Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation

[Bradley Morgan <bradley.morgan@linux.dev>]

On 13 November 2026 21:39:33 GMT, "Serge E. Hallyn" <serge@hallyn.com>
wrote:
>On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
>> Right now security_capable() gets called in create_user_ns() to snapshot
>> whether the parent could setfcap, but the LSM gets zero context on where
>> the check actually came from. It is the same story as setid: without a
>> dedicated flag, security modules cannot tell this apart from regular
>> capability checks.
>> 
>> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
>
>This should be patch 1/N in a set that introduces a user of it
>in some lsm.

hmm. Did you read Christians suggestion? Let's see if Christian or anyone
else could suggest a nice little lsm user for this.

If nobody responds, in coming days, I'll go and find and do a user for it.

>
>> Suggested-by: Christian Brauner <brauner@kernel.org>
>> Link:
>https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
>> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
>> ---
>> Thanks Christian for the suggestion :).
>> ---
>>  include/linux/security.h | 2 ++
>>  kernel/user_namespace.c  | 3 ++-
>>  2 files changed, 4 insertions(+), 1 deletion(-)
>> 
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index 40831fab54709..d24666a0b4833 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -75,6 +75,8 @@ struct nsset;
>>  #define CAP_OPT_NOAUDIT BIT(1)
>>  /* If capable is being called by a setid function */
>>  #define CAP_OPT_INSETID BIT(2)
>> +/* Is capable being called from the user namespace creation path? */
>> +#define CAP_OPT_USERNS_CREATE BIT(3)
>>  
>>  /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>>  #define SECURITY_LSM_NATIVE_LABELS	1
>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>> index 57b7f10be74e1..37480f6d8369f 100644
>> --- a/kernel/user_namespace.c
>> +++ b/kernel/user_namespace.c
>> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>>  	 * audit: the creator may never map uid 0.
>>  	 */
>>  	ns->parent_could_setfcap =
>> -		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
>> +		!security_capable(new, parent_ns, CAP_SETFCAP,
>> +				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>>  
>>  	ret = ns_common_init(ns);
>>  	if (ret)
>> -- 
>> 2.53.0
>

--- Thanks!