Re: [PATCH 0/2] lsm: expose mount idmaps to inode hooks

[Christian Brauner <brauner@kernel.org>]

> OverlayFS performs upper-layer operations through inode-based security
> hooks. Those hooks receive the upper inode and dentry, but not the mount
> idmap used by the VFS operation.
> 
> The security layer cannot distinguish an identity-mapped upper from an
> idmapped one or make the same ownership decision as the VFS. The VFS
> layer already passes the idmap down into all relevant inode operations
> so this just brings the security hooks to parity.

Yes, I didn't do it initially but this has been on my ToDo for quite a while.
Thanks for doing this.

> 
> So pass the mount idmap through the create, link, symlink, mkdir, mknod,
> and permission hooks. Update the in-tree security implementations and
> non-VFS callers accordingly.
> 
> systemd has been shipping systemd-nsresourced for quite a while now. It
> relies on inode and path hooks to perform ownership checks using a bpf lsm.
> To make this actually secure we need to be able to calculate the on-disk
> ownership from the idmap.

All looks good to me, but you need to resend with your SoB added.
I think you dropped this because systemd doesn't require it.

Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>

--