[PATCH] userns: security: Inform LSMs of capability check during userns creation

[PATCH] userns: security: Inform LSMs of capability check during userns creation

[Bradley Morgan]

Right now security_capable() gets called in create_user_ns() to snapshot
whether the parent could setfcap, but the LSM gets zero context on where
the check actually came from. It is the same story as setid: without a
dedicated flag, security modules cannot tell this apart from regular
capability checks.

Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().

Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
---
Thanks Christian for the suggestion :).
---
 include/linux/security.h | 2 ++
 kernel/user_namespace.c  | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index 40831fab54709..d24666a0b4833 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -75,6 +75,8 @@ struct nsset;
 #define CAP_OPT_NOAUDIT BIT(1)
 /* If capable is being called by a setid function */
 #define CAP_OPT_INSETID BIT(2)
+/* Is capable being called from the user namespace creation path? */
+#define CAP_OPT_USERNS_CREATE BIT(3)
 
 /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
 #define SECURITY_LSM_NATIVE_LABELS	1
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 57b7f10be74e1..37480f6d8369f 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
 	 * audit: the creator may never map uid 0.
 	 */
 	ns->parent_could_setfcap =
-		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
+		!security_capable(new, parent_ns, CAP_SETFCAP,
+				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
 
 	ret = ns_common_init(ns);
 	if (ret)
-- 
2.53.0

Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation

[Serge E. Hallyn]

On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
> Right now security_capable() gets called in create_user_ns() to snapshot
> whether the parent could setfcap, but the LSM gets zero context on where
> the check actually came from. It is the same story as setid: without a
> dedicated flag, security modules cannot tell this apart from regular
> capability checks.
> 
> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().

This should be patch 1/N in a set that introduces a user of it
in some lsm.

> Suggested-by: Christian Brauner <brauner@kernel.org>
> Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
> ---
> Thanks Christian for the suggestion :).
> ---
>  include/linux/security.h | 2 ++
>  kernel/user_namespace.c  | 3 ++-
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 40831fab54709..d24666a0b4833 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -75,6 +75,8 @@ struct nsset;
>  #define CAP_OPT_NOAUDIT BIT(1)
>  /* If capable is being called by a setid function */
>  #define CAP_OPT_INSETID BIT(2)
> +/* Is capable being called from the user namespace creation path? */
> +#define CAP_OPT_USERNS_CREATE BIT(3)
>  
>  /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>  #define SECURITY_LSM_NATIVE_LABELS	1
> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
> index 57b7f10be74e1..37480f6d8369f 100644
> --- a/kernel/user_namespace.c
> +++ b/kernel/user_namespace.c
> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>  	 * audit: the creator may never map uid 0.
>  	 */
>  	ns->parent_could_setfcap =
> -		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
> +		!security_capable(new, parent_ns, CAP_SETFCAP,
> +				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>  
>  	ret = ns_common_init(ns);
>  	if (ret)
> -- 
> 2.53.0

Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation

[Bradley Morgan]

On 13 November 2026 21:39:33 GMT, "Serge E. Hallyn" <serge@hallyn.com>
wrote:
>On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
>> Right now security_capable() gets called in create_user_ns() to snapshot
>> whether the parent could setfcap, but the LSM gets zero context on where
>> the check actually came from. It is the same story as setid: without a
>> dedicated flag, security modules cannot tell this apart from regular
>> capability checks.
>> 
>> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
>
>This should be patch 1/N in a set that introduces a user of it
>in some lsm.

hmm. Did you read Christians suggestion? Let's see if Christian or anyone
else could suggest a nice little lsm user for this.

If nobody responds, in coming days, I'll go and find and do a user for it.

>
>> Suggested-by: Christian Brauner <brauner@kernel.org>
>> Link:
>https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
>> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
>> ---
>> Thanks Christian for the suggestion :).
>> ---
>>  include/linux/security.h | 2 ++
>>  kernel/user_namespace.c  | 3 ++-
>>  2 files changed, 4 insertions(+), 1 deletion(-)
>> 
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index 40831fab54709..d24666a0b4833 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -75,6 +75,8 @@ struct nsset;
>>  #define CAP_OPT_NOAUDIT BIT(1)
>>  /* If capable is being called by a setid function */
>>  #define CAP_OPT_INSETID BIT(2)
>> +/* Is capable being called from the user namespace creation path? */
>> +#define CAP_OPT_USERNS_CREATE BIT(3)
>>  
>>  /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>>  #define SECURITY_LSM_NATIVE_LABELS	1
>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>> index 57b7f10be74e1..37480f6d8369f 100644
>> --- a/kernel/user_namespace.c
>> +++ b/kernel/user_namespace.c
>> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>>  	 * audit: the creator may never map uid 0.
>>  	 */
>>  	ns->parent_could_setfcap =
>> -		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
>> +		!security_capable(new, parent_ns, CAP_SETFCAP,
>> +				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>>  
>>  	ret = ns_common_init(ns);
>>  	if (ret)
>> -- 
>> 2.53.0
>

--- Thanks!

Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation

[Serge Hallyn]

Nov 13, 2026 15:54:37 Bradley Morgan <bradley.morgan@linux.dev>:

> On 13 November 2026 21:39:33 GMT, "Serge E. Hallyn" <serge@hallyn.com>
> wrote:
>> On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
>>> Right now security_capable() gets called in create_user_ns() to snapshot
>>> whether the parent could setfcap, but the LSM gets zero context on where
>>> the check actually came from. It is the same story as setid: without a
>>> dedicated flag, security modules cannot tell this apart from regular
>>> capability checks.
>>>
>>> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
>>
>> This should be patch 1/N in a set that introduces a user of it
>> in some lsm.
>
> hmm. Did you read Christians suggestion?

I did, when he first sent it. Actually it seems to me that what the lsm would really like to know is that this is not for an immediate use of setfcap, but possible future use. But that doesn't really matter. I wasn't judging the patch. I was just going by what i believe is general lsm subsystem policy.

> Let's see if Christian or anyone
> else could suggest a nice little lsm user for this.
>
> If nobody responds, in coming days, I'll go and find and do a user for it.
>
>>
>>> Suggested-by: Christian Brauner <brauner@kernel.org>
>>> Link:
>> https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
>>> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
>>> ---
>>> Thanks Christian for the suggestion :).
>>> ---
>>> include/linux/security.h | 2 ++
>>> kernel/user_namespace.c  | 3 ++-
>>> 2 files changed, 4 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/include/linux/security.h b/include/linux/security.h
>>> index 40831fab54709..d24666a0b4833 100644
>>> --- a/include/linux/security.h
>>> +++ b/include/linux/security.h
>>> @@ -75,6 +75,8 @@ struct nsset;
>>> #define CAP_OPT_NOAUDIT BIT(1)
>>> /* If capable is being called by a setid function */
>>> #define CAP_OPT_INSETID BIT(2)
>>> +/* Is capable being called from the user namespace creation path? */
>>> +#define CAP_OPT_USERNS_CREATE BIT(3)
>>>
>>> /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>>> #define SECURITY_LSM_NATIVE_LABELS 1
>>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>>> index 57b7f10be74e1..37480f6d8369f 100644
>>> --- a/kernel/user_namespace.c
>>> +++ b/kernel/user_namespace.c
>>> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>>>      * audit: the creator may never map uid 0.
>>>      */
>>>     ns->parent_could_setfcap =
>>> -       !security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
>>> +       !security_capable(new, parent_ns, CAP_SETFCAP,
>>> +                 CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>>>
>>>     ret = ns_common_init(ns);
>>>     if (ret)
>>> --
>>> 2.53.0
>>
>
> --- Thanks!

Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation

[Bradley Morgan]

On 14 November 2026 14:34:07 GMT, Serge Hallyn <serge@hallyn.com> wrote:
>Nov 13, 2026 15:54:37 Bradley Morgan <bradley.morgan@linux.dev>:
>
>> On 13 November 2026 21:39:33 GMT, "Serge E. Hallyn" <serge@hallyn.com>
>> wrote:
>>> On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
>>>> Right now security_capable() gets called in create_user_ns() to
>snapshot
>>>> whether the parent could setfcap, but the LSM gets zero context on
>where
>>>> the check actually came from. It is the same story as setid: without a
>>>> dedicated flag, security modules cannot tell this apart from regular
>>>> capability checks.
>>>>
>>>> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
>>>
>>> This should be patch 1/N in a set that introduces a user of it
>>> in some lsm.
>>
>> hmm. Did you read Christians suggestion?
>
>I did, when he first sent it. Actually it seems to me that what the lsm
>would really like to know is that this is not for an immediate use of
>setfcap, but possible future use. But that doesn't really matter. I wasn't
>judging the patch. I was just going by what i believe is general lsm
>subsystem policy.

( my word wrapping client did not like that message :( )

hmm, it's pre-reqed over the patch as on the lore link, so Christian may
want to have a look at this obe

>
>> Let's see if Christian or anyone
>> else could suggest a nice little lsm user for this.
>>
>> If nobody responds, in coming days, I'll go and find and do a user for
>it.
>>
>>>
>>>> Suggested-by: Christian Brauner <brauner@kernel.org>
>>>> Link:
>>>
>https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
>>>> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
>>>> ---
>>>> Thanks Christian for the suggestion :).
>>>> ---
>>>> include/linux/security.h | 2 ++
>>>> kernel/user_namespace.c  | 3 ++-
>>>> 2 files changed, 4 insertions(+), 1 deletion(-)
>>>>
>>>> diff --git a/include/linux/security.h b/include/linux/security.h
>>>> index 40831fab54709..d24666a0b4833 100644
>>>> --- a/include/linux/security.h
>>>> +++ b/include/linux/security.h
>>>> @@ -75,6 +75,8 @@ struct nsset;
>>>> #define CAP_OPT_NOAUDIT BIT(1)
>>>> /* If capable is being called by a setid function */
>>>> #define CAP_OPT_INSETID BIT(2)
>>>> +/* Is capable being called from the user namespace creation path? */
>>>> +#define CAP_OPT_USERNS_CREATE BIT(3)
>>>>
>>>> /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>>>> #define SECURITY_LSM_NATIVE_LABELS 1
>>>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>>>> index 57b7f10be74e1..37480f6d8369f 100644
>>>> --- a/kernel/user_namespace.c
>>>> +++ b/kernel/user_namespace.c
>>>> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>>>>      * audit: the creator may never map uid 0.
>>>>      */
>>>>     ns->parent_could_setfcap =
>>>> -       !security_capable(new, parent_ns, CAP_SETFCAP,
>CAP_OPT_NOAUDIT);
>>>> +       !security_capable(new, parent_ns, CAP_SETFCAP,
>>>> +                 CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>>>>
>>>>     ret = ns_common_init(ns);
>>>>     if (ret)
>>>> --
>>>> 2.53.0
>>>
>>
>> --- Thanks!
>
>

--- Thanks!