* [PATCH] userns: security: Inform LSMs of capability check during userns creation
@ 2026-11-11 20:58 Bradley Morgan
2026-11-13 21:39 ` Serge E. Hallyn
0 siblings, 1 reply; 3+ messages in thread
From: Bradley Morgan @ 2026-11-11 20:58 UTC (permalink / raw)
To: Christian Brauner, Mickaël Salaün, Paul Moore,
Serge E . Hallyn, James Morris
Cc: Josef Bacik, linux-security-module, linux-kernel, Bradley Morgan
Right now security_capable() gets called in create_user_ns() to snapshot
whether the parent could setfcap, but the LSM gets zero context on where
the check actually came from. It is the same story as setid: without a
dedicated flag, security modules cannot tell this apart from regular
capability checks.
Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
---
Thanks Christian for the suggestion :).
---
include/linux/security.h | 2 ++
kernel/user_namespace.c | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index 40831fab54709..d24666a0b4833 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -75,6 +75,8 @@ struct nsset;
#define CAP_OPT_NOAUDIT BIT(1)
/* If capable is being called by a setid function */
#define CAP_OPT_INSETID BIT(2)
+/* Is capable being called from the user namespace creation path? */
+#define CAP_OPT_USERNS_CREATE BIT(3)
/* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
#define SECURITY_LSM_NATIVE_LABELS 1
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 57b7f10be74e1..37480f6d8369f 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
* audit: the creator may never map uid 0.
*/
ns->parent_could_setfcap =
- !security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
+ !security_capable(new, parent_ns, CAP_SETFCAP,
+ CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
ret = ns_common_init(ns);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation
2026-11-11 20:58 [PATCH] userns: security: Inform LSMs of capability check during userns creation Bradley Morgan
@ 2026-11-13 21:39 ` Serge E. Hallyn
2026-11-13 21:54 ` Bradley Morgan
0 siblings, 1 reply; 3+ messages in thread
From: Serge E. Hallyn @ 2026-11-13 21:39 UTC (permalink / raw)
To: Bradley Morgan
Cc: Christian Brauner, Mickaël Salaün, Paul Moore,
James Morris, Josef Bacik, linux-security-module, linux-kernel
On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
> Right now security_capable() gets called in create_user_ns() to snapshot
> whether the parent could setfcap, but the LSM gets zero context on where
> the check actually came from. It is the same story as setid: without a
> dedicated flag, security modules cannot tell this apart from regular
> capability checks.
>
> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
This should be patch 1/N in a set that introduces a user of it
in some lsm.
> Suggested-by: Christian Brauner <brauner@kernel.org>
> Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
> ---
> Thanks Christian for the suggestion :).
> ---
> include/linux/security.h | 2 ++
> kernel/user_namespace.c | 3 ++-
> 2 files changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 40831fab54709..d24666a0b4833 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -75,6 +75,8 @@ struct nsset;
> #define CAP_OPT_NOAUDIT BIT(1)
> /* If capable is being called by a setid function */
> #define CAP_OPT_INSETID BIT(2)
> +/* Is capable being called from the user namespace creation path? */
> +#define CAP_OPT_USERNS_CREATE BIT(3)
>
> /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
> #define SECURITY_LSM_NATIVE_LABELS 1
> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
> index 57b7f10be74e1..37480f6d8369f 100644
> --- a/kernel/user_namespace.c
> +++ b/kernel/user_namespace.c
> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
> * audit: the creator may never map uid 0.
> */
> ns->parent_could_setfcap =
> - !security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
> + !security_capable(new, parent_ns, CAP_SETFCAP,
> + CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>
> ret = ns_common_init(ns);
> if (ret)
> --
> 2.53.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation
2026-11-13 21:39 ` Serge E. Hallyn
@ 2026-11-13 21:54 ` Bradley Morgan
0 siblings, 0 replies; 3+ messages in thread
From: Bradley Morgan @ 2026-11-13 21:54 UTC (permalink / raw)
To: Serge E. Hallyn
Cc: Christian Brauner, Mickaël Salaün, Paul Moore,
James Morris, Josef Bacik, linux-security-module, linux-kernel
On 13 November 2026 21:39:33 GMT, "Serge E. Hallyn" <serge@hallyn.com>
wrote:
>On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
>> Right now security_capable() gets called in create_user_ns() to snapshot
>> whether the parent could setfcap, but the LSM gets zero context on where
>> the check actually came from. It is the same story as setid: without a
>> dedicated flag, security modules cannot tell this apart from regular
>> capability checks.
>>
>> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().
>
>This should be patch 1/N in a set that introduces a user of it
>in some lsm.
hmm. Did you read Christians suggestion? Let's see if Christian or anyone
else could suggest a nice little lsm user for this.
If nobody responds, in coming days, I'll go and find and do a user for it.
>
>> Suggested-by: Christian Brauner <brauner@kernel.org>
>> Link:
>https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
>> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
>> ---
>> Thanks Christian for the suggestion :).
>> ---
>> include/linux/security.h | 2 ++
>> kernel/user_namespace.c | 3 ++-
>> 2 files changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index 40831fab54709..d24666a0b4833 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -75,6 +75,8 @@ struct nsset;
>> #define CAP_OPT_NOAUDIT BIT(1)
>> /* If capable is being called by a setid function */
>> #define CAP_OPT_INSETID BIT(2)
>> +/* Is capable being called from the user namespace creation path? */
>> +#define CAP_OPT_USERNS_CREATE BIT(3)
>>
>> /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>> #define SECURITY_LSM_NATIVE_LABELS 1
>> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
>> index 57b7f10be74e1..37480f6d8369f 100644
>> --- a/kernel/user_namespace.c
>> +++ b/kernel/user_namespace.c
>> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>> * audit: the creator may never map uid 0.
>> */
>> ns->parent_could_setfcap =
>> - !security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
>> + !security_capable(new, parent_ns, CAP_SETFCAP,
>> + CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>>
>> ret = ns_common_init(ns);
>> if (ret)
>> --
>> 2.53.0
>
--- Thanks!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-11-13 21:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-11 20:58 [PATCH] userns: security: Inform LSMs of capability check during userns creation Bradley Morgan
2026-11-13 21:39 ` Serge E. Hallyn
2026-11-13 21:54 ` Bradley Morgan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox