[PATCH] userns: security: Inform LSMs of capability check during userns creation

[Bradley Morgan <bradley.morgan@linux.dev>]

Right now security_capable() gets called in create_user_ns() to snapshot
whether the parent could setfcap, but the LSM gets zero context on where
the check actually came from. It is the same story as setid: without a
dedicated flag, security modules cannot tell this apart from regular
capability checks.

Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().

Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
---
Thanks Christian for the suggestion :).
---
 include/linux/security.h | 2 ++
 kernel/user_namespace.c  | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index 40831fab54709..d24666a0b4833 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -75,6 +75,8 @@ struct nsset;
 #define CAP_OPT_NOAUDIT BIT(1)
 /* If capable is being called by a setid function */
 #define CAP_OPT_INSETID BIT(2)
+/* Is capable being called from the user namespace creation path? */
+#define CAP_OPT_USERNS_CREATE BIT(3)
 
 /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
 #define SECURITY_LSM_NATIVE_LABELS	1
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 57b7f10be74e1..37480f6d8369f 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
 	 * audit: the creator may never map uid 0.
 	 */
 	ns->parent_could_setfcap =
-		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
+		!security_capable(new, parent_ns, CAP_SETFCAP,
+				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
 
 	ret = ns_common_init(ns);
 	if (ret)
-- 
2.53.0