama/Kconfig:2:config SECURITY_YAMA\nsecurity/yama/Kconfig-3-\tbool \"Yama support\"\n"
}

							input: 23389
							output: 18
							thoughts: 13

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Examining the Cachefiles Kconfig**

Alright, let's dive in. My immediate thought is, "Okay, `fs/cachefiles/Kconfig` – right, that's where the configuration options for the cachefiles filesystem are defined." I need to understand what's controllable at compile time. What features can be enabled or disabled? Are there any dependencies on other kernel subsystems that I should be aware of, like specific cryptographic algorithms or namespace capabilities?

I'm thinking, "I need to look for the core features first." What are the critical booleans that dictate whether the cachefiles code is even *included* in the build? Then, I should scan for any further options that allow a fine-grained tuning of the cache's behavior. I will probably look for any default settings that catch my eye, or potential performance tunables. Maybe some options for debugging that will come in handy. I know the Kconfig syntax well, so I'll be quickly looking for the usual suspects: `bool`, `tristate`, `int`, and `string` types. Dependencies and conditional compilation, and the general structure of the file is what I'm looking for. Let's see what we can find.

{
  "Expression": "config CACHEFILES"
}

{
  "Output": "fs/cachefiles/Kconfig-2-\nfs/cachefiles/Kconfig:3:config CACHEFILES\nfs/cachefiles/Kconfig-4-\ttristate \"Filesystem caching on files\"\n--\nfs/cachefiles/Kconfig-13-\nfs/cachefiles/Kconfig:14:config CACHEFILES_DEBUG\nfs/cachefiles/Kconfig-15-\tbool \"Debug CacheFiles\"\n--\nfs/cachefiles/Kconfig-22-\nfs/cachefiles/Kconfig:23:config CACHEFILES_ERROR_INJECTION\nfs/cachefiles/Kconfig-24-\tbool \"Provide error injection for cachefiles\"\n"
}

							input: 23861
							output: 209
							thoughts: 1282

**Analysis of Potential Fuzzing Target**

Okay, let's break this down. This patch is adding a `mnt_idmap` parameter to a bunch of critical security-related VFS hooks: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_permission`. It's also updating the VFS callers and the LSM implementations themselves, including BPF selftests.

The question is, is this worth fuzzing? Based on the criteria, we need to determine if it modifies "reachable core kernel logic."

Yes, absolutely. This touches core VFS functions (`inode_permission`, `vfs_create`, `vfs_mkdir`, etc.) and LSM hook wrappers (`security_inode_*`). These are entry points directly accessible from user-space via system calls like `open`, `mkdir`, and others. That makes it a good candidate.

Now, let's identify the 'FocusSymbols'. I need to be careful not to include generic hot-path functions. We want non-static, non-inlined API entrypoints. That means we should exclude things like `inode_permission` (which is practically called on every file access). So the focus symbols are: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod` and `security_inode_permission` because those are called at creation time.

Next, the required kernel configurations. We'll need `SECURITY` to enable the security infrastructure and LSM hooks. `BPF_LSM` is also required because it leverages the `idmap` argument, and then either `SECURITY_SELINUX` or `SECURITY_SMACK` for a practical LSM.

The `BPF_LSM` dependency needs `BPF_EVENTS`, `BPF_SYSCALL`, `SECURITY`, `BPF_JIT`.

So, the configurations required are `SECURITY`, `BPF_LSM`, and either `SECURITY_SELINUX` or `SECURITY_SMACK`. Let's keep it simple and just list `SECURITY`, `BPF_LSM`, `SECURITY_SELINUX`, and `SECURITY_SMACK`.

Now, for `set-results`:

* **WorthFuzzing**: True, definitely.
* **Reasoning**: This patch extends VFS LSM hooks and their callers to propagate mount idmappings (`struct mnt_idmap *idmap`). This allows security modules (including BPF LSM, SELinux, Smack) to perform permissions checks aware of idmapped mounts. These changes modify core VFS and security subsystem interfaces and are reachable from userspace filesystem operations.
* **FocusSymbols**: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, `security_inode_permission`.
* **EnableConfigs**: `SECURITY`, `BPF_LSM`, `SECURITY_SELINUX`, `SECURITY_SMACK`.

That should be it!

{
  "EnableConfigs": [
    "SECURITY",
    "BPF_LSM",
    "SECURITY_SELINUX",
    "SECURITY_SMACK",
    "CACHEFILES"
  ],
  "FocusSymbols": [
    "security_inode_create",
    "security_inode_link",
    "security_inode_symlink",
    "security_inode_mkdir",
    "security_inode_mknod",
    "security_inode_permission"
  ],
  "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap *idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "SECURITY",
    "BPF_LSM",
    "SECURITY_SELINUX",
    "SECURITY_SMACK",
    "CACHEFILES"
  ],
  "FocusSymbols": [
    "security_inode_create",
    "security_inode_link",
    "security_inode_symlink",
    "security_inode_mkdir",
    "security_inode_mknod",
    "security_inode_permission"
  ],
  "Reasoning": "The patch updates several inode LSM hooks (security_inode_create, security_inode_link, security_inode_symlink, security_inode_mkdir, security_inode_mknod, security_inode_permission) along with VFS callers to pass down mount idmaps (struct mnt_idmap *idmap). This enables LSMs and BPF LSM programs to inspect idmapped mounts during file operations, altering reachable core VFS and security subsystem logic.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

{
  "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap *idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e9c28218b2d5e57d772a682e02a587bfa3470b48
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Sep 2 02:08:49 2026 +0000

    syz-cluster: applied patch under review

diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
index fc6611886b3b5..eefe5453b904e 100644
--- a/fs/cachefiles/security.c
+++ b/fs/cachefiles/security.c
@@ -51,14 +51,14 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
 {
 	int ret;
 
-	ret = security_inode_mkdir(d_backing_inode(root), root, 0);
+	ret = security_inode_mkdir(&nop_mnt_idmap, d_backing_inode(root), root, 0);
 	if (ret < 0) {
 		pr_err("Security denies permission to make dirs: error %d",
 		       ret);
 		return ret;
 	}
 
-	ret = security_inode_create(d_backing_inode(root), root, 0);
+	ret = security_inode_create(&nop_mnt_idmap, d_backing_inode(root), root, 0);
 	if (ret < 0)
 		pr_err("Security denies permission to create files: error %d",
 		       ret);
diff --git a/fs/namei.c b/fs/namei.c
index 20a6534ea3eff..99f894f3f7e13 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -658,7 +658,7 @@ int inode_permission(struct mnt_idmap *idmap,
 	if (unlikely(retval))
 		return retval;
 
-	return security_inode_permission(inode, mask);
+	return security_inode_permission(idmap, inode, mask);
 }
 EXPORT_SYMBOL(inode_permission);
 
@@ -695,7 +695,7 @@ static __always_inline int lookup_inode_permission_may_exec(struct mnt_idmap *id
 	if (unlikely(((inode->i_mode & 0111) != 0111) || !no_acl_inode(inode)))
 		return inode_permission(idmap, inode, mask);
 
-	return security_inode_permission(inode, mask);
+	return security_inode_permission(idmap, inode, mask);
 }
 
 /**
@@ -4188,7 +4188,7 @@ int vfs_create(struct mnt_idmap *idmap, struct dentry *dentry, umode_t mode,
 		return -EACCES;	/* shouldn't it be ENOSYS? */
 
 	mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);
-	error = security_inode_create(dir, dentry, mode);
+	error = security_inode_create(idmap, dir, dentry, mode);
 	if (error)
 		return error;
 	error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di);
@@ -4212,7 +4212,7 @@ int vfs_mkobj(struct dentry *dentry, umode_t mode,
 
 	mode &= S_IALLUGO;
 	mode |= S_IFREG;
-	error = security_inode_create(dir, dentry, mode);
+	error = security_inode_create(&nop_mnt_idmap, dir, dentry, mode);
 	if (error)
 		return error;
 	error = f(dentry, mode, arg);
@@ -4328,7 +4328,7 @@ static int may_o_create(struct mnt_idmap *idmap,
 	if (error)
 		return error;
 
-	return security_inode_create(dir->dentry->d_inode, dentry, mode);
+	return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode);
 }
 
 /**
@@ -5258,7 +5258,7 @@ int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
 	if (error)
 		return error;
 
-	error = security_inode_mknod(dir, dentry, mode, dev);
+	error = security_inode_mknod(idmap, dir, dentry, mode, dev);
 	if (error)
 		return error;
 
@@ -5395,7 +5395,7 @@ struct dentry *vfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
 		goto err;
 
 	mode = vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, S_IFDIR);
-	error = security_inode_mkdir(dir, dentry, mode);
+	error = security_inode_mkdir(idmap, dir, dentry, mode);
 	if (error)
 		goto err;
 
@@ -5783,7 +5783,7 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
 	if (!dir->i_op->symlink)
 		return -EPERM;
 
-	error = security_inode_symlink(dir, dentry, oldname);
+	error = security_inode_symlink(idmap, dir, dentry, oldname);
 	if (error)
 		return error;
 
@@ -5907,7 +5907,7 @@ int vfs_link(struct dentry *old_dentry, struct mnt_idmap *idmap,
 	if (S_ISDIR(inode->i_mode))
 		return -EPERM;
 
-	error = security_inode_link(old_dentry, dir, new_dentry);
+	error = security_inode_link(idmap, old_dentry, dir, new_dentry);
 	if (error)
 		return error;
 
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 65c9609ec2077..9e49a5bc9ff3c 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -120,26 +120,27 @@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,
 	 int *xattr_count)
 LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
 	 const struct qstr *name, const struct inode *context_inode)
-LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
-	 umode_t mode)
+LSM_HOOK(int, 0, inode_create, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, umode_t mode)
 LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
 	 struct inode *inode)
-LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
-	 struct dentry *new_dentry)
+LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap,
+	 struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
 LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
-LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,
-	 const char *old_name)
-LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,
-	 umode_t mode)
+LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, const char *old_name)
+LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, umode_t mode)
 LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)
-LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,
-	 umode_t mode, dev_t dev)
+LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
+	 struct dentry *dentry, umode_t mode, dev_t dev)
 LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,
 	 struct inode *new_dir, struct dentry *new_dentry)
 LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)
 LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
 	 bool rcu)
-LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
+LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,
+	 struct inode *inode, int mask)
 LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,
 	 struct iattr *attr)
 LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
diff --git a/include/linux/security.h b/include/linux/security.h
index 153e9043058f8..0f5f20ac10507 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -404,24 +404,28 @@ int security_inode_init_security(struct inode *inode, struct inode *dir,
 int security_inode_init_security_anon(struct inode *inode,
 				      const struct qstr *name,
 				      const struct inode *context_inode);
-int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
+int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+			  struct dentry *dentry, umode_t mode);
 void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
 					struct inode *inode);
-int security_inode_link(struct dentry *old_dentry, struct inode *dir,
-			 struct dentry *new_dentry);
+int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			struct inode *dir, struct dentry *new_dentry);
 int security_inode_unlink(struct inode *dir, struct dentry *dentry);
-int security_inode_symlink(struct inode *dir, struct dentry *dentry,
-			   const char *old_name);
-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
+int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+			   struct dentry *dentry, const char *old_name);
+int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode);
 int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
-int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
+int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode, dev_t dev);
 int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
 			  struct inode *new_dir, struct dentry *new_dentry,
 			  unsigned int flags);
 int security_inode_readlink(struct dentry *dentry);
 int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
 			       bool rcu);
-int security_inode_permission(struct inode *inode, int mask);
+int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+			      int mask);
 int security_inode_setattr(struct mnt_idmap *idmap,
 			   struct dentry *dentry, struct iattr *attr);
 void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
@@ -902,9 +906,10 @@ static inline int security_inode_init_security_anon(struct inode *inode,
 	return 0;
 }
 
-static inline int security_inode_create(struct inode *dir,
-					 struct dentry *dentry,
-					 umode_t mode)
+static inline int security_inode_create(struct mnt_idmap *idmap,
+					struct inode *dir,
+					struct dentry *dentry,
+					umode_t mode)
 {
 	return 0;
 }
@@ -913,9 +918,10 @@ static inline void
 security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
 { }
 
-static inline int security_inode_link(struct dentry *old_dentry,
-				       struct inode *dir,
-				       struct dentry *new_dentry)
+static inline int security_inode_link(struct mnt_idmap *idmap,
+				      struct dentry *old_dentry,
+				      struct inode *dir,
+				      struct dentry *new_dentry)
 {
 	return 0;
 }
@@ -926,16 +932,18 @@ static inline int security_inode_unlink(struct inode *dir,
 	return 0;
 }
 
-static inline int security_inode_symlink(struct inode *dir,
-					  struct dentry *dentry,
-					  const char *old_name)
+static inline int security_inode_symlink(struct mnt_idmap *idmap,
+					 struct inode *dir,
+					 struct dentry *dentry,
+					 const char *old_name)
 {
 	return 0;
 }
 
-static inline int security_inode_mkdir(struct inode *dir,
-					struct dentry *dentry,
-					int mode)
+static inline int security_inode_mkdir(struct mnt_idmap *idmap,
+				       struct inode *dir,
+				       struct dentry *dentry,
+				       int mode)
 {
 	return 0;
 }
@@ -946,9 +954,10 @@ static inline int security_inode_rmdir(struct inode *dir,
 	return 0;
 }
 
-static inline int security_inode_mknod(struct inode *dir,
-					struct dentry *dentry,
-					int mode, dev_t dev)
+static inline int security_inode_mknod(struct mnt_idmap *idmap,
+				       struct inode *dir,
+				       struct dentry *dentry,
+				       int mode, dev_t dev)
 {
 	return 0;
 }
@@ -974,7 +983,8 @@ static inline int security_inode_follow_link(struct dentry *dentry,
 	return 0;
 }
 
-static inline int security_inode_permission(struct inode *inode, int mask)
+static inline int security_inode_permission(struct mnt_idmap *idmap,
+					    struct inode *inode, int mask)
 {
 	return 0;
 }
diff --git a/security/security.c b/security/security.c
index 2ee276ab15c5b..a9190da3341dd 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1614,6 +1614,7 @@ int security_path_chroot(const struct path *path)
 
 /**
  * security_inode_create() - Check if creating a file is allowed
+ * @idmap: idmap of the mount
  * @dir: the parent directory
  * @dentry: the file being created
  * @mode: requested file mode
@@ -1622,12 +1623,12 @@ int security_path_chroot(const struct path *path)
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_create(struct inode *dir, struct dentry *dentry,
-			  umode_t mode)
+int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+			  struct dentry *dentry, umode_t mode)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_create, dir, dentry, mode);
+	return call_int_hook(inode_create, idmap, dir, dentry, mode);
 }
 EXPORT_SYMBOL_GPL(security_inode_create);
 
@@ -1648,6 +1649,7 @@ void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
 
 /**
  * security_inode_link() - Check if creating a hard link is allowed
+ * @idmap: idmap of the mount
  * @old_dentry: existing file
  * @dir: new parent directory
  * @new_dentry: new link
@@ -1656,12 +1658,12 @@ void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_link(struct dentry *old_dentry, struct inode *dir,
-			struct dentry *new_dentry)
+int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			struct inode *dir, struct dentry *new_dentry)
 {
 	if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry))))
 		return 0;
-	return call_int_hook(inode_link, old_dentry, dir, new_dentry);
+	return call_int_hook(inode_link, idmap, old_dentry, dir, new_dentry);
 }
 
 /**
@@ -1682,6 +1684,7 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry)
 
 /**
  * security_inode_symlink() - Check if creating a symbolic link is allowed
+ * @idmap: idmap of the mount
  * @dir: parent directory
  * @dentry: symbolic link
  * @old_name: existing filename
@@ -1690,16 +1693,17 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry)
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_symlink(struct inode *dir, struct dentry *dentry,
-			   const char *old_name)
+int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+			   struct dentry *dentry, const char *old_name)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_symlink, dir, dentry, old_name);
+	return call_int_hook(inode_symlink, idmap, dir, dentry, old_name);
 }
 
 /**
  * security_inode_mkdir() - Check if creating a new directory is allowed
+ * @idmap: idmap of the mount
  * @dir: parent directory
  * @dentry: new directory
  * @mode: new directory mode
@@ -1709,11 +1713,12 @@ int security_inode_symlink(struct inode *dir, struct dentry *dentry,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_mkdir, dir, dentry, mode);
+	return call_int_hook(inode_mkdir, idmap, dir, dentry, mode);
 }
 EXPORT_SYMBOL_GPL(security_inode_mkdir);
 
@@ -1735,6 +1740,7 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
 
 /**
  * security_inode_mknod() - Check if creating a special file is allowed
+ * @idmap: idmap of the mount
  * @dir: parent directory
  * @dentry: new file
  * @mode: new file mode
@@ -1747,12 +1753,12 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry)
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_mknod(struct inode *dir, struct dentry *dentry,
-			 umode_t mode, dev_t dev)
+int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+			 struct dentry *dentry, umode_t mode, dev_t dev)
 {
 	if (unlikely(IS_PRIVATE(dir)))
 		return 0;
-	return call_int_hook(inode_mknod, dir, dentry, mode, dev);
+	return call_int_hook(inode_mknod, idmap, dir, dentry, mode, dev);
 }
 
 /**
@@ -1823,6 +1829,7 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
 
 /**
  * security_inode_permission() - Check if accessing an inode is allowed
+ * @idmap: idmap of the mount
  * @inode: inode
  * @mask: access mask
  *
@@ -1835,11 +1842,12 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
  *
  * Return: Returns 0 if permission is granted.
  */
-int security_inode_permission(struct inode *inode, int mask)
+int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+			      int mask)
 {
 	if (unlikely(IS_PRIVATE(inode)))
 		return 0;
-	return call_int_hook(inode_permission, inode, mask);
+	return call_int_hook(inode_permission, idmap, inode, mask);
 }
 
 /**
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 035aaf113d1da..967984d0af300 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3074,12 +3074,14 @@ static int selinux_inode_init_security_anon(struct inode *inode,
 			    &ad);
 }
 
-static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
+static int selinux_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+				struct dentry *dentry, umode_t mode)
 {
 	return may_create(dir, dentry, SECCLASS_FILE);
 }
 
-static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
+static int selinux_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			      struct inode *dir, struct dentry *new_dentry)
 {
 	return may_link(dir, old_dentry, MAY_LINK);
 }
@@ -3089,12 +3091,14 @@ static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
 	return may_link(dir, dentry, MAY_UNLINK);
 }
 
-static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
+static int selinux_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+				 struct dentry *dentry, const char *name)
 {
 	return may_create(dir, dentry, SECCLASS_LNK_FILE);
 }
 
-static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
+static int selinux_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+			       struct dentry *dentry, umode_t mask)
 {
 	return may_create(dir, dentry, SECCLASS_DIR);
 }
@@ -3104,7 +3108,8 @@ static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
 	return may_link(dir, dentry, MAY_RMDIR);
 }
 
-static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
+static int selinux_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+			       struct dentry *dentry, umode_t mode, dev_t dev)
 {
 	return may_create(dir, dentry, inode_mode_to_security_class(mode));
 }
@@ -3236,13 +3241,15 @@ static inline void task_avdcache_update(struct task_security_struct *tsec,
 
 /**
  * selinux_inode_permission - Check if the current task can access an inode
+ * @idmap: idmap of the mount
  * @inode: the inode that is being accessed
  * @requested: the accesses being requested
  *
  * Check if the current task is allowed to access @inode according to
  * @requested.  Returns 0 if allowed, negative values otherwise.
  */
-static int selinux_inode_permission(struct inode *inode, int requested)
+static int selinux_inode_permission(struct mnt_idmap *idmap,
+				    struct inode *inode, int requested)
 {
 	int mask;
 	u32 perms;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 8e88ac65fd7fc..a45819d13c0d6 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1089,14 +1089,15 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
 
 /**
  * smack_inode_link - Smack check on link
+ * @idmap: idmap of the mount
  * @old_dentry: the existing object
  * @dir: unused
  * @new_dentry: the new object
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
-			    struct dentry *new_dentry)
+static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+			    struct inode *dir, struct dentry *new_dentry)
 {
 	struct smack_known *isp;
 	struct smk_audit_info ad;
@@ -1226,6 +1227,7 @@ static int smack_inode_rename(struct inode *old_inode,
 
 /**
  * smack_inode_permission - Smack version of permission()
+ * @idmap: idmap of the mount
  * @inode: the inode in question
  * @mask: the access requested
  *
@@ -1233,7 +1235,8 @@ static int smack_inode_rename(struct inode *old_inode,
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_permission(struct inode *inode, int mask)
+static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
+				  int mask)
 {
 	struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
 	struct smk_audit_info ad;
diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
index d7495efd4a562..c0ae813698ae2 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
@@ -1,18 +1,30 @@
 // SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
 
 /*
  * Copyright (C) 2020 Google LLC.
  */
 
 #include <test_progs.h>
+#include <sched.h>
+#include <signal.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
+#include <linux/mount.h>
+
 #include "lsm.skel.h"
 #include "lsm_tailcall.skel.h"
 
 char *CMD_ARGS[] = {"true", NULL};
 
+enum {
+	INODE_IDMAP_ALL = (1U << 6) - 1,
+};
+
 int exec_cmd(int *monitored_pid)
 {
 	int child_pid, child_status;
@@ -30,6 +42,219 @@ int exec_cmd(int *monitored_pid)
 	return -EINVAL;
 }
 
+static ssize_t write_nointr(int fd, const void *buf, size_t count)
+{
+	ssize_t ret;
+
+	do {
+		ret = write(fd, buf, count);
+	} while (ret < 0 && errno == EINTR);
+
+	return ret;
+}
+
+static int write_file(const char *path, const char *value)
+{
+	size_t len = strlen(value);
+	int fd, saved_errno = 0;
+	ssize_t ret;
+
+	fd = open(path, O_WRONLY | O_CLOEXEC | O_NOCTTY | O_NOFOLLOW);
+	if (fd < 0)
+		return -1;
+
+	ret = write_nointr(fd, value, len);
+	if (ret < 0)
+		saved_errno = errno;
+	else if ((size_t)ret != len)
+		saved_errno = EIO;
+	close(fd);
+	if (saved_errno) {
+		errno = saved_errno;
+		return -1;
+	}
+	return 0;
+}
+
+static int write_userns_file(pid_t pid, const char *name, const char *value)
+{
+	char path[64];
+	int len;
+
+	len = snprintf(path, sizeof(path), "/proc/%d/%s", pid, name);
+	if (len < 0 || (size_t)len >= sizeof(path)) {
+		errno = EOVERFLOW;
+		return -1;
+	}
+
+	return write_file(path, value);
+}
+
+static int create_userns_fd(void)
+{
+	char path[64];
+	pid_t pid, waited;
+	int fd = -1, len, saved_errno, status;
+
+	pid = fork();
+	if (pid < 0)
+		return -1;
+	if (pid == 0) {
+		if (unshare(CLONE_NEWUSER))
+			_exit(1);
+		raise(SIGSTOP);
+		_exit(0);
+	}
+
+	do {
+		waited = waitpid(pid, &status, WUNTRACED);
+	} while (waited < 0 && errno == EINTR);
+	if (waited != pid)
+		goto out;
+	if (!WIFSTOPPED(status)) {
+		pid = -1;
+		goto out;
+	}
+
+	/* A one-entry map is identity for root but remains distinct from nop_mnt_idmap. */
+	if (write_userns_file(pid, "setgroups", "deny") && errno != ENOENT)
+		goto out;
+	if (write_userns_file(pid, "uid_map", "0 0 1") ||
+	    write_userns_file(pid, "gid_map", "0 0 1"))
+		goto out;
+
+	len = snprintf(path, sizeof(path), "/proc/%d/ns/user", pid);
+	if (len < 0 || (size_t)len >= sizeof(path)) {
+		errno = EOVERFLOW;
+		goto out;
+	}
+	fd = open(path, O_RDONLY | O_CLOEXEC);
+
+out:
+	saved_errno = errno;
+	if (pid > 0) {
+		kill(pid, SIGKILL);
+		do {
+			waited = waitpid(pid, NULL, 0);
+		} while (waited < 0 && errno == EINTR);
+	}
+	errno = saved_errno;
+	return fd;
+}
+
+static int create_idmapped_tmpfs(void)
+{
+	struct mount_attr attr = {
+		.attr_set = MOUNT_ATTR_IDMAP,
+	};
+	int fsfd = -1, mntfd = -1, saved_errno, userns_fd = -1;
+
+	userns_fd = create_userns_fd();
+	if (userns_fd < 0)
+		goto out;
+
+	/* A detached tmpfs avoids relying on the host test directory supporting idmaps. */
+	fsfd = syscall(__NR_fsopen, "tmpfs", FSOPEN_CLOEXEC);
+	if (fsfd < 0)
+		goto out;
+	if (syscall(__NR_fsconfig, fsfd, FSCONFIG_CMD_CREATE, NULL, NULL, 0))
+		goto out;
+
+	mntfd = syscall(__NR_fsmount, fsfd, FSMOUNT_CLOEXEC, 0);
+	if (mntfd < 0)
+		goto out;
+
+	attr.userns_fd = userns_fd;
+	if (syscall(__NR_mount_setattr, mntfd, "", AT_EMPTY_PATH, &attr,
+		    sizeof(attr))) {
+		close(mntfd);
+		mntfd = -1;
+	}
+
+out:
+	saved_errno = errno;
+	if (fsfd >= 0)
+		close(fsfd);
+	if (userns_fd >= 0)
+		close(userns_fd);
+	errno = saved_errno;
+	return mntfd;
+}
+
+static int exercise_inode_idmap_hooks(int dirfd)
+{
+	int fd = -1, ret = -1;
+
+	fd = openat(dirfd, "file", O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC,
+		    0600);
+	if (!ASSERT_GE(fd, 0, "create"))
+		goto out;
+	close(fd);
+	fd = -1;
+
+	if (!ASSERT_OK(mkdirat(dirfd, "dir", 0700), "mkdir"))
+		goto out;
+	if (!ASSERT_OK(symlinkat("target", dirfd, "symlink"), "symlink"))
+		goto out;
+	if (!ASSERT_OK(linkat(dirfd, "file", dirfd, "link", 0), "link"))
+		goto out;
+	if (!ASSERT_OK(mkfifoat(dirfd, "fifo", 0600), "mknod"))
+		goto out;
+
+	ret = 0;
+out:
+	if (fd >= 0)
+		close(fd);
+	unlinkat(dirfd, "link", 0);
+	unlinkat(dirfd, "fifo", 0);
+	unlinkat(dirfd, "symlink", 0);
+	unlinkat(dirfd, "file", 0);
+	unlinkat(dirfd, "dir", AT_REMOVEDIR);
+	return ret;
+}
+
+static int test_lsm_inode_idmap(struct lsm *skel)
+{
+	char tmpdir[] = "/var/tmp/test_lsm_idmap.XXXXXX";
+	__u32 expected = INODE_IDMAP_ALL;
+	int dirfd = -1, idmapped_dirfd = -1;
+	int ret = -1;
+
+	if (!ASSERT_OK_PTR(mkdtemp(tmpdir), "mkdtemp"))
+		return -1;
+
+	dirfd = open(tmpdir, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+	if (!ASSERT_GE(dirfd, 0, "open_tmpdir"))
+		goto out;
+
+	idmapped_dirfd = create_idmapped_tmpfs();
+	if (!ASSERT_GE(idmapped_dirfd, 0, "create_idmapped_tmpfs"))
+		goto out;
+
+	skel->bss->inode_identity_idmap_seen = 0;
+	skel->bss->inode_idmapped_mount_seen = 0;
+
+	if (!ASSERT_OK(exercise_inode_idmap_hooks(dirfd), "identity_idmap"))
+		goto out;
+	if (!ASSERT_OK(exercise_inode_idmap_hooks(idmapped_dirfd),
+		       "idmapped_mount"))
+		goto out;
+
+	if (!ASSERT_EQ(skel->bss->inode_identity_idmap_seen, expected,
+		       "inode_identity_idmap_seen"))
+		goto out;
+	ret = ASSERT_EQ(skel->bss->inode_idmapped_mount_seen, expected,
+			"inode_idmapped_mount_seen") ? 0 : -1;
+
+out:
+	if (idmapped_dirfd >= 0)
+		close(idmapped_dirfd);
+	if (dirfd >= 0)
+		close(dirfd);
+	rmdir(tmpdir);
+	return ret;
+}
+
 static int test_lsm(struct lsm *skel)
 {
 	struct bpf_link *link;
@@ -53,6 +278,10 @@ static int test_lsm(struct lsm *skel)
 
 	skel->bss->monitored_pid = getpid();
 
+	err = test_lsm_inode_idmap(skel);
+	if (!ASSERT_OK(err, "test_lsm_inode_idmap"))
+		return err;
+
 	err = stack_mprotect();
 	if (!ASSERT_EQ(err, -1, "stack_mprotect") ||
 	    !ASSERT_EQ(errno, EPERM, "stack_mprotect"))
@@ -71,6 +300,8 @@ static int test_lsm(struct lsm *skel)
 	skel->bss->copy_test = 0;
 	skel->bss->bprm_count = 0;
 	skel->bss->mprotect_count = 0;
+	skel->bss->inode_identity_idmap_seen = 0;
+	skel->bss->inode_idmapped_mount_seen = 0;
 	return 0;
 }
 
diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selftests/bpf/progs/lsm.c
index 7de173daf27b6..7e32fbddbfadf 100644
--- a/tools/testing/selftests/bpf/progs/lsm.c
+++ b/tools/testing/selftests/bpf/progs/lsm.c
@@ -84,6 +84,85 @@ char _license[] SEC("license") = "GPL";
 int monitored_pid = 0;
 int mprotect_count = 0;
 int bprm_count = 0;
+__u32 inode_identity_idmap_seen = 0;
+__u32 inode_idmapped_mount_seen = 0;
+
+enum {
+	INODE_IDMAP_CREATE	= 1U << 0,
+	INODE_IDMAP_LINK	= 1U << 1,
+	INODE_IDMAP_SYMLINK	= 1U << 2,
+	INODE_IDMAP_MKDIR	= 1U << 3,
+	INODE_IDMAP_MKNOD	= 1U << 4,
+	INODE_IDMAP_PERMISSION	= 1U << 5,
+};
+
+static __always_inline bool is_monitored_idmap(struct mnt_idmap *idmap)
+{
+	__u32 pid = bpf_get_current_pid_tgid() >> 32;
+
+	return monitored_pid == pid && idmap;
+}
+
+static __always_inline bool is_identity_idmap(struct mnt_idmap *idmap)
+{
+	return idmap->uid_map.nr_extents == 0 &&
+	       idmap->gid_map.nr_extents == 0;
+}
+
+static __always_inline int record_inode_idmap(struct mnt_idmap *idmap,
+					      __u32 hook, int ret)
+{
+	if (ret || !is_monitored_idmap(idmap))
+		return ret;
+	if (is_identity_idmap(idmap))
+		inode_identity_idmap_seen |= hook;
+	else
+		inode_idmapped_mount_seen |= hook;
+	return 0;
+}
+
+SEC("lsm/inode_create")
+int BPF_PROG(test_inode_create, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, umode_t mode, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_CREATE, ret);
+}
+
+SEC("lsm/inode_link")
+int BPF_PROG(test_inode_link, struct mnt_idmap *idmap,
+	     struct dentry *old_dentry, struct inode *dir,
+	     struct dentry *new_dentry, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_LINK, ret);
+}
+
+SEC("lsm/inode_symlink")
+int BPF_PROG(test_inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, const char *old_name, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_SYMLINK, ret);
+}
+
+SEC("lsm/inode_mkdir")
+int BPF_PROG(test_inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, umode_t mode, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_MKDIR, ret);
+}
+
+SEC("lsm/inode_mknod")
+int BPF_PROG(test_inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
+	     struct dentry *dentry, umode_t mode, dev_t dev, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_MKNOD, ret);
+}
+
+SEC("lsm/inode_permission")
+int BPF_PROG(test_inode_permission, struct mnt_idmap *idmap,
+	     struct inode *inode, int mask, int ret)
+{
+	return record_inode_idmap(idmap, INODE_IDMAP_PERMISSION, ret);
+}
 
 SEC("lsm/file_mprotect")
 int BPF_PROG(test_int_hook, struct vm_area_struct *vma,

							input: 13561
							output: 19
							thoughts: 482

**Analyzing the Patch for LSM Hook Integration**

Okay, let's dive into this patch. The commit message simply indicates it's a patch under review related to syz-cluster. I'm seeing changes across a few core areas: `fs/cachefiles/security.c`, `fs/namei.c`, a couple of include files (`linux/lsm_hook_defs.h` and `linux/security.h`), and the `security` directory itself with `security.c`, `selinux/hooks.c`, and `smack/smack_lsm.c`.  I'm also seeing a change in the bpf selftests.

What immediately catches my eye is that this patch is passing a `struct mnt_idmap *idmap` down into a handful of LSM hooks. Specifically, the following are being modified to accept the `idmap`: `security_inode_create`, `security_inode_link`, `security_inode_symlink`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_permission`.

Taking a closer look at the impacted LSM implementations, I see a pattern.  SELinuX (`selinux_inode_...`) and Smack (`smack_inode_...`) are being updated to simply accept the new `idmap` parameter to match the function prototype; it's a straight-forward addition to their signatures.  In `fs/cachefiles/security.c`, it's passing `&nop_mnt_idmap`, which makes sense. `fs/namei.c` seems to be passing either the `idmap` or `&nop_mnt_idmap` as well. The bpf selftests are also being updated to handle the new hook signatures.

My immediate next thought is to verify that these are the only LSM implementations affected and that there are no uninitialized memory risks. Let me quickly run a `grep` to ensure no other LSM hooks or callers are lurking that might have been missed. We need to be exhaustive here to ensure we aren't introducing unintended consequences.

{
  "Expression": "security_inode_create"
}

{
  "Output": "fs/cachefiles/security.c=49=static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,\n--\nfs/cachefiles/security.c-60-\nfs/cachefiles/security.c:61:\tret = security_inode_create(\u0026nop_mnt_idmap, d_backing_inode(root), root, 0);\nfs/cachefiles/security.c-62-\tif (ret \u003c 0)\n--\nfs/namei.c=4177=int vfs_create(struct mnt_idmap *idmap, struct dentry *dentry, umode_t mode,\n--\nfs/namei.c-4190-\tmode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);\nfs/namei.c:4191:\terror = security_inode_create(idmap, dir, dentry, mode);\nfs/namei.c-4192-\tif (error)\n--\nfs/namei.c=4204=int vfs_mkobj(struct dentry *dentry, umode_t mode,\n--\nfs/namei.c-4214-\tmode |= S_IFREG;\nfs/namei.c:4215:\terror = security_inode_create(\u0026nop_mnt_idmap, dir, dentry, mode);\nfs/namei.c-4216-\tif (error)\n--\nfs/namei.c=4315=static int may_o_create(struct mnt_idmap *idmap,\n--\nfs/namei.c-4330-\nfs/namei.c:4331:\treturn security_inode_create(idmap, dir-\u003edentry-\u003ed_inode, dentry, mode);\nfs/namei.c-4332-}\n--\ninclude/linux/security.h=404=int security_inode_init_security_anon(struct inode *inode,\n--\ninclude/linux/security.h-406-\t\t\t\t      const struct inode *context_inode);\ninclude/linux/security.h:407:int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,\ninclude/linux/security.h-408-\t\t\t  struct dentry *dentry, umode_t mode);\n--\ninclude/linux/security.h=902=static inline int security_inode_init_security_anon(struct inode *inode,\n--\ninclude/linux/security.h-908-\ninclude/linux/security.h:909:static inline int security_inode_create(struct mnt_idmap *idmap,\ninclude/linux/security.h-910-\t\t\t\t\tstruct inode *dir,\n--\nsecurity/security.c=1609=int security_path_chroot(const struct path *path)\n--\nsecurity/security.c-1615-/**\nsecurity/security.c:1616: * security_inode_create() - Check if creating a file is allowed\nsecurity/security.c-1617- * @idmap: idmap of the mount\n--\nsecurity/security.c-1625- */\nsecurity/security.c:1626:int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,\nsecurity/security.c-1627-\t\t\t  struct dentry *dentry, umode_t mode)\n--\nsecurity/security.c-1632-}\nsecurity/security.c:1633:EXPORT_SYMBOL_GPL(security_inode_create);\nsecurity/security.c-1634-\n"
}

							input: 15420
							output: 25
							thoughts: 84

**My Security-Focused Review**

Okay, time to methodically dig into this security aspect. I need to refresh my understanding of how this particular system handles inode permissions and creation. My focus right now is on the core security mechanisms. First, I'm going to quickly audit the standard LSM hooks that are likely involved: specifically, `security_inode_permission`, `security_inode_link`, `security_inode_mkdir`, `security_inode_mknod`, and `security_inode_symlink`. That seems like a good starting point.

But I also need to think more broadly. Are there *any* other LSM implementations active on this system? I need to be aware of potentially conflicting or overlapping behaviors from things like AppArmor, Landlock, Tomoyo, or any other custom LSMs that might have been deployed. That's critical. I'm going to search across the other LSMs for relevant hooks, focusing on `inode_permission` or `inode_create`. Finding the intersection of these implementations is the key to understanding the full security picture here. I can't afford to miss a single layer.

{
  "Expression": "inode_permission",
  "PathPrefix": "security/"
}

{
  "Output": "security/security.c=1225=static void inode_free_by_rcu(struct rcu_head *head)\n--\nsecurity/security.c-1241- * security_inode_free(), @inode may still be referenced in a VFS path walk\nsecurity/security.c:1242: * and calls to security_inode_permission() may be made during, or after,\nsecurity/security.c-1243- * a call to security_inode_free().  For this reason the inode-\u003ei_security\nsecurity/security.c-1244- * field is released via a call_rcu() callback and any LSMs which need to\nsecurity/security.c:1245: * retain inode state for use in security_inode_permission() should only\nsecurity/security.c-1246- * release that state in the inode_free_security_rcu() LSM hook callback.\n--\nsecurity/security.c=1822=int security_inode_follow_link(struct dentry *dentry, struct inode *inode,\n--\nsecurity/security.c-1830-/**\nsecurity/security.c:1831: * security_inode_permission() - Check if accessing an inode is allowed\nsecurity/security.c-1832- * @idmap: idmap of the mount\n--\nsecurity/security.c-1844- */\nsecurity/security.c:1845:int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\nsecurity/security.c-1846-\t\t\t      int mask)\n--\nsecurity/security.c-1849-\t\treturn 0;\nsecurity/security.c:1850:\treturn call_int_hook(inode_permission, idmap, inode, mask);\nsecurity/security.c-1851-}\n--\nsecurity/security.c=2727=int security_file_receive(struct file *file)\n--\nsecurity/security.c-2736- * Save open-time permission checking state for later use upon file_permission,\nsecurity/security.c:2737: * and recheck access if anything has changed since inode_permission.\nsecurity/security.c-2738- *\n--\nsecurity/selinux/hooks.c=3130=static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,\n--\nsecurity/selinux/hooks.c-3145-\nsecurity/selinux/hooks.c:3146:static noinline int audit_inode_permission(struct inode *inode,\nsecurity/selinux/hooks.c-3147-\t\t\t\t\t   u32 perms, u32 audited, u32 denied,\n--\nsecurity/selinux/hooks.c=3223=static inline void task_avdcache_update(struct task_security_struct *tsec,\n--\nsecurity/selinux/hooks.c-3242-/**\nsecurity/selinux/hooks.c:3243: * selinux_inode_permission - Check if the current task can access an inode\nsecurity/selinux/hooks.c-3244- * @idmap: idmap of the mount\n--\nsecurity/selinux/hooks.c-3250- */\nsecurity/selinux/hooks.c:3251:static int selinux_inode_permission(struct mnt_idmap *idmap,\nsecurity/selinux/hooks.c-3252-\t\t\t\t    struct inode *inode, int requested)\n--\nsecurity/selinux/hooks.c-3299-\nsecurity/selinux/hooks.c:3300:\trc2 = audit_inode_permission(inode, perms, audited, denied, rc);\nsecurity/selinux/hooks.c-3301-\tif (rc2)\n--\nsecurity/selinux/hooks.c=4263=static int selinux_file_open(struct file *file)\n--\nsecurity/selinux/hooks.c-4280-\t * Since the inode label or policy seqno may have changed\nsecurity/selinux/hooks.c:4281:\t * between the selinux_inode_permission check and the saving\nsecurity/selinux/hooks.c-4282-\t * of state above, recheck that access is still permitted.\n--\nsecurity/selinux/hooks.c=7567=static struct security_hook_list selinux_hooks[] __ro_after_init = {\n--\nsecurity/selinux/hooks.c-7617-\tLSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),\nsecurity/selinux/hooks.c:7618:\tLSM_HOOK_INIT(inode_permission, selinux_inode_permission),\nsecurity/selinux/hooks.c-7619-\tLSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),\n--\nsecurity/smack/smack_lsm.c=1020=static int smack_inode_init_security(struct inode *inode, struct inode *dir,\n--\nsecurity/smack/smack_lsm.c-1033-\t * UNIX domain sockets use lower level socket data. Let\nsecurity/smack/smack_lsm.c:1034:\t * UDS inode have fixed * label to keep smack_inode_permission() calm\nsecurity/smack/smack_lsm.c-1035-\t * when called from unix_find_bsd()\n--\nsecurity/smack/smack_lsm.c=1203=static int smack_inode_rename(struct inode *old_inode,\n--\nsecurity/smack/smack_lsm.c-1228-/**\nsecurity/smack/smack_lsm.c:1229: * smack_inode_permission - Smack version of permission()\nsecurity/smack/smack_lsm.c-1230- * @idmap: idmap of the mount\n--\nsecurity/smack/smack_lsm.c-1237- */\nsecurity/smack/smack_lsm.c:1238:static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode,\nsecurity/smack/smack_lsm.c-1239-\t\t\t\t  int mask)\n--\nsecurity/smack/smack_lsm.c=5158=static struct security_hook_list smack_hooks[] __ro_after_init = {\n--\nsecurity/smack/smack_lsm.c-5180-\tLSM_HOOK_INIT(inode_rename, smack_inode_rename),\nsecurity/smack/smack_lsm.c:5181:\tLSM_HOOK_INIT(inode_permission, smack_inode_permission),\nsecurity/smack/smack_lsm.c-5182-\tLSM_HOOK_INIT(inode_setattr, smack_inode_setattr),\n"
}

							input: 17497
							output: 204
							thoughts: 709

**KMSAN Assessment: No Need for Dedicated Fuzzing**

Alright, let's break this down. My initial assessment is that this patch is a refactor, primarily concerning the propagation of the `struct mnt_idmap *idmap` through several inode LSM hooks and their corresponding callers. My thought process is clear:

First, the patch modifies the signatures of the inode LSM hooks—`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`—to include the `idmap` parameter. The VFS callers in `fs/namei.c` and `fs/cachefiles/security.c` are updated to correctly pass the `idmap` (or `&nop_mnt_idmap`) into the relevant security wrappers. This change also extends to implementations such as SELinux, Smack and LSM BPF which also update to accommodate the new parameter. I've got to consider if any uninitialized memory risks are involved, so I go through a mental checklist:

1.  **Kernel-to-userspace data transfer:** Nothing new is exposed or copied to userspace. No changes to `copy_to_user`, `put_user`, netlink, or ioctl are happening here.
2.  **Conditional logic and uninitialized variables:** The `idmap` pointer being passed around is a valid pointer originating from VFS callers, or the safe `&nop_mnt_idmap`. I'm not seeing any scenarios where conditional logic depends on an uninitialized variable.
3.  **Complex data structure allocation and initialization:** No new allocations or complex data structure initializations are introduced in the kernel's code path.
4.  **Bounds checks or other logic that could expose uninitialized memory:** There's no manipulation of memory, bounds checks, or logic that would allow reading uninitialized memory.

Based on this, KMSAN is unlikely to identify any issues. This is because the patch is primarily changing function signatures to propagate an existing parameter, not introducing new memory access patterns that KMSAN excels at catching. Any potential issues would likely manifest as null pointer dereferences or incorrect pointers which are types of memory errors that KASAN (Kernel Address Sanitizer) is well-equipped to detect. KMSAN is great for catching *uninitialized* memory access, which isn't present here.

Therefore, the `NeedsKMSAN` flag is `false`.

Now, I'll solidify the reasoning:

*   The patch's core function is extending LSM hooks with the `struct mnt_idmap *idmap` parameter.
*   No new memory allocations, heap/stack buffers, or uninitialized variables are introduced.
*   No kernel-to-user memory copy operations or interactions are modified or added.
*   The change is about plumbing an existing pointer (`idmap` / `&nop_mnt_idmap`).
*   Any potential bugs would likely be pointer-related, and standard KASAN and kernel fault handling would catch them.
*   Thus, there's no risk of uninitialized memory issues or information leaks, and no dedicated KMSAN fuzzing is necessary.
I'm satisfied with this analysis, and now I'll call the `set-results` tool.

{
  "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap *idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch extends several inode-related LSM hooks (`inode_create`, `inode_link`, `inode_symlink`, `inode_mkdir`, `inode_mknod`, and `inode_permission`) and their wrappers by passing `struct mnt_idmap *idmap`. It also updates SELinux and Smack implementations and adds BPF LSM selftests for idmapped mounts.\n\nThis change is purely a function signature and parameter plumbing update across VFS and LSM interfaces. No new memory allocations or stack/heap buffers are introduced in the kernel, and no data structures copied to user space or uninitialized variables are accessed. Any potential issues with pointer validity or dereferencing are standard memory safety concerns covered by KASAN and general kernel debugging rather than uninitialized memory issues detected by KMSAN. Therefore, a dedicated KMSAN fuzzing session is not needed.",
  "NeedsKMSAN": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)