From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f44.google.com (mail-ed1-f44.google.com [209.85.208.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0DB6139D0A for ; Mon, 23 Feb 2026 10:36:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771842987; cv=none; b=sow0maiKgnAB5ET0L7OYptSj388dDYJz/MDBLiwarQkSsfm4UOc8OZ5mrFWxG4pFYD1/hVMRoT+6zGLMbExGuIGvj8e+6P+jLQEGT7AExHZztxfsHkV8akUxKR/f+FmILSv6ppg7mbzbNiJHS9L+itpE+2DlgxQ549A9lT/FieM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771842987; c=relaxed/simple; bh=JSLGqiSDjgElRV2goR5pCQttJXW9o2ylgPNe8z4u/P8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=OkcLcTwD6Follc5LSblqu+bJRzQnVZxKYlD+h0OBhJv1ll0L4EDmet/eJUouiDEQZuUjYM01Oa6hkSuNHaXVxw6nHPN9gKm9GMHkzmyCjVFPDxbqh9IqeQU/2gOcfrTjaJtWH5mE4Re27WS0OiQet3BBHmbZcoTboEV7WUNqLig= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=o/QeRXVG; arc=none smtp.client-ip=209.85.208.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="o/QeRXVG" Received: by mail-ed1-f44.google.com with SMTP id 4fb4d7f45d1cf-65a3fdeb7d9so5835738a12.0 for ; Mon, 23 Feb 2026 02:36:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1771842984; x=1772447784; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=DXAUAzqkpnDd1Jzh6Y9R0674dRENosx/WyoGcsLMZB0=; b=o/QeRXVGkLtE7tIxRNXuCMtYfoq02XkANB5WGxk/FdzXyKsxvQwa21XY02qmkhPeMD Hx7WCDYvAgK3XJ+l7C+YI/BVtdJzQkr3BVywfNvPE319wymcnFQNRA4lml7RIG8u576x nSRV9k2OpXJ52vSKBHoIgC41hTLk5k6wdiTZUPM0lT5m3yj3NhiNY3NH6qeXxjNpj6UC fC+pmKYQ48L9MuqSvi+LhaDk+DhI5KU2MSp7rDKent+OGHWjE/w6CpITBP7wwJIJ7LvK +wK0mfjFqytr9fm6U8qUgjzOkxFfJJ1Oq4+2KSJv8GnmtDUj7DY1ef3DS/1gWibpgW8D 6WIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771842984; x=1772447784; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=DXAUAzqkpnDd1Jzh6Y9R0674dRENosx/WyoGcsLMZB0=; b=AWhBc8purMhUQb2mEKxqyk5+3XEyYyJZLusejO3D5ZrzCbclg9iG/+gJpJYcjVHl32 znwZo8i4R11R54Z6rD3hZjZ+pREPONHFAu0Gv5P09UQF5MEXPox/7naxU/1wkF+6ixXu Vdy3whr8W0ntqRYFkvovY1TUuAotTLEzkvLjO/d2CvxQiXtT+l7Q595UlFIvUskrNcmn JxWqEkVLOT1Xf6EuAYO49VPcNi3foZqmFV1pAfxdIXyxWy3TBfMa6CH0Vvifj3sze5aI sbB2c1GaliwX2XmDvKLLg0bMwjWzcWUTUAi9xwQZ4tgBmtTG54EjnPjuczdPMj4vkuOu rYZw== X-Forwarded-Encrypted: i=1; AJvYcCWEm2vPf8NRW9GBDqG59Ff3he5F6I/Z0Hhv/uxG3V3sq5olI7Rkrr85sFDKoFFDN8UooCgZ5iRDoBqxSg4=@vger.kernel.org X-Gm-Message-State: AOJu0YxJeYn4b73XSkE5ibOdAJBBNIFlTvpvZs46jHT+J40ihIo7dHPT X+oqAHMMctkbwepm8uJfhr1tZkfyScSYjYxmELy5KxNGAafCe7pK8cxVnNOsFdVXsw== X-Gm-Gg: AZuq6aIG3TMUI6kMOd+Q9FkBJEynz/Bx5nyVAMLy75uNAd9dof6Zpt9SyLgWZdKBs8M Q830zWoF7lRH6ULOFMdzG7l88lrsQUPEn7/F57eZ6BW2lhIAxltAUC9JwjCc5Xb5ReRKzh4DMjf t9MOkKa285PIcx/dpWmMOfhyPXMrqpVcU9c0EYDq1A6rEY9vTqa96Ro1PRW+AauSgxO3PWvrt3M 2tYaus7T5i2qILK0vpPD7LMO5pyblFIMyjJQpBGnHoRBSEssUeOkHEe98Y7vnNZnbIgdBTZDSXD VjlOGrkLIZysnJWHkwcADcfurov2NW9jhZmPx6pmPHbXG231idZXN3XwnG2oo+t4G4e+FBYzCWA GkWBhKwV0aO2O7hJTvK5e/s0Hc1j96rE4Pd000nGKBZBATXZ0dBjegjPKu1PBu59oUZGsjTI1fH 1C37N74MCHTjbEFwBIAhk11ZP9ve1Avf05neic0pxW8SdvVCRyWlBEWE9POyrSH74= X-Received: by 2002:a17:907:3e83:b0:b7f:f862:df26 with SMTP id a640c23a62f3a-b9081a0251bmr477474066b.14.1771842983799; Mon, 23 Feb 2026 02:36:23 -0800 (PST) Received: from google.com (93.50.90.34.bc.googleusercontent.com. [34.90.50.93]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-b9084c5d47fsm300893566b.11.2026.02.23.02.36.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 23 Feb 2026 02:36:23 -0800 (PST) Date: Mon, 23 Feb 2026 10:36:19 +0000 From: Matt Bobrowski To: Christian Brauner Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Tejun Heo , KP Singh , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, Lennart Poettering Subject: Re: [PATCH 1/4] ns: add bpf hooks Message-ID: References: <20260220-work-bpf-namespace-v1-0-866207db7b83@kernel.org> <20260220-work-bpf-namespace-v1-1-866207db7b83@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260220-work-bpf-namespace-v1-1-866207db7b83@kernel.org> On Fri, Feb 20, 2026 at 01:38:29AM +0100, Christian Brauner wrote: > Add the three namespace lifecycle hooks and make them available to bpf > lsm program types. This allows bpf to supervise namespace creation. I'm > in the process of adding various "universal truth" bpf programs to > systemd that will make use of this. This e.g., allows to lock in a > program into a given set of namespaces. > > Signed-off-by: Christian Brauner > --- > include/linux/bpf_lsm.h | 21 +++++++++++++++++++++ > kernel/bpf/bpf_lsm.c | 25 +++++++++++++++++++++++++ > kernel/nscommon.c | 9 ++++++++- > kernel/nsproxy.c | 7 +++++++ > 4 files changed, 61 insertions(+), 1 deletion(-) > > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h > index 643809cc78c3..5ae438fdf567 100644 > --- a/include/linux/bpf_lsm.h > +++ b/include/linux/bpf_lsm.h > @@ -12,6 +12,9 @@ > #include > #include > > +struct ns_common; > +struct nsset; > + > #ifdef CONFIG_BPF_LSM > > #define LSM_HOOK(RET, DEFAULT, NAME, ...) \ > @@ -48,6 +51,11 @@ void bpf_lsm_find_cgroup_shim(const struct bpf_prog *prog, bpf_func_t *bpf_func) > > int bpf_lsm_get_retval_range(const struct bpf_prog *prog, > struct bpf_retval_range *range); > + > +int bpf_lsm_namespace_alloc(struct ns_common *ns); > +void bpf_lsm_namespace_free(struct ns_common *ns); > +int bpf_lsm_namespace_install(struct nsset *nsset, struct ns_common *ns); > + > int bpf_set_dentry_xattr_locked(struct dentry *dentry, const char *name__str, > const struct bpf_dynptr *value_p, int flags); > int bpf_remove_dentry_xattr_locked(struct dentry *dentry, const char *name__str); > @@ -104,6 +112,19 @@ static inline bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog) > { > return false; > } > + > +static inline int bpf_lsm_namespace_alloc(struct ns_common *ns) > +{ > + return 0; > +} > +static inline void bpf_lsm_namespace_free(struct ns_common *ns) > +{ > +} > +static inline int bpf_lsm_namespace_install(struct nsset *nsset, > + struct ns_common *ns) > +{ > + return 0; > +} > #endif /* CONFIG_BPF_LSM */ > > #endif /* _LINUX_BPF_LSM_H */ > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > index 0c4a0c8e6f70..f6378db46220 100644 > --- a/kernel/bpf/bpf_lsm.c > +++ b/kernel/bpf/bpf_lsm.c > @@ -30,10 +30,32 @@ __weak noinline RET bpf_lsm_##NAME(__VA_ARGS__) \ > #include > #undef LSM_HOOK > > +__bpf_hook_start(); > + > +__weak noinline int bpf_lsm_namespace_alloc(struct ns_common *ns) > +{ > + return 0; > +} > + > +__weak noinline void bpf_lsm_namespace_free(struct ns_common *ns) > +{ > +} > + > +__weak noinline int bpf_lsm_namespace_install(struct nsset *nsset, > + struct ns_common *ns) > +{ > + return 0; > +} > + > +__bpf_hook_end(); > + > #define LSM_HOOK(RET, DEFAULT, NAME, ...) BTF_ID(func, bpf_lsm_##NAME) > BTF_SET_START(bpf_lsm_hooks) > #include > #undef LSM_HOOK > +BTF_ID(func, bpf_lsm_namespace_alloc) > +BTF_ID(func, bpf_lsm_namespace_free) > +BTF_ID(func, bpf_lsm_namespace_install) > BTF_SET_END(bpf_lsm_hooks) > > BTF_SET_START(bpf_lsm_disabled_hooks) > @@ -383,6 +405,8 @@ BTF_ID(func, bpf_lsm_task_prctl) > BTF_ID(func, bpf_lsm_task_setscheduler) > BTF_ID(func, bpf_lsm_task_to_inode) > BTF_ID(func, bpf_lsm_userns_create) > +BTF_ID(func, bpf_lsm_namespace_alloc) > +BTF_ID(func, bpf_lsm_namespace_install) > BTF_SET_END(sleepable_lsm_hooks) > > BTF_SET_START(untrusted_lsm_hooks) > @@ -395,6 +419,7 @@ BTF_ID(func, bpf_lsm_sk_alloc_security) > BTF_ID(func, bpf_lsm_sk_free_security) > #endif /* CONFIG_SECURITY_NETWORK */ > BTF_ID(func, bpf_lsm_task_free) > +BTF_ID(func, bpf_lsm_namespace_free) > BTF_SET_END(untrusted_lsm_hooks) > > bool bpf_lsm_is_sleepable_hook(u32 btf_id) > diff --git a/kernel/nscommon.c b/kernel/nscommon.c > index bdc3c86231d3..c3613cab3d41 100644 > --- a/kernel/nscommon.c > +++ b/kernel/nscommon.c > @@ -1,6 +1,7 @@ > // SPDX-License-Identifier: GPL-2.0-only > /* Copyright (c) 2025 Christian Brauner */ > > +#include > #include > #include > #include > @@ -77,6 +78,7 @@ int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_ope > ret = proc_alloc_inum(&ns->inum); > if (ret) > return ret; > + > /* > * Tree ref starts at 0. It's incremented when namespace enters > * active use (installed in nsproxy) and decremented when all > @@ -86,11 +88,16 @@ int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_ope > atomic_set(&ns->__ns_ref_active, 1); > else > atomic_set(&ns->__ns_ref_active, 0); > - return 0; > + > + ret = bpf_lsm_namespace_alloc(ns); > + if (ret && !inum) > + proc_free_inum(ns->inum); > + return ret; > } > > void __ns_common_free(struct ns_common *ns) > { > + bpf_lsm_namespace_free(ns); > proc_free_inum(ns->inum); > } > > diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c > index 259c4b4f1eeb..5742f9664dbb 100644 > --- a/kernel/nsproxy.c > +++ b/kernel/nsproxy.c > @@ -9,6 +9,7 @@ > * Pavel Emelianov > */ > > +#include > #include > #include > #include > @@ -379,6 +380,12 @@ static int prepare_nsset(unsigned flags, struct nsset *nsset) > > static inline int validate_ns(struct nsset *nsset, struct ns_common *ns) > { > + int ret; > + > + ret = bpf_lsm_namespace_install(nsset, ns); > + if (ret) > + return ret; > + > return ns->ops->install(nsset, ns); > } What's the reason for not adding these new hook points to the generic set of hooks that are currently being exposed directly by the LSM framework? Honestly, it seems a little odd to be providing declarations/definitions for a set of new hook points which are to be exclusively siloed to BPF LSM implementations only. I'd argue that some other LSM implementations could very well find namespace lifecycle events possibly interesting.