Re: [PATCH 4/8] landlock: pass the namespace id to log to check_ns_type()

["Mickaël Salaün" <mic@digikod.net>]

On Mon, Oct 26, 2026 at 10:57:12AM +0100, Christian Brauner wrote:
> Landlock logs the namespace id when it denies the use of a namespace.
> check_ns_type() takes it from the namespace itself. When it is called
> from the namespace_init hook the id is always zero as it is only
> allocated after the hook has run.
> 
> A follow-up patch will allocate the id before the namespace_init hook is
> called. But a namespace whose creation is denied never becomes visible
> and the Landlock documentation says that namespace_id is zero for
> namespace creation (cf. Documentation/admin-guide/LSM/landlock.rst and
> Documentation/trace/events-landlock.rst). So pass the id to log to
> check_ns_type() and keep passing zero from hook_namespace_init().
> 
> No functional changes.
> 
> Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> Cc: <stable@kernel.org> # mainline only
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
> ---
>  security/landlock/ns.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/security/landlock/ns.c b/security/landlock/ns.c
> index cd44c927f83a..39795c4e1404 100644
> --- a/security/landlock/ns.c
> +++ b/security/landlock/ns.c
> @@ -90,15 +90,16 @@ static const struct access_masks ns_permission = {
>   * check_ns_type - Check namespace use permission
>   *
>   * @ns: The namespace being allocated or installed.
> + * @ns_id: The namespace id to log.
>   *
>   * Shared check for namespace_init (creation via clone(2), unshare(2),
>   * open_tree(2), or fsmount(2)) and namespace_install (use via setns(2)): denies
>   * when the namespace type is not in the domain's allowed set.  At allocation
> - * time @ns->ns_id is still zero and is logged as such.
> + * time the namespace isn't visible yet so @ns_id is zero.
>   *
>   * Return: 0 if allowed, -EPERM if denied.
>   */
> -static int check_ns_type(struct ns_common *const ns)
> +static int check_ns_type(struct ns_common *const ns, const u64 ns_id)
>  {
>  	const struct landlock_cred_security *subject;
>  	size_t denied_layer;
> @@ -121,7 +122,7 @@ static int check_ns_type(struct ns_common *const ns)
>  				    .permission =
>  					    LANDLOCK_PERMISSION_NAMESPACE_USE,
>  				    .audit.u.ns.ns_type = ns->ns_type,
> -				    .audit.u.ns.ns_id = ns->ns_id,
> +				    .audit.u.ns.ns_id = ns_id,
>  				    .layer_plus_one = denied_layer,
>  			    });
>  	return -EPERM;
> @@ -129,13 +130,13 @@ static int check_ns_type(struct ns_common *const ns)
>  
>  static int hook_namespace_init(struct ns_common *const ns)
>  {
> -	return check_ns_type(ns);
> +	return check_ns_type(ns, 0);

The use of 0 as a namespace ID in logs was mainly a consequence of the
hook implementation and the fact that no ID were visible to user space.
This changes with this series: the kernel allocates a new ID and other
LSMs see this newly created ID.  Landlock's logs should follow this
change consistently and always reflect the real namespace ID instead of
faking it with 0 for namespace creation.

Could you please update the doc and tests instead?  The doc should still
warn that when blocking a namespace creation, the logged namespace ID is
still not *directly* visible from user space.

Being able to differentiate namespace creation (i.e. when a namespace is
not yet reachable by user space) from a namespace enter operation is
important for Landlock from an observability point of view.  We then
need at least the Landlock tracepoints to make this possible.  I'm
working alongside what you're doing and I'll send patches next week.

>  }
>  
>  static int hook_namespace_install(const struct nsset *const nsset,
>  				  struct ns_common *const ns)
>  {
> -	return check_ns_type(ns);
> +	return check_ns_type(ns, ns->ns_id);
>  }
>  
>  static struct security_hook_list landlock_hooks[] __ro_after_init = {
> 
> -- 
> 2.53.0
> 
>