Re: [PATCH] ns: skip namespace_init LSM hook for internal namespaces

[sashiko-bot@kernel.org]

> mount_subtree() allocates a temporary mount namespace while resolving a
> path inside a detached mount.  btrfs mounts use this path on every mount
> (btrfs_get_tree() -> btrfs_get_tree_subvol() -> mount_subvol() ->
> mount_subtree()), as does NFS for referrals.  The namespace is private to
> mount_subtree(): it is never installed in an nsproxy, is not reachable
> from user space, and is freed before mount_subtree() returns.
> 
> __ns_common_init() calls security_namespace_init() for every namespace,
> which runs the LSM namespace_init hook.  Landlock implements
> LANDLOCK_PERMISSION_NAMESPACE_USE through that hook, so a task in a
> domain that handles the permission, allows every namespace type except
> CLONE_NEWNS, and is otherwise allowed to mount gets -EPERM from a btrfs
> mount.  mount(2) is not covered by the permission and the task never
> acquires a namespace.
> 
> [ ... ]
> the first domain with this fix.  With the first domain,
> unshare(CLONE_NEWNS) and open_tree(OPEN_TREE_CLONE) remain denied.
> 
> Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> Signed-off-by: Zhiqi Zhang <zhiqizhangg@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114141323.19029-1-zhiqizhangg@gmail.com?part=1