Re: [PATCH v3 3/12] security: Add LSM_AUDIT_DATA_NS for namespace audit records

["Mickaël Salaün" <mic@digikod.net>]

On Mon, Aug 31, 2026 at 05:26:20PM -0400, Paul Moore wrote:
> On Tue, Aug 11, 2026 at 4:16 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Jul 26, 2026 =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= <mic@digikod.net> wrote:
> > >
> > > Add a new LSM audit data type LSM_AUDIT_DATA_NS that logs namespace
> > > information in audit records.  Two fields are provided:
> > >
> > > - ns_type: the CLONE_NEW* flag identifying the namespace type, logged
> > >   in hexadecimal.
> > >
> > > - ns_id: the unique 64-bit namespace identifier, retrievable from
> > >   userspace via NS_GET_ID or listns(2).  Unlike the proc inode number
> > >   (inum), ns_id is never recycled.  For namespace creation denials,
> > >   ns_id is 0 because the namespace does not exist yet.
> >
> > Based on the code in this patch, "ns_type" should be "namespace_type"
> > and a similar change needs to be done for "ns_id".  Regardless, the
> > first three patches look fine to me (I can fixup the above during a
> > merge).
> >
> > As mentioned previously, I want to merge at least the first three
> > patches via the LSM tree since we have multiple LSMs which depend on
> > these new hooks.  I'm happy to also merge the remaining Landlock
> > patches in this patchset via the LSM tree, or you can manage those
> > separately; let me know how you would like to proceed with that.
> >
> > Since we are at -rc7, this is obviously something for after the
> > upcoming merge window so I'm going to merge the first three patches
> > into the lsm/dev-staging branch now with the understanding that they
> > will move over to the lsm/dev branch after the upcoming merge window
> > is finished.  If you want me to merge the Landlock patches too, just
> > let me know.
> 
> The first three patches are now in lsm/dev, thanks everyone.

Thanks.

> 
> Mickaël, if you would like me to merge the remaining patches in this
> patchset into the lsm/dev branch just let me know.

I'll send a new patch series soon because this v3 would not apply
anymore.  I'll include your lsm/dev patches to keep a consistent patch
series.