From: Christian Brauner <brauner@kernel.org>
To: linux-fsdevel@vger.kernel.org, bpf@vger.kernel.org
Cc: linux-security-module@vger.kernel.org,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Paul Moore <paul@paul-moore.com>,
netdev@vger.kernel.org,
"Christian Brauner (Amutable)" <brauner@kernel.org>
Subject: [PATCH 3/8] selftests/bpf: add verifier tests for the namespace LSM hooks
Date: Mon, 26 Oct 2026 10:57:11 +0100 [thread overview]
Message-ID: <20261026-work-security-namespace_free-v1-3-ffa3ebbf71bd@kernel.org> (raw)
In-Reply-To: <20261026-work-security-namespace_free-v1-0-ffa3ebbf71bd@kernel.org>
Add a test kfunc that takes a trusted struct ns_common and check that:
- namespace_init and namespace_free arguments can't be passed to it
- namespace_install arguments can
The test fails if namespace_init and namespace_free are treated as
trusted.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/verifier.c | 2 ++
.../selftests/bpf/progs/verifier_lsm_namespace.c | 38 ++++++++++++++++++++++
.../testing/selftests/bpf/test_kmods/bpf_testmod.c | 5 +++
.../selftests/bpf/test_kmods/bpf_testmod_kfunc.h | 1 +
4 files changed, 46 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/verifier.c b/tools/testing/selftests/bpf/prog_tests/verifier.c
index 04740ba37e91..3963a4f71d98 100644
--- a/tools/testing/selftests/bpf/prog_tests/verifier.c
+++ b/tools/testing/selftests/bpf/prog_tests/verifier.c
@@ -147,6 +147,7 @@
#include "verifier_set_retval.skel.h"
#include "verifier_lsm.skel.h"
#include "verifier_lsm_init_xattr.skel.h"
+#include "verifier_lsm_namespace.skel.h"
#include "verifier_jit_inline.skel.h"
#include "irq.skel.h"
#include "verifier_ctx_ptr_param.skel.h"
@@ -337,6 +338,7 @@ void test_verifier_bits_iter(void) { RUN(verifier_bits_iter); }
void test_verifier_set_retval(void) { RUN(verifier_set_retval); }
void test_verifier_lsm(void) { RUN(verifier_lsm); }
void test_verifier_lsm_init_xattr(void) { RUN(verifier_lsm_init_xattr); }
+void test_verifier_lsm_namespace(void) { RUN_TESTS(verifier_lsm_namespace); }
void test_irq(void) { RUN(irq); }
void test_verifier_mtu(void) { RUN(verifier_mtu); }
void test_verifier_jit_inline(void) { RUN(verifier_jit_inline); }
diff --git a/tools/testing/selftests/bpf/progs/verifier_lsm_namespace.c b/tools/testing/selftests/bpf/progs/verifier_lsm_namespace.c
new file mode 100644
index 000000000000..d14fa2363dcc
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/verifier_lsm_namespace.c
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+#include "bpf_misc.h"
+#include "../test_kmods/bpf_testmod_kfunc.h"
+
+/* The namespace hasn't been set up yet. */
+SEC("lsm/namespace_init")
+__failure __msg("R1 must be referenced or trusted")
+int BPF_PROG(namespace_init_untrusted, struct ns_common *ns)
+{
+ bpf_kfunc_trusted_ns_test(ns);
+ return 0;
+}
+
+/* The namespace is being torn down. */
+SEC("lsm/namespace_free")
+__failure __msg("R1 must be referenced or trusted")
+int BPF_PROG(namespace_free_untrusted, struct ns_common *ns)
+{
+ bpf_kfunc_trusted_ns_test(ns);
+ return 0;
+}
+
+/* setns() holds a reference to a fully set up namespace. */
+SEC("lsm/namespace_install")
+__success
+int BPF_PROG(namespace_install_trusted, const struct nsset *nsset,
+ struct ns_common *ns)
+{
+ bpf_kfunc_trusted_ns_test(ns);
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
index 6380f52f4dd2..8d6bd2237f34 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod.c
@@ -350,6 +350,10 @@ __bpf_kfunc void bpf_kfunc_trusted_task_test(struct task_struct *ptr)
{
}
+__bpf_kfunc void bpf_kfunc_trusted_ns_test(struct ns_common *ptr)
+{
+}
+
__bpf_kfunc struct task_struct *bpf_kfunc_trusted_null_test(void)
{
return NULL;
@@ -1030,6 +1034,7 @@ BTF_ID_FLAGS(func, bpf_kfunc_nested_acquire_zero_offset_test, KF_ACQUIRE)
BTF_ID_FLAGS(func, bpf_kfunc_nested_release_test, KF_RELEASE)
BTF_ID_FLAGS(func, bpf_kfunc_trusted_vma_test)
BTF_ID_FLAGS(func, bpf_kfunc_trusted_task_test)
+BTF_ID_FLAGS(func, bpf_kfunc_trusted_ns_test)
BTF_ID_FLAGS(func, bpf_kfunc_trusted_null_test, KF_RET_NULL)
BTF_ID_FLAGS(func, bpf_kfunc_trusted_nullable_test)
BTF_ID_FLAGS(func, bpf_kfunc_trusted_num_test)
diff --git a/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h b/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h
index 3b810f1e438f..bc32c4078d27 100644
--- a/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h
+++ b/tools/testing/selftests/bpf/test_kmods/bpf_testmod_kfunc.h
@@ -355,6 +355,7 @@ int bpf_kfunc_st_ops_inc10(struct st_ops_args *args) __ksym;
void bpf_kfunc_trusted_vma_test(struct vm_area_struct *ptr) __ksym;
void bpf_kfunc_trusted_task_test(struct task_struct *ptr) __ksym;
+void bpf_kfunc_trusted_ns_test(struct ns_common *ptr) __ksym;
struct task_struct *bpf_kfunc_trusted_null_test(void) __ksym;
void bpf_kfunc_trusted_nullable_test(struct task_struct *ptr__nullable) __ksym;
void bpf_kfunc_trusted_num_test(int *ptr) __ksym;
--
2.53.0
next prev parent reply other threads:[~2026-10-26 9:57 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-26 9:57 [PATCH 0/8] ns: fixes for the namespace LSM hooks Christian Brauner
2026-10-26 9:57 ` [PATCH 1/8] lsm: always call the namespace_free hook Christian Brauner
2026-10-26 9:57 ` [PATCH 2/8] bpf: don't mark namespace_init and namespace_free arguments as trusted Christian Brauner
2026-10-26 9:57 ` Christian Brauner [this message]
2026-10-26 9:57 ` [PATCH 4/8] landlock: pass the namespace id to log to check_ns_type() Christian Brauner
2026-10-26 9:57 ` [PATCH 5/8] ns: allocate the namespace id before the namespace_init hook Christian Brauner
2026-10-26 9:57 ` [PATCH 6/8] nstree: drop ns_tree_add_raw() Christian Brauner
2026-10-26 9:57 ` [PATCH 7/8] lsm: fix the security_namespace_init() kernel-doc Christian Brauner
2026-10-26 9:57 ` [PATCH 8/8] selftests/bpf: add a lifecycle test for the namespace LSM hooks Christian Brauner
2026-10-26 20:31 ` [PATCH 0/8] ns: fixes " Paul Moore
2026-10-27 9:24 ` Christian Brauner
2026-10-27 14:36 ` Daniel Borkmann
2026-10-27 22:37 ` Paul Moore
2026-10-28 10:42 ` Christian Brauner
2026-10-28 15:59 ` Paul Moore
2026-10-26 23:31 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261026-work-security-namespace_free-v1-3-ffa3ebbf71bd@kernel.org \
--to=brauner@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox