Re: [PATCH v3 7/7] lsm: Remove security_sb_mount and security_move_mount

[Paul Moore <paul@paul-moore.com>]

On May  8, 2026 Song Liu <song@kernel.org> wrote:
> 
> Now that all LSMs have been converted to granular mount hooks,
> remove the old hooks:
> 
> - security_sb_mount(): removed from lsm_hook_defs.h, security.h,
>   security.c, and its call in path_mount().
> - security_move_mount(): removed and replaced by security_mount_move()
>   in do_move_mount(). All LSMs now use mount_move exclusively.
> 
> Code generated with the assistance of Claude, reviewed by human.
> 
> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> Tested-by: Stephen Smalley <stephen.smalley.work@gmail.com> # for selinux only
> Signed-off-by: Song Liu <song@kernel.org>
> ---
>  fs/namespace.c                |  8 --------
>  include/linux/lsm_hook_defs.h |  4 ----
>  include/linux/security.h      | 16 ---------------
>  kernel/bpf/bpf_lsm.c          |  2 --
>  security/apparmor/lsm.c       |  1 -
>  security/landlock/fs.c        |  1 -
>  security/security.c           | 38 -----------------------------------
>  security/selinux/hooks.c      |  2 --
>  8 files changed, 72 deletions(-)

...

> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index e0a8a44c95aa..b0de7f316f51 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -1705,7 +1705,6 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = {
>  	LSM_HOOK_INIT(capget, apparmor_capget),
>  	LSM_HOOK_INIT(capable, apparmor_capable),
>  
> -	LSM_HOOK_INIT(move_mount, apparmor_move_mount),

This should be in patch 3/7 when you convert AppArmor over to the new
hooks.

>  	LSM_HOOK_INIT(mount_bind, apparmor_mount_bind),
>  	LSM_HOOK_INIT(mount_new, apparmor_mount_new),
>  	LSM_HOOK_INIT(mount_remount, apparmor_mount_remount),
> diff --git a/security/landlock/fs.c b/security/landlock/fs.c
> index 4547e736e496..7377f22a165e 100644
> --- a/security/landlock/fs.c
> +++ b/security/landlock/fs.c
> @@ -1983,7 +1983,6 @@ static struct security_hook_list landlock_hooks[] __ro_after_init = {
>  	LSM_HOOK_INIT(mount_reconfigure, hook_mount_reconfigure),
>  	LSM_HOOK_INIT(mount_change_type, hook_mount_change_type),
>  	LSM_HOOK_INIT(mount_move, hook_move_mount),
> -	LSM_HOOK_INIT(move_mount, hook_move_mount),

This should be in patch 5/7 when you convert Landlock.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 864a3ca772c9..c8de175bde04 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -7586,8 +7586,6 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = {
>  	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
>  	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
>  
> -	LSM_HOOK_INIT(move_mount, selinux_move_mount),

This should be in patch 4/7 when you convert SELinux.

>  	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
>  	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
>  
> -- 
> 2.53.0-Meta

--
paul-moore.com