[PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[Stephen Smalley]

Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
added a security blob to struct ns_common and allocates it from
__ns_common_init(). Most initial namespaces (init_user_ns,
init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
however set up statically via NS_COMMON_INIT() and never pass through
__ns_common_init(), so their ns_security pointer is left NULL for the
lifetime of the system. Any LSM that registers an lbs_ns blob and
dereferences its slice on one of those namespaces (for example from
the namespace_install hook when a task setns()'s back into an initial
namespace) will fault.

Allocate the blob and run the namespace_init hook for each of these
namespaces at the end of security_init(), after all ordered LSMs have
registered their hooks, so every LSM sees the initial namespaces the
same way it sees init_net (which is initialized at runtime via
ns_common_init(&init_net) from net_ns_init() immediately after
security_init()) and does not need to special-case them in its own
->init() callback.

Provide a ns_common_init_security() helper in kernel/nscommon.c so
that the list of statically-defined initial namespaces and their
Kconfig guards live next to the rest of the ns_common
infrastructure. init_net is intentionally excluded: pre-initializing
it here would leak once __ns_common_init() clears ns_security and
re-allocates.

Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
v3 adds a Return: line in the kerneldoc for ns_common_init_security().

 include/linux/ns_common.h |  3 +++
 kernel/nscommon.c         | 49 +++++++++++++++++++++++++++++++++++++++
 security/lsm_init.c       |  4 ++++
 3 files changed, 56 insertions(+)

diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index c8e227a3f9e2..9321db8b82a1 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -11,6 +11,9 @@
 bool is_current_namespace(struct ns_common *ns);
 int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_operations *ops, int inum);
 void __ns_common_free(struct ns_common *ns);
+#ifdef CONFIG_SECURITY
+int ns_common_init_security(void);
+#endif
 struct ns_common *__must_check ns_owner(struct ns_common *ns);
 
 static __always_inline bool is_ns_init_inum(const struct ns_common *ns)
diff --git a/kernel/nscommon.c b/kernel/nscommon.c
index e72426bba29a..57e5074b97e3 100644
--- a/kernel/nscommon.c
+++ b/kernel/nscommon.c
@@ -1,11 +1,17 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /* Copyright (c) 2025 Christian Brauner <brauner@kernel.org> */
 
+#include <linux/cgroup.h>
+#include <linux/ipc_namespace.h>
+#include <linux/mnt_namespace.h>
 #include <linux/ns_common.h>
 #include <linux/nstree.h>
+#include <linux/pid_namespace.h>
 #include <linux/proc_ns.h>
 #include <linux/security.h>
+#include <linux/time_namespace.h>
 #include <linux/user_namespace.h>
+#include <linux/uts_namespace.h>
 #include <linux/vfsdebug.h>
 
 #ifdef CONFIG_DEBUG_VFS
@@ -101,6 +107,49 @@ int __ns_common_init(struct ns_common *ns, u32 ns_type, const struct proc_ns_ope
 	return 0;
 }
 
+/**
+ * ns_common_init_security - allocate LSM state for the initial namespaces
+ *
+ * The initial namespaces are set up statically via NS_COMMON_INIT() at compile
+ * time and therefore never pass through __ns_common_init(), so their LSM blob
+ * is left unallocated. Called from security_init() once all ordered LSMs are
+ * registered so every LSM's namespace_init hook fires on them the same way it
+ * does for init_net (which is initialized at runtime via
+ * ns_common_init(&init_net) from net_ns_init() and is therefore excluded
+ * here).
+ *
+ * Return: the first non-zero return from security_namespace_init(), or 0.
+ */
+#ifdef CONFIG_SECURITY
+int __init ns_common_init_security(void)
+{
+	struct ns_common *set[] = {
+		to_ns_common(&init_user_ns),
+		to_ns_common(&init_uts_ns),
+		to_ns_common(&init_pid_ns),
+		from_mnt_ns(&init_mnt_ns),
+#if defined(CONFIG_POSIX_MQUEUE) || defined(CONFIG_SYSVIPC)
+		to_ns_common(&init_ipc_ns),
+#endif
+#ifdef CONFIG_CGROUPS
+		to_ns_common(&init_cgroup_ns),
+#endif
+#ifdef CONFIG_TIME_NS
+		to_ns_common(&init_time_ns),
+#endif
+	};
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < ARRAY_SIZE(set); i++) {
+		ret = security_namespace_init(set[i]);
+		if (ret)
+			return ret;
+	}
+	return 0;
+}
+#endif
+
 void __ns_common_free(struct ns_common *ns)
 {
 	security_namespace_free(ns);
diff --git a/security/lsm_init.c b/security/lsm_init.c
index dbda7771013b..7cc2975b287a 100644
--- a/security/lsm_init.c
+++ b/security/lsm_init.c
@@ -7,6 +7,7 @@
 
 #include <linux/init.h>
 #include <linux/lsm_hooks.h>
+#include <linux/ns_common.h>
 
 #include "lsm.h"
 
@@ -490,6 +491,9 @@ int __init security_init(void)
 		lsm_init_single(*lsm);
 	}
 
+	if (ns_common_init_security())
+		panic("initial LSM ns alloc failed\n");
+
 	return 0;
 }
 
-- 
2.55.0

Re: [PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[sashiko-bot]

> Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> added a security blob to struct ns_common and allocates it from
> __ns_common_init(). Most initial namespaces (init_user_ns,
> init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
> configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
> however set up statically via NS_COMMON_INIT() and never pass through
> __ns_common_init(), so their ns_security pointer is left NULL for the
> lifetime of the system. Any LSM that registers an lbs_ns blob and
> dereferences its slice on one of those namespaces (for example from
> the namespace_install hook when a task setns()'s back into an initial
> namespace) will fault.
> 
> Allocate the blob and run the namespace_init hook for each of these
> namespaces at the end of security_init(), after all ordered LSMs have
> registered their hooks, so every LSM sees the initial namespaces the
> same way it sees init_net (which is initialized at runtime via
> ns_common_init(&init_net) from net_ns_init() immediately after
> security_init()) and does not need to special-case them in its own
> ->init() callback.
> 
> Provide a ns_common_init_security() helper in kernel/nscommon.c so
> that the list of statically-defined initial namespaces and their
> Kconfig guards live next to the rest of the ns_common
> infrastructure. init_net is intentionally excluded: pre-initializing
> it here would leak once __ns_common_init() clears ns_security and
> re-allocates.
> 
> Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918143142.19435-2-stephen.smalley.work@gmail.com?part=1

Re: [PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[Christian Brauner]

On Fri, Sep 18, 2026 at 10:31:43AM -0400, Stephen Smalley wrote:
> Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> added a security blob to struct ns_common and allocates it from
> __ns_common_init(). Most initial namespaces (init_user_ns,
> init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
> configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
> however set up statically via NS_COMMON_INIT() and never pass through
> __ns_common_init(), so their ns_security pointer is left NULL for the
> lifetime of the system. Any LSM that registers an lbs_ns blob and
> dereferences its slice on one of those namespaces (for example from
> the namespace_install hook when a task setns()'s back into an initial
> namespace) will fault.
> 
> Allocate the blob and run the namespace_init hook for each of these
> namespaces at the end of security_init(), after all ordered LSMs have
> registered their hooks, so every LSM sees the initial namespaces the
> same way it sees init_net (which is initialized at runtime via
> ns_common_init(&init_net) from net_ns_init() immediately after
> security_init()) and does not need to special-case them in its own
> ->init() callback.
> 
> Provide a ns_common_init_security() helper in kernel/nscommon.c so
> that the list of statically-defined initial namespaces and their
> Kconfig guards live next to the rest of the ns_common
> infrastructure. init_net is intentionally excluded: pre-initializing
> it here would leak once __ns_common_init() clears ns_security and
> re-allocates.
> 
> Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---

Seems good to me,
Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>

I'm waiting for Paul and then I would pick this into namespace-7.4.misc.

Re: [PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[Paul Moore]

On Fri, Sep 25, 2026 at 9:58 AM Christian Brauner <brauner@kernel.org> wrote:
> On Fri, Sep 18, 2026 at 10:31:43AM -0400, Stephen Smalley wrote:
> > Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > added a security blob to struct ns_common and allocates it from
> > __ns_common_init(). Most initial namespaces (init_user_ns,
> > init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
> > configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
> > however set up statically via NS_COMMON_INIT() and never pass through
> > __ns_common_init(), so their ns_security pointer is left NULL for the
> > lifetime of the system. Any LSM that registers an lbs_ns blob and
> > dereferences its slice on one of those namespaces (for example from
> > the namespace_install hook when a task setns()'s back into an initial
> > namespace) will fault.
> >
> > Allocate the blob and run the namespace_init hook for each of these
> > namespaces at the end of security_init(), after all ordered LSMs have
> > registered their hooks, so every LSM sees the initial namespaces the
> > same way it sees init_net (which is initialized at runtime via
> > ns_common_init(&init_net) from net_ns_init() immediately after
> > security_init()) and does not need to special-case them in its own
> > ->init() callback.
> >
> > Provide a ns_common_init_security() helper in kernel/nscommon.c so
> > that the list of statically-defined initial namespaces and their
> > Kconfig guards live next to the rest of the ns_common
> > infrastructure. init_net is intentionally excluded: pre-initializing
> > it here would leak once __ns_common_init() clears ns_security and
> > re-allocates.
> >
> > Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> > ---
>
> Seems good to me,
> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
>
> I'm waiting for Paul and then I would pick this into namespace-7.4.misc.

Since we already have the other LSM/namespace patches in lsm/dev I'd
prefer to merge this patch into lsm/dev so it is we have the core
LSM/namespace patches rooted in one branch.  Going forward we can
stick with the topic branch approach.

Are we all okay with that for this patch?

-- 
paul-moore.com

Re: [PATCH v3] lsm,nscommon: initialize the security blob for the initial namespaces

[Stephen Smalley]

On Tue, Sep 29, 2026 at 9:59 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Fri, Sep 25, 2026 at 9:58 AM Christian Brauner <brauner@kernel.org> wrote:
> > On Fri, Sep 18, 2026 at 10:31:43AM -0400, Stephen Smalley wrote:
> > > Commit f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > > added a security blob to struct ns_common and allocates it from
> > > __ns_common_init(). Most initial namespaces (init_user_ns,
> > > init_uts_ns, init_pid_ns, init_mnt_ns, and, depending on
> > > configuration, init_ipc_ns, init_cgroup_ns and init_time_ns) are
> > > however set up statically via NS_COMMON_INIT() and never pass through
> > > __ns_common_init(), so their ns_security pointer is left NULL for the
> > > lifetime of the system. Any LSM that registers an lbs_ns blob and
> > > dereferences its slice on one of those namespaces (for example from
> > > the namespace_install hook when a task setns()'s back into an initial
> > > namespace) will fault.
> > >
> > > Allocate the blob and run the namespace_init hook for each of these
> > > namespaces at the end of security_init(), after all ordered LSMs have
> > > registered their hooks, so every LSM sees the initial namespaces the
> > > same way it sees init_net (which is initialized at runtime via
> > > ns_common_init(&init_net) from net_ns_init() immediately after
> > > security_init()) and does not need to special-case them in its own
> > > ->init() callback.
> > >
> > > Provide a ns_common_init_security() helper in kernel/nscommon.c so
> > > that the list of statically-defined initial namespaces and their
> > > Kconfig guards live next to the rest of the ns_common
> > > infrastructure. init_net is intentionally excluded: pre-initializing
> > > it here would leak once __ns_common_init() clears ns_security and
> > > re-allocates.
> > >
> > > Fixes: f675d2e95569 ("lsm: add LSM blob and hooks for namespaces")
> > > Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> > > ---
> >
> > Seems good to me,
> > Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
> >
> > I'm waiting for Paul and then I would pick this into namespace-7.4.misc.
>
> Since we already have the other LSM/namespace patches in lsm/dev I'd
> prefer to merge this patch into lsm/dev so it is we have the core
> LSM/namespace patches rooted in one branch.  Going forward we can
> stick with the topic branch approach.
>
> Are we all okay with that for this patch?

That's fine with me.