* linux-next: manual merge of the security tree with the vfs-brauner tree
@ 2026-09-23 13:25 Mark Brown
2026-09-23 15:39 ` Mark Brown
0 siblings, 1 reply; 9+ messages in thread
From: Mark Brown @ 2026-09-23 13:25 UTC (permalink / raw)
To: Paul Moore
Cc: Christian Brauner, Daan De Meyer, Linux Kernel Mailing List,
Linux Next Mailing List
[-- Attachment #1: Type: text/plain, Size: 8840 bytes --]
Hi all,
Today's linux-next merge of the security tree got conflicts in:
include/linux/security.h
include/linux/lsm_hook_defs.h
between commit:
ad664d41535a5 ("fs: port ->tmpfile() to pass const mnt_idmap")
from the vfs-brauner tree and commit:
16959c469f232 ("lsm: expose mount idmaps to inode hooks")
from the security tree.
I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging. You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.
diff --cc include/linux/lsm_hook_defs.h
index c9561564585e7,af9624c30f99d..0000000000000
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@@ -121,29 -120,30 +121,35 @@@ LSM_HOOK(int, -EOPNOTSUPP, inode_init_s
int *xattr_count)
LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,
const struct qstr *name, const struct inode *context_inode)
- LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,
- umode_t mode)
-LSM_HOOK(int, 0, inode_create, struct mnt_idmap *idmap, struct inode *dir,
++LSM_HOOK(int, 0, inode_create, const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
-LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, struct mnt_idmap *idmap,
+LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, const struct mnt_idmap *idmap,
struct inode *inode)
- LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry)
+ LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap,
+ struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry)
- LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry,
- const char *old_name)
- LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry,
- umode_t mode)
+ LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *old_name)
+ LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode)
LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry)
- LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry,
- umode_t mode, dev_t dev)
+ LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev)
LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry)
LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode,
bool rcu)
++<<<<<<< HEAD
+LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask)
+LSM_HOOK(int, 0, inode_setattr, const struct mnt_idmap *idmap, struct dentry *dentry,
++=======
+ LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap,
+ struct inode *inode, int mask)
+ LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry,
++>>>>>>> security/next
struct iattr *attr)
-LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, struct mnt_idmap *idmap,
+LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, const struct mnt_idmap *idmap,
struct dentry *dentry, int ia_valid)
LSM_HOOK(int, 0, inode_getattr, const struct path *path)
LSM_HOOK(int, 0, inode_xattr_skipcap, const char *name)
diff --cc include/linux/ns/ns_common_types.h
index 6ed6b497831c7,5cfe0ce3c8818..0000000000000
--- a/include/linux/ns/ns_common_types.h
+++ b/include/linux/ns/ns_common_types.h
@@@ -116,8 -116,13 +116,11 @@@ struct ns_common
struct dentry *stashed;
const struct proc_ns_operations *ops;
unsigned int inum;
+ struct ns_tree;
+ struct rcu_head ns_rcu;
+ #ifdef CONFIG_SECURITY
+ void *ns_security;
+ #endif
- union {
- struct ns_tree;
- struct rcu_head ns_rcu;
- };
};
#define to_ns_common(__ns) \
diff --cc include/linux/security.h
index f7ff72ff956b7,7bb073f734f60..0000000000000
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@@ -405,33 -406,37 +407,37 @@@ int security_inode_init_security(struc
int security_inode_init_security_anon(struct inode *inode,
const struct qstr *name,
const struct inode *context_inode);
- int security_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode);
-int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
++int security_inode_create(const struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode);
-void security_inode_post_create_tmpfile(struct mnt_idmap *idmap,
+void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap,
struct inode *inode);
- int security_inode_link(struct dentry *old_dentry, struct inode *dir,
- struct dentry *new_dentry);
+ int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry,
+ struct inode *dir, struct dentry *new_dentry);
int security_inode_unlink(struct inode *dir, struct dentry *dentry);
- int security_inode_symlink(struct inode *dir, struct dentry *dentry,
- const char *old_name);
- int security_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode);
+ int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, const char *old_name);
+ int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode);
int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
- int security_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev);
+ int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir,
+ struct dentry *dentry, umode_t mode, dev_t dev);
int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry,
unsigned int flags);
int security_inode_readlink(struct dentry *dentry);
int security_inode_follow_link(struct dentry *dentry, struct inode *inode,
bool rcu);
- int security_inode_permission(struct inode *inode, int mask);
-int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode,
++int security_inode_permission(const struct mnt_idmap *idmap, struct inode *inode,
+ int mask);
-int security_inode_setattr(struct mnt_idmap *idmap,
+int security_inode_setattr(const struct mnt_idmap *idmap,
struct dentry *dentry, struct iattr *attr);
-void security_inode_post_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
+void security_inode_post_setattr(const struct mnt_idmap *idmap, struct dentry *dentry,
int ia_valid);
int security_inode_getattr(const struct path *path);
-int security_inode_setxattr(struct mnt_idmap *idmap,
+int security_inode_setxattr(const struct mnt_idmap *idmap,
struct dentry *dentry, const char *name,
const void *value, size_t size, int flags);
-int security_inode_set_acl(struct mnt_idmap *idmap,
+int security_inode_set_acl(const struct mnt_idmap *idmap,
struct dentry *dentry, const char *acl_name,
struct posix_acl *kacl);
void security_inode_post_set_acl(struct dentry *dentry, const char *acl_name,
@@@ -917,12 -920,13 +927,13 @@@ static inline int security_inode_create
}
static inline void
-security_inode_post_create_tmpfile(struct mnt_idmap *idmap, struct inode *inode)
+security_inode_post_create_tmpfile(const struct mnt_idmap *idmap, struct inode *inode)
{ }
- static inline int security_inode_link(struct dentry *old_dentry,
- struct inode *dir,
- struct dentry *new_dentry)
+ static inline int security_inode_link(struct mnt_idmap *idmap,
+ struct dentry *old_dentry,
+ struct inode *dir,
+ struct dentry *new_dentry)
{
return 0;
}
diff --git a/security/security.c b/security/security.c
index 5e5c73bfdd93a..09b0af1c0d656 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1662,7 +1662,7 @@ int security_path_chroot(const struct path *path)
*
* Return: Returns 0 if permission is granted.
*/
-int security_inode_create(struct mnt_idmap *idmap, struct inode *dir,
+int security_inode_create(const struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, umode_t mode)
{
if (unlikely(IS_PRIVATE(dir)))
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: linux-next: manual merge of the security tree with the vfs-brauner tree 2026-09-23 13:25 linux-next: manual merge of the security tree with the vfs-brauner tree Mark Brown @ 2026-09-23 15:39 ` Mark Brown 0 siblings, 0 replies; 9+ messages in thread From: Mark Brown @ 2026-09-23 15:39 UTC (permalink / raw) To: Paul Moore Cc: Christian Brauner, Daan De Meyer, Linux Kernel Mailing List, Linux Next Mailing List [-- Attachment #1: Type: text/plain, Size: 22367 bytes --] On Wed, Sep 23, 2026 at 03:25:31PM +0200, Mark Brown wrote: > Hi all, > > Today's linux-next merge of the security tree got conflicts in: > > include/linux/security.h > include/linux/lsm_hook_defs.h > > between commit: > > ad664d41535a5 ("fs: port ->tmpfile() to pass const mnt_idmap") > > from the vfs-brauner tree and commit: > > 16959c469f232 ("lsm: expose mount idmaps to inode hooks") > > from the security tree. > > I fixed it up (see below) and can carry the fix as necessary. This > is now fixed as far as linux-next is concerned, but any non trivial > conflicts should be mentioned to your upstream maintainer when your tree > is submitted for merging. You may also want to consider cooperating > with the maintainer of the conflicting tree to minimise any particularly > complex conflicts. This resolution was not good, there were additional semantic conflicts plus a bit of a mismerge. This is all rather messy, I've applied the quickly hacked together fixup below but it's all concerningly large and this probably needs some collaboration between the two trees. From 3f3dca4e8d3b9acf6652dd0cc91122773568120e Mon Sep 17 00:00:00 2001 From: Mark Brown <broonie@kernel.org> Date: Wed, 23 Sep 2026 15:48:54 +0200 Subject: [PATCH] security: Fix up mismerge and additional semantic issues with vfs-brauner Signed-off-by: Mark Brown <broonie@kernel.org> --- include/linux/lsm_hook_defs.h | 19 +++++++------------ include/linux/security.h | 24 ++++++++++++------------ security/apparmor/af_unix.c | 2 +- security/apparmor/file.c | 10 +++++----- security/apparmor/include/af_unix.h | 2 +- security/apparmor/include/file.h | 4 ++-- security/apparmor/include/net.h | 2 +- security/apparmor/lsm.c | 4 ++-- security/apparmor/net.c | 2 +- security/security.c | 12 ++++++------ security/selinux/hooks.c | 16 ++++++++-------- security/smack/smack_lsm.c | 4 ++-- 12 files changed, 48 insertions(+), 53 deletions(-) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 597e965fd5d9e..ef16e5343e099 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -125,29 +125,24 @@ LSM_HOOK(int, 0, inode_create, const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode) LSM_HOOK(void, LSM_RET_VOID, inode_post_create_tmpfile, const struct mnt_idmap *idmap, struct inode *inode) -LSM_HOOK(int, 0, inode_link, struct mnt_idmap *idmap, +LSM_HOOK(int, 0, inode_link, const struct mnt_idmap *idmap, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry) -LSM_HOOK(int, 0, inode_symlink, struct mnt_idmap *idmap, struct inode *dir, +LSM_HOOK(int, 0, inode_symlink, const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, const char *old_name) -LSM_HOOK(int, 0, inode_mkdir, struct mnt_idmap *idmap, struct inode *dir, +LSM_HOOK(int, 0, inode_mkdir, const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode) LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry) -LSM_HOOK(int, 0, inode_mknod, struct mnt_idmap *idmap, struct inode *dir, +LSM_HOOK(int, 0, inode_mknod, const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry) LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry) LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode, bool rcu) -<<<<<<< HEAD -LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask) -LSM_HOOK(int, 0, inode_setattr, const struct mnt_idmap *idmap, struct dentry *dentry, -======= -LSM_HOOK(int, 0, inode_permission, struct mnt_idmap *idmap, +LSM_HOOK(int, 0, inode_permission, const struct mnt_idmap *idmap, struct inode *inode, int mask) -LSM_HOOK(int, 0, inode_setattr, struct mnt_idmap *idmap, struct dentry *dentry, ->>>>>>> security/next +LSM_HOOK(int, 0, inode_setattr, const struct mnt_idmap *idmap, struct dentry *dentry, struct iattr *attr) LSM_HOOK(void, LSM_RET_VOID, inode_post_setattr, const struct mnt_idmap *idmap, struct dentry *dentry, int ia_valid) @@ -194,7 +189,7 @@ LSM_HOOK(int, 0, inode_setintegrity, const struct inode *inode, enum lsm_integrity_type type, const void *value, size_t size) LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, struct kernfs_node *kn) -LSM_HOOK(int, 0, file_permission, struct file *file, int mask) +LSM_HOOK(int, 0, file_permission, const struct file *file, int mask) LSM_HOOK(int, 0, file_alloc_security, struct file *file) LSM_HOOK(void, LSM_RET_VOID, file_release, struct file *file) LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file) diff --git a/include/linux/security.h b/include/linux/security.h index d0d27b4260827..8b8d6b8b802f1 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -411,15 +411,15 @@ int security_inode_create(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode); void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap, struct inode *inode); -int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry, +int security_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry); int security_inode_unlink(struct inode *dir, struct dentry *dentry); -int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir, +int security_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, const char *old_name); -int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir, +int security_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode); int security_inode_rmdir(struct inode *dir, struct dentry *dentry); -int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir, +int security_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev); int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry, struct inode *new_dir, struct dentry *new_dentry, @@ -475,7 +475,7 @@ int security_inode_setintegrity(const struct inode *inode, size_t size); int security_kernfs_init_security(struct kernfs_node *kn_dir, struct kernfs_node *kn); -int security_file_permission(struct file *file, int mask); +int security_file_permission(const struct file *file, int mask); int security_file_alloc(struct file *file); void security_file_release(struct file *file); void security_file_free(struct file *file); @@ -918,7 +918,7 @@ static inline int security_inode_init_security_anon(struct inode *inode, return 0; } -static inline int security_inode_create(struct mnt_idmap *idmap, +static inline int security_inode_create(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode) @@ -930,7 +930,7 @@ static inline void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap, struct inode *inode) { } -static inline int security_inode_link(struct mnt_idmap *idmap, +static inline int security_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) @@ -944,7 +944,7 @@ static inline int security_inode_unlink(struct inode *dir, return 0; } -static inline int security_inode_symlink(struct mnt_idmap *idmap, +static inline int security_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, const char *old_name) @@ -952,7 +952,7 @@ static inline int security_inode_symlink(struct mnt_idmap *idmap, return 0; } -static inline int security_inode_mkdir(struct mnt_idmap *idmap, +static inline int security_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, int mode) @@ -966,7 +966,7 @@ static inline int security_inode_rmdir(struct inode *dir, return 0; } -static inline int security_inode_mknod(struct mnt_idmap *idmap, +static inline int security_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, int mode, dev_t dev) @@ -995,7 +995,7 @@ static inline int security_inode_follow_link(struct dentry *dentry, return 0; } -static inline int security_inode_permission(struct mnt_idmap *idmap, +static inline int security_inode_permission(const struct mnt_idmap *idmap, struct inode *inode, int mask) { return 0; @@ -1154,7 +1154,7 @@ static inline int security_inode_copy_up_xattr(struct dentry *src, const char *n return -EOPNOTSUPP; } -static inline int security_file_permission(struct file *file, int mask) +static inline int security_file_permission(const struct file *file, int mask) { return 0; } diff --git a/security/apparmor/af_unix.c b/security/apparmor/af_unix.c index b908e744818c9..de80561348fc4 100644 --- a/security/apparmor/af_unix.c +++ b/security/apparmor/af_unix.c @@ -715,7 +715,7 @@ static void update_peer_ctx(struct sock *sk, struct aa_sk_ctx *ctx, * boundaries. Otherwise cached info off file is sufficient */ int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label, - const char *op, u32 request, struct file *file) + const char *op, u32 request, const struct file *file) { struct socket *sock = (struct socket *) file->private_data; struct sockaddr_un *addr, *peer_addr; diff --git a/security/apparmor/file.c b/security/apparmor/file.c index 3e74b613db325..305fdb341ddbb 100644 --- a/security/apparmor/file.c +++ b/security/apparmor/file.c @@ -489,7 +489,7 @@ static void update_file_ctx(struct aa_file_ctx *fctx, struct aa_label *label, static int __file_path_perm(const char *op, const struct cred *subj_cred, struct aa_label *label, - struct aa_label *flabel, struct file *file, + struct aa_label *flabel, const struct file *file, u32 request, u32 denied, bool in_atomic) { struct aa_profile *profile; @@ -550,7 +550,7 @@ static int __file_path_perm(const char *op, const struct cred *subj_cred, static int __file_sock_perm(const char *op, const struct cred *subj_cred, struct aa_label *label, - struct aa_label *flabel, struct file *file, + struct aa_label *flabel, const struct file *file, u32 request, u32 denied) { int error; @@ -579,7 +579,7 @@ static bool __file_is_delegated(struct aa_label *obj_label) return unconfined(obj_label); } -static bool __is_unix_file(struct file *file) +static bool __is_unix_file(const struct file *file) { struct socket *sock = (struct socket *) file->private_data; @@ -595,7 +595,7 @@ static bool __is_unix_file(struct file *file) return false; } -static bool __unix_needs_revalidation(struct file *file, struct aa_label *label, +static bool __unix_needs_revalidation(const struct file *file, struct aa_label *label, u32 request) { struct socket *sock = (struct socket *) file->private_data; @@ -624,7 +624,7 @@ static bool __unix_needs_revalidation(struct file *file, struct aa_label *label, * Returns: %0 if access allowed else error */ int aa_file_perm(const char *op, const struct cred *subj_cred, - struct aa_label *label, struct file *file, + struct aa_label *label, const struct file *file, u32 request, bool in_atomic) { struct aa_file_ctx *fctx; diff --git a/security/apparmor/include/af_unix.h b/security/apparmor/include/af_unix.h index 4a62e600d82b0..62e3269273eb7 100644 --- a/security/apparmor/include/af_unix.h +++ b/security/apparmor/include/af_unix.h @@ -50,6 +50,6 @@ int aa_unix_msg_perm(const char *op, u32 request, struct socket *sock, int aa_unix_opt_perm(const char *op, u32 request, struct socket *sock, int level, int optname); int aa_unix_file_perm(const struct cred *subj_cred, struct aa_label *label, - const char *op, u32 request, struct file *file); + const char *op, u32 request, const struct file *file); #endif /* __AA_AF_UNIX_H */ diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h index 1614c07fc53ee..d69a0611a981e 100644 --- a/security/apparmor/include/file.h +++ b/security/apparmor/include/file.h @@ -29,7 +29,7 @@ struct path; AA_MAY_CHMOD | AA_MAY_CHOWN | AA_MAY_LOCK | \ AA_EXEC_MMAP | AA_MAY_LINK) -static inline struct aa_file_ctx *file_ctx(struct file *file) +static inline struct aa_file_ctx *file_ctx(const struct file *file) { return file->f_security + apparmor_blob_sizes.lbs_file; } @@ -97,7 +97,7 @@ int aa_path_link(const struct cred *subj_cred, struct aa_label *label, struct dentry *new_dentry); int aa_file_perm(const char *op, const struct cred *subj_cred, - struct aa_label *label, struct file *file, + struct aa_label *label, const struct file *file, u32 request, bool in_atomic); void aa_inherit_files(const struct cred *cred, struct files_struct *files); diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h index 375341929cb65..e387b50920b3b 100644 --- a/security/apparmor/include/net.h +++ b/security/apparmor/include/net.h @@ -112,7 +112,7 @@ int aa_label_sk_perm(const struct cred *subj_cred, struct aa_label *label, const char *op, u32 request, const struct sock *sk); int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label, const char *op, u32 request, - struct file *file); + const struct file *file); int apparmor_secmark_check(struct aa_label *label, char *op, u32 request, u32 secid, const struct sock *sk); diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index c73681d820a06..9d572cf8486b2 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -525,7 +525,7 @@ static void apparmor_file_free_security(struct file *file) aa_put_label(rcu_access_pointer(ctx->label)); } -static int common_file_perm(const char *op, struct file *file, u32 mask) +static int common_file_perm(const char *op, const struct file *file, u32 mask) { struct aa_label *label; bool needput; @@ -543,7 +543,7 @@ static int apparmor_file_receive(struct file *file) return common_file_perm(OP_FRECEIVE, file, aa_map_file_to_perms(file)); } -static int apparmor_file_permission(struct file *file, int mask) +static int apparmor_file_permission(const struct file *file, int mask) { return common_file_perm(OP_FPERM, file, mask); } diff --git a/security/apparmor/net.c b/security/apparmor/net.c index a333e6aff9262..6048e3c5533d7 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -325,7 +325,7 @@ int aa_sk_perm(const char *op, u32 request, const struct sock *sk) int aa_sock_file_perm(const struct cred *subj_cred, struct aa_label *label, - const char *op, u32 request, struct file *file) + const char *op, u32 request, const struct file *file) { struct socket *sock = (struct socket *) file->private_data; diff --git a/security/security.c b/security/security.c index 09b0af1c0d656..da8d48cd0a2a4 100644 --- a/security/security.c +++ b/security/security.c @@ -1697,7 +1697,7 @@ void security_inode_post_create_tmpfile(const struct mnt_idmap *idmap, * * Return: Returns 0 if permission is granted. */ -int security_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry, +int security_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) { if (unlikely(IS_PRIVATE(d_backing_inode(old_dentry)))) @@ -1732,7 +1732,7 @@ int security_inode_unlink(struct inode *dir, struct dentry *dentry) * * Return: Returns 0 if permission is granted. */ -int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir, +int security_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, const char *old_name) { if (unlikely(IS_PRIVATE(dir))) @@ -1752,7 +1752,7 @@ int security_inode_symlink(struct mnt_idmap *idmap, struct inode *dir, * * Return: Returns 0 if permission is granted. */ -int security_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir, +int security_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode) { if (unlikely(IS_PRIVATE(dir))) @@ -1792,7 +1792,7 @@ int security_inode_rmdir(struct inode *dir, struct dentry *dentry) * * Return: Returns 0 if permission is granted. */ -int security_inode_mknod(struct mnt_idmap *idmap, struct inode *dir, +int security_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) { if (unlikely(IS_PRIVATE(dir))) @@ -1881,7 +1881,7 @@ int security_inode_follow_link(struct dentry *dentry, struct inode *inode, * * Return: Returns 0 if permission is granted. */ -int security_inode_permission(struct mnt_idmap *idmap, struct inode *inode, +int security_inode_permission(const struct mnt_idmap *idmap, struct inode *inode, int mask) { if (unlikely(IS_PRIVATE(inode))) @@ -2434,7 +2434,7 @@ int security_kernfs_init_security(struct kernfs_node *kn_dir, * * Return: Returns 0 if permission is granted. */ -int security_file_permission(struct file *file, int mask) +int security_file_permission(const struct file *file, int mask) { return call_int_hook(file_permission, file, mask); } diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index eb31241047abf..88f3a5858c2a5 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3110,13 +3110,13 @@ static int selinux_inode_init_security_anon(struct inode *inode, &ad); } -static int selinux_inode_create(struct mnt_idmap *idmap, struct inode *dir, +static int selinux_inode_create(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode) { return may_create(dir, dentry, SECCLASS_FILE); } -static int selinux_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry, +static int selinux_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) { return may_link(dir, old_dentry, MAY_LINK); @@ -3127,13 +3127,13 @@ static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry) return may_link(dir, dentry, MAY_UNLINK); } -static int selinux_inode_symlink(struct mnt_idmap *idmap, struct inode *dir, +static int selinux_inode_symlink(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, const char *name) { return may_create(dir, dentry, SECCLASS_LNK_FILE); } -static int selinux_inode_mkdir(struct mnt_idmap *idmap, struct inode *dir, +static int selinux_inode_mkdir(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mask) { return may_create(dir, dentry, SECCLASS_DIR); @@ -3144,7 +3144,7 @@ static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry) return may_link(dir, dentry, MAY_RMDIR); } -static int selinux_inode_mknod(struct mnt_idmap *idmap, struct inode *dir, +static int selinux_inode_mknod(const struct mnt_idmap *idmap, struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) { return may_create(dir, dentry, inode_mode_to_security_class(mode)); @@ -3284,7 +3284,7 @@ static inline void task_avdcache_update(struct task_security_struct *tsec, * Check if the current task is allowed to access @inode according to * @requested. Returns 0 if allowed, negative values otherwise. */ -static int selinux_inode_permission(struct mnt_idmap *idmap, +static int selinux_inode_permission(const struct mnt_idmap *idmap, struct inode *inode, int requested) { int mask; @@ -3842,7 +3842,7 @@ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir, /* file security operations */ -static int selinux_revalidate_file_permission(struct file *file, int mask) +static int selinux_revalidate_file_permission(const struct file *file, int mask) { const struct cred *cred = current_cred(); struct inode *inode = file_inode(file); @@ -3855,7 +3855,7 @@ static int selinux_revalidate_file_permission(struct file *file, int mask) file_mask_to_av(inode->i_mode, mask)); } -static int selinux_file_permission(struct file *file, int mask) +static int selinux_file_permission(const struct file *file, int mask) { struct inode *inode = file_inode(file); struct file_security_struct *fsec = selinux_file(file); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 07183e4606fc0..28a8e12603cec 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1096,7 +1096,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, * * Returns 0 if access is permitted, an error code otherwise */ -static int smack_inode_link(struct mnt_idmap *idmap, struct dentry *old_dentry, +static int smack_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) { struct smack_known *isp; @@ -1235,7 +1235,7 @@ static int smack_inode_rename(struct inode *old_inode, * * Returns 0 if access is permitted, an error code otherwise */ -static int smack_inode_permission(struct mnt_idmap *idmap, struct inode *inode, +static int smack_inode_permission(const struct mnt_idmap *idmap, struct inode *inode, int mask) { struct superblock_smack *sbsp = smack_superblock(inode->i_sb); -- 2.47.3 [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 9+ messages in thread
* linux-next: manual merge of the security tree with the vfs-brauner tree
@ 2026-09-14 11:48 Mark Brown
2026-09-14 13:18 ` Jori Koolstra
0 siblings, 1 reply; 9+ messages in thread
From: Mark Brown @ 2026-09-14 11:48 UTC (permalink / raw)
To: Paul Moore
Cc: Christian Brauner, Daan De Meyer, Jori Koolstra,
Linux Kernel Mailing List, Linux Next Mailing List
[-- Attachment #1: Type: text/plain, Size: 2297 bytes --]
Hi all,
Today's linux-next merge of the security tree got a conflict in:
fs/namei.c
between commit:
449c7265d60d4 ("vfs: add O_CREAT|O_DIRECTORY to open*(2)")
from the vfs-brauner tree and commit:
16959c469f232 ("lsm: expose mount idmaps to inode hooks")
from the security tree.
I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging. You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.
diff --cc fs/namei.c
index ca4f5e3be99ac,99f894f3f7e13..0000000000000
--- a/fs/namei.c
+++ b/fs/namei.c
@@@ -4227,11 -4188,16 +4227,11 @@@ int vfs_create(struct mnt_idmap *idmap
return -EACCES; /* shouldn't it be ENOSYS? */
mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);
- error = security_inode_create(dir, dentry, mode);
+ error = security_inode_create(idmap, dir, dentry, mode);
if (error)
return error;
- error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di);
- if (error)
- return error;
- error = dir->i_op->create(idmap, dir, dentry, mode);
- if (!error)
- fsnotify_create(dir, dentry);
- return error;
+
+ return vfs_create_no_perm(idmap, dentry, mode, di);
}
EXPORT_SYMBOL(vfs_create);
@@@ -4368,21 -4328,7 +4368,21 @@@ static int may_o_create(struct mnt_idma
if (error)
return error;
- return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode);
+ if (create_dir)
- error = security_inode_mkdir(dir_inode, dentry, mode);
++ error = security_inode_mkdir(idmap, dir_inode, dentry, mode);
+ else
- error = security_inode_create(dir_inode, dentry, mode);
++ error = security_inode_create(idmap, dir_inode, dentry, mode);
+
+ return error;
+}
+
+static inline umode_t o_create_mode(struct mnt_idmap *idmap,
+ const struct inode *dir, int open_flag, umode_t mode)
+{
+ if (O_IS_MKDIR(open_flag))
+ return vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, S_IFDIR);
+ else
+ return vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG);
}
/**
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: linux-next: manual merge of the security tree with the vfs-brauner tree 2026-09-14 11:48 Mark Brown @ 2026-09-14 13:18 ` Jori Koolstra 0 siblings, 0 replies; 9+ messages in thread From: Jori Koolstra @ 2026-09-14 13:18 UTC (permalink / raw) To: Mark Brown, Christian Brauner, Paul Moore Cc: Daan De Meyer, linux-fsdevel, Linux Kernel Mailing List, Linux Next Mailing List Hi Mark/Christian, @Mark Wasn't aware that Christian pulled this already. There are some obvious errors in the v5 of the O_CREAT|O_DIRECTORY that Christian also pointed out. I messed something up during rebasing and somehow forgot to format-patch again when sending that series out. Anyway, finally got back from holiday and fixed everything in the v6, which I sent yesterday. So please don't pull this just yet. I am a bit surprised, because I hadn't gotten an explicit reviewed-by on every patch in the series. @Christian, could you review the v6 so that we can fix this for next quickly? It fixes the rebase issues, but there are some other small changes someone else should also look at. > Op 14-09-2026 13:48 CEST schreef Mark Brown <broonie@kernel.org>: > > > Hi all, > > Today's linux-next merge of the security tree got a conflict in: > > fs/namei.c > > between commit: > > 449c7265d60d4 ("vfs: add O_CREAT|O_DIRECTORY to open*(2)") > > from the vfs-brauner tree and commit: > > 16959c469f232 ("lsm: expose mount idmaps to inode hooks") > > from the security tree. > > I fixed it up (see below) and can carry the fix as necessary. This > is now fixed as far as linux-next is concerned, but any non trivial > conflicts should be mentioned to your upstream maintainer when your tree > is submitted for merging. You may also want to consider cooperating > with the maintainer of the conflicting tree to minimise any particularly > complex conflicts. > > diff --cc fs/namei.c > index ca4f5e3be99ac,99f894f3f7e13..0000000000000 > --- a/fs/namei.c > +++ b/fs/namei.c > @@@ -4227,11 -4188,16 +4227,11 @@@ int vfs_create(struct mnt_idmap *idmap > return -EACCES; /* shouldn't it be ENOSYS? */ > > mode = vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); > - error = security_inode_create(dir, dentry, mode); > + error = security_inode_create(idmap, dir, dentry, mode); > if (error) > return error; > - error = try_break_deleg(dir, LEASE_BREAK_DIR_CREATE, di); > - if (error) > - return error; > - error = dir->i_op->create(idmap, dir, dentry, mode); > - if (!error) > - fsnotify_create(dir, dentry); > - return error; > + > + return vfs_create_no_perm(idmap, dentry, mode, di); > } > EXPORT_SYMBOL(vfs_create); > > @@@ -4368,21 -4328,7 +4368,21 @@@ static int may_o_create(struct mnt_idma > if (error) > return error; > > - return security_inode_create(idmap, dir->dentry->d_inode, dentry, mode); > + if (create_dir) > - error = security_inode_mkdir(dir_inode, dentry, mode); > ++ error = security_inode_mkdir(idmap, dir_inode, dentry, mode); > + else > - error = security_inode_create(dir_inode, dentry, mode); > ++ error = security_inode_create(idmap, dir_inode, dentry, mode); > + > + return error; > +} > + > +static inline umode_t o_create_mode(struct mnt_idmap *idmap, > + const struct inode *dir, int open_flag, umode_t mode) > +{ > + if (O_IS_MKDIR(open_flag)) > + return vfs_prepare_mode(idmap, dir, mode, S_IRWXUGO | S_ISVTX, S_IFDIR); > + else > + return vfs_prepare_mode(idmap, dir, mode, S_IALLUGO, S_IFREG); > } > > /** OK, doesn't look too bad. It's just that the struct mnt_idmap in now being passed around, it looks like. Thanks, Jori. ^ permalink raw reply [flat|nested] 9+ messages in thread
* linux-next: manual merge of the security tree with the vfs-brauner tree
@ 2026-04-06 14:05 Mark Brown
0 siblings, 0 replies; 9+ messages in thread
From: Mark Brown @ 2026-04-06 14:05 UTC (permalink / raw)
To: Paul Moore
Cc: Amir Goldstein, Christian Brauner, Linux Kernel Mailing List,
Linux Next Mailing List, Mateusz Guzik
[-- Attachment #1: Type: text/plain, Size: 1939 bytes --]
Hi all,
Today's linux-next merge of the security tree got a conflict in:
fs/file_table.c
between commit:
1f1651d6dc2ac ("fs: hide file and bfile caches behind runtime const machinery")
from the vfs-brauner tree and commit:
fbec24706feb2 ("fs: prepare for adding LSM blob to backing_file")
from the security tree.
I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging. You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.
diff --cc fs/file_table.c
index c40ec1be28992,d19d879b6efc1..0000000000000
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@@ -70,6 -69,25 +73,25 @@@ void backing_file_set_user_path(struct
}
EXPORT_SYMBOL_GPL(backing_file_set_user_path);
+ #ifdef CONFIG_SECURITY
+ void *backing_file_security(const struct file *f)
+ {
+ return backing_file(f)->security;
+ }
+
+ void backing_file_set_security(struct file *f, void *security)
+ {
+ backing_file(f)->security = security;
+ }
+ #endif /* CONFIG_SECURITY */
+
+ static inline void backing_file_free(struct backing_file *ff)
+ {
+ security_backing_file_free(&ff->file);
+ path_put(&ff->user_path);
- kmem_cache_free(bfilp_cachep, ff);
++ kmem_cache_free(bfilp_cache, ff);
+ }
+
static inline void file_free(struct file *f)
{
security_file_free(f);
@@@ -77,10 -95,9 +99,9 @@@
percpu_counter_dec(&nr_files);
put_cred(f->f_cred);
if (unlikely(f->f_mode & FMODE_BACKING)) {
- path_put(backing_file_user_path(f));
- kmem_cache_free(bfilp_cache, backing_file(f));
+ backing_file_free(backing_file(f));
} else {
- kmem_cache_free(filp_cachep, f);
+ kmem_cache_free(filp_cache, f);
}
}
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* linux-next: manual merge of the security tree with the vfs-brauner tree
@ 2024-09-10 3:27 Stephen Rothwell
2024-09-10 19:45 ` Paul Moore
0 siblings, 1 reply; 9+ messages in thread
From: Stephen Rothwell @ 2024-09-10 3:27 UTC (permalink / raw)
To: Paul Moore, Christian Brauner
Cc: Linux Kernel Mailing List, Linux Next Mailing List,
Mickaël Salaün
[-- Attachment #1: Type: text/plain, Size: 3071 bytes --]
Hi all,
Today's linux-next merge of the security tree got a conflict in:
fs/fcntl.c
between commit:
1934b212615d ("file: reclaim 24 bytes from f_owner")
from the vfs-brauner tree and commit:
26f204380a3c ("fs: Fix file_set_fowner LSM hook inconsistencies")
from the security tree.
I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging. You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.
--
Cheers,
Stephen Rothwell
diff --cc fs/fcntl.c
index f6fde75a3bd5,c28dc6c005f1..000000000000
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@@ -89,72 -87,24 +89,66 @@@ static int setfl(int fd, struct file *
return error;
}
+/*
+ * Allocate an file->f_owner struct if it doesn't exist, handling racing
+ * allocations correctly.
+ */
+int file_f_owner_allocate(struct file *file)
+{
+ struct fown_struct *f_owner;
+
+ f_owner = file_f_owner(file);
+ if (f_owner)
+ return 0;
+
+ f_owner = kzalloc(sizeof(struct fown_struct), GFP_KERNEL);
+ if (!f_owner)
+ return -ENOMEM;
+
+ rwlock_init(&f_owner->lock);
+ f_owner->file = file;
+ /* If someone else raced us, drop our allocation. */
+ if (unlikely(cmpxchg(&file->f_owner, NULL, f_owner)))
+ kfree(f_owner);
+ return 0;
+}
+EXPORT_SYMBOL(file_f_owner_allocate);
+
+void file_f_owner_release(struct file *file)
+{
+ struct fown_struct *f_owner;
+
+ f_owner = file_f_owner(file);
+ if (f_owner) {
+ put_pid(f_owner->pid);
+ kfree(f_owner);
+ }
+}
+
- static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
- int force)
+ void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
+ int force)
{
- write_lock_irq(&filp->f_owner.lock);
- if (force || !filp->f_owner.pid) {
- put_pid(filp->f_owner.pid);
- filp->f_owner.pid = get_pid(pid);
- filp->f_owner.pid_type = type;
+ struct fown_struct *f_owner;
+
+ f_owner = file_f_owner(filp);
+ if (WARN_ON_ONCE(!f_owner))
+ return;
+
+ write_lock_irq(&f_owner->lock);
+ if (force || !f_owner->pid) {
+ put_pid(f_owner->pid);
+ f_owner->pid = get_pid(pid);
+ f_owner->pid_type = type;
if (pid) {
const struct cred *cred = current_cred();
+ security_file_set_fowner(filp);
- filp->f_owner.uid = cred->uid;
- filp->f_owner.euid = cred->euid;
+ f_owner->uid = cred->uid;
+ f_owner->euid = cred->euid;
}
}
- write_unlock_irq(&filp->f_owner.lock);
+ write_unlock_irq(&f_owner->lock);
}
-
- void __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
- int force)
- {
- security_file_set_fowner(filp);
- f_modown(filp, pid, type, force);
- }
EXPORT_SYMBOL(__f_setown);
int f_setown(struct file *filp, int who, int force)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: linux-next: manual merge of the security tree with the vfs-brauner tree 2024-09-10 3:27 Stephen Rothwell @ 2024-09-10 19:45 ` Paul Moore 0 siblings, 0 replies; 9+ messages in thread From: Paul Moore @ 2024-09-10 19:45 UTC (permalink / raw) To: Stephen Rothwell Cc: Christian Brauner, Linux Kernel Mailing List, Linux Next Mailing List, Mickaël Salaün On Mon, Sep 9, 2024 at 11:27 PM Stephen Rothwell <sfr@canb.auug.org.au> wrote: > > Hi all, > > Today's linux-next merge of the security tree got a conflict in: > > fs/fcntl.c > > between commit: > > 1934b212615d ("file: reclaim 24 bytes from f_owner") > > from the vfs-brauner tree and commit: > > 26f204380a3c ("fs: Fix file_set_fowner LSM hook inconsistencies") > > from the security tree. > > I fixed it up (see below) and can carry the fix as necessary. This > is now fixed as far as linux-next is concerned, but any non trivial > conflicts should be mentioned to your upstream maintainer when your tree > is submitted for merging. You may also want to consider cooperating > with the maintainer of the conflicting tree to minimise any particularly > complex conflicts. > > -- > Cheers, > Stephen Rothwell Thanks Stephen, the fixup looked from from a LSM perspective. -- paul-moore.com ^ permalink raw reply [flat|nested] 9+ messages in thread
* linux-next: manual merge of the security tree with the vfs-brauner tree
@ 2023-11-20 3:31 Stephen Rothwell
2023-11-20 21:09 ` Paul Moore
0 siblings, 1 reply; 9+ messages in thread
From: Stephen Rothwell @ 2023-11-20 3:31 UTC (permalink / raw)
To: Paul Moore, Christian Brauner
Cc: Casey Schaufler, Linux Kernel Mailing List,
Linux Next Mailing List, Miklos Szeredi
[-- Attachment #1: Type: text/plain, Size: 15972 bytes --]
Hi all,
Today's linux-next merge of the security tree got conflicts in:
arch/alpha/kernel/syscalls/syscall.tbl
arch/arm/tools/syscall.tbl
arch/arm64/include/asm/unistd32.h
arch/m68k/kernel/syscalls/syscall.tbl
arch/microblaze/kernel/syscalls/syscall.tbl
arch/mips/kernel/syscalls/syscall_n32.tbl
arch/mips/kernel/syscalls/syscall_n64.tbl
arch/mips/kernel/syscalls/syscall_o32.tbl
arch/parisc/kernel/syscalls/syscall.tbl
arch/powerpc/kernel/syscalls/syscall.tbl
arch/s390/kernel/syscalls/syscall.tbl
arch/sh/kernel/syscalls/syscall.tbl
arch/sparc/kernel/syscalls/syscall.tbl
arch/x86/entry/syscalls/syscall_32.tbl
arch/x86/entry/syscalls/syscall_64.tbl
arch/xtensa/kernel/syscalls/syscall.tbl
include/uapi/asm-generic/unistd.h
between commit:
9fa5392c080e ("wire up syscalls for statmount/listmount")
from the vfs-brauner tree and commit:
5f42375904b0 ("LSM: wireup Linux Security Module syscalls")
from the security tree.
I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging. You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.
I also needed this merge fix patch (the former commit neglected to
update this file).
From: Stephen Rothwell <sfr@canb.auug.org.au>
Date: Mon, 20 Nov 2023 14:27:19 +1100
Subject: [PATCH] fix up for "LSM: wireup Linux Security Module syscalls"
interacting with commit "wire up syscalls for statmount/listmount"
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
arch/arm64/include/asm/unistd.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index abe10a833fcd..491b2b9bd553 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -39,7 +39,7 @@
#define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5)
#define __ARM_NR_COMPAT_END (__ARM_NR_COMPAT_BASE + 0x800)
-#define __NR_compat_syscalls 460
+#define __NR_compat_syscalls 462
#endif
#define __ARCH_WANT_SYS_CLONE
--
2.40.1
--
Cheers,
Stephen Rothwell
diff --cc arch/alpha/kernel/syscalls/syscall.tbl
index 186e785f5b56,b04af0c9fcbc..000000000000
--- a/arch/alpha/kernel/syscalls/syscall.tbl
+++ b/arch/alpha/kernel/syscalls/syscall.tbl
@@@ -496,5 -496,6 +496,8 @@@
564 common futex_wake sys_futex_wake
565 common futex_wait sys_futex_wait
566 common futex_requeue sys_futex_requeue
-567 common lsm_get_self_attr sys_lsm_get_self_attr
-568 common lsm_set_self_attr sys_lsm_set_self_attr
-569 common lsm_list_modules sys_lsm_list_modules
+567 common statmount sys_statmount
+568 common listmount sys_listmount
++569 common lsm_get_self_attr sys_lsm_get_self_attr
++570 common lsm_set_self_attr sys_lsm_set_self_attr
++571 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/arm/tools/syscall.tbl
index d6a324dbff2e,43313beefae7..000000000000
--- a/arch/arm/tools/syscall.tbl
+++ b/arch/arm/tools/syscall.tbl
@@@ -470,5 -470,6 +470,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/arm64/include/asm/unistd32.h
index 8a191423c316,ab1a7c2b6653..000000000000
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@@ -919,10 -919,12 +919,16 @@@ __SYSCALL(__NR_futex_wake, sys_futex_wa
__SYSCALL(__NR_futex_wait, sys_futex_wait)
#define __NR_futex_requeue 456
__SYSCALL(__NR_futex_requeue, sys_futex_requeue)
-#define __NR_lsm_get_self_attr 457
+#define __NR_statmount 457
+__SYSCALL(__NR_statmount, sys_statmount)
+#define __NR_listmount 458
+__SYSCALL(__NR_listmount, sys_listmount)
++#define __NR_lsm_get_self_attr 459
+ __SYSCALL(__NR_lsm_get_self_attr, sys_lsm_get_self_attr)
-#define __NR_lsm_set_self_attr 458
++#define __NR_lsm_set_self_attr 460
+ __SYSCALL(__NR_lsm_set_self_attr, sys_lsm_set_self_attr)
-#define __NR_lsm_list_modules 459
++#define __NR_lsm_list_modules 461
+ __SYSCALL(__NR_lsm_list_modules, sys_lsm_list_modules)
/*
* Please add new compat syscalls above this comment and update
diff --cc arch/m68k/kernel/syscalls/syscall.tbl
index 37db1a810b67,90629ffc6732..000000000000
--- a/arch/m68k/kernel/syscalls/syscall.tbl
+++ b/arch/m68k/kernel/syscalls/syscall.tbl
@@@ -456,5 -456,6 +456,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/microblaze/kernel/syscalls/syscall.tbl
index 07fff5ad1c9c,c395dece73b4..000000000000
--- a/arch/microblaze/kernel/syscalls/syscall.tbl
+++ b/arch/microblaze/kernel/syscalls/syscall.tbl
@@@ -462,5 -462,6 +462,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/mips/kernel/syscalls/syscall_n32.tbl
index 134ea054b1c7,4a876c4e77d6..000000000000
--- a/arch/mips/kernel/syscalls/syscall_n32.tbl
+++ b/arch/mips/kernel/syscalls/syscall_n32.tbl
@@@ -395,5 -395,6 +395,8 @@@
454 n32 futex_wake sys_futex_wake
455 n32 futex_wait sys_futex_wait
456 n32 futex_requeue sys_futex_requeue
-457 n32 lsm_get_self_attr sys_lsm_get_self_attr
-458 n32 lsm_set_self_attr sys_lsm_set_self_attr
-459 n32 lsm_list_modules sys_lsm_list_modules
+457 n32 statmount sys_statmount
+458 n32 listmount sys_listmount
++459 n32 lsm_get_self_attr sys_lsm_get_self_attr
++460 n32 lsm_set_self_attr sys_lsm_set_self_attr
++461 n32 lsm_list_modules sys_lsm_list_modules
diff --cc arch/mips/kernel/syscalls/syscall_n64.tbl
index 959a21664703,b74c8571f063..000000000000
--- a/arch/mips/kernel/syscalls/syscall_n64.tbl
+++ b/arch/mips/kernel/syscalls/syscall_n64.tbl
@@@ -371,5 -371,6 +371,8 @@@
454 n64 futex_wake sys_futex_wake
455 n64 futex_wait sys_futex_wait
456 n64 futex_requeue sys_futex_requeue
-457 n64 lsm_get_self_attr sys_lsm_get_self_attr
-458 n64 lsm_set_self_attr sys_lsm_set_self_attr
-459 n64 lsm_list_modules sys_lsm_list_modules
+457 n64 statmount sys_statmount
+458 n64 listmount sys_listmount
++459 n64 lsm_get_self_attr sys_lsm_get_self_attr
++460 n64 lsm_set_self_attr sys_lsm_set_self_attr
++461 n64 lsm_list_modules sys_lsm_list_modules
diff --cc arch/mips/kernel/syscalls/syscall_o32.tbl
index e55bc1d4bf0f,bf41906e1f68..000000000000
--- a/arch/mips/kernel/syscalls/syscall_o32.tbl
+++ b/arch/mips/kernel/syscalls/syscall_o32.tbl
@@@ -444,5 -444,6 +444,8 @@@
454 o32 futex_wake sys_futex_wake
455 o32 futex_wait sys_futex_wait
456 o32 futex_requeue sys_futex_requeue
-457 o32 lsm_get_self_attr sys_lsm_get_self_attr
-458 032 lsm_set_self_attr sys_lsm_set_self_attr
-459 o32 lsm_list_modules sys_lsm_list_modules
+457 o32 statmount sys_statmount
+458 o32 listmount sys_listmount
++459 o32 lsm_get_self_attr sys_lsm_get_self_attr
++460 032 lsm_set_self_attr sys_lsm_set_self_attr
++461 o32 lsm_list_modules sys_lsm_list_modules
diff --cc arch/parisc/kernel/syscalls/syscall.tbl
index 9c84470c31c7,ccc0a679e774..000000000000
--- a/arch/parisc/kernel/syscalls/syscall.tbl
+++ b/arch/parisc/kernel/syscalls/syscall.tbl
@@@ -455,5 -455,6 +455,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/powerpc/kernel/syscalls/syscall.tbl
index 6988ecbc316e,a6f37e2333cb..000000000000
--- a/arch/powerpc/kernel/syscalls/syscall.tbl
+++ b/arch/powerpc/kernel/syscalls/syscall.tbl
@@@ -543,5 -543,6 +543,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/s390/kernel/syscalls/syscall.tbl
index 5f5cd20ebb34,4b818e9ee832..000000000000
--- a/arch/s390/kernel/syscalls/syscall.tbl
+++ b/arch/s390/kernel/syscalls/syscall.tbl
@@@ -459,5 -459,6 +459,8 @@@
454 common futex_wake sys_futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount sys_statmount
+458 common listmount sys_listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules sys_lsm_list_modules
diff --cc arch/sh/kernel/syscalls/syscall.tbl
index 3103ebd2e4cb,1a3d88d1a07f..000000000000
--- a/arch/sh/kernel/syscalls/syscall.tbl
+++ b/arch/sh/kernel/syscalls/syscall.tbl
@@@ -459,5 -459,6 +459,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/sparc/kernel/syscalls/syscall.tbl
index ba147d7ad19a,e0e8cec62358..000000000000
--- a/arch/sparc/kernel/syscalls/syscall.tbl
+++ b/arch/sparc/kernel/syscalls/syscall.tbl
@@@ -502,5 -502,6 +502,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc arch/x86/entry/syscalls/syscall_32.tbl
index 56e6c2f3ee9c,6e45e693f339..000000000000
--- a/arch/x86/entry/syscalls/syscall_32.tbl
+++ b/arch/x86/entry/syscalls/syscall_32.tbl
@@@ -461,5 -461,6 +461,8 @@@
454 i386 futex_wake sys_futex_wake
455 i386 futex_wait sys_futex_wait
456 i386 futex_requeue sys_futex_requeue
-457 i386 lsm_get_self_attr sys_lsm_get_self_attr
-458 i386 lsm_set_self_attr sys_lsm_set_self_attr
-459 i386 lsm_list_modules sys_lsm_list_modules
+457 i386 statmount sys_statmount
+458 i386 listmount sys_listmount
++459 i386 lsm_get_self_attr sys_lsm_get_self_attr
++460 i386 lsm_set_self_attr sys_lsm_set_self_attr
++461 i386 lsm_list_modules sys_lsm_list_modules
diff --cc arch/x86/entry/syscalls/syscall_64.tbl
index 3a22eef585c2,d3b41d059d4d..000000000000
--- a/arch/x86/entry/syscalls/syscall_64.tbl
+++ b/arch/x86/entry/syscalls/syscall_64.tbl
@@@ -378,8 -378,9 +378,11 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
#
# Due to a historical design error, certain syscalls are numbered differently
diff --cc arch/xtensa/kernel/syscalls/syscall.tbl
index 497b5d32f457,284784ea5a46..000000000000
--- a/arch/xtensa/kernel/syscalls/syscall.tbl
+++ b/arch/xtensa/kernel/syscalls/syscall.tbl
@@@ -427,5 -427,6 +427,8 @@@
454 common futex_wake sys_futex_wake
455 common futex_wait sys_futex_wait
456 common futex_requeue sys_futex_requeue
-457 common lsm_get_self_attr sys_lsm_get_self_attr
-458 common lsm_set_self_attr sys_lsm_set_self_attr
-459 common lsm_list_modules sys_lsm_list_modules
+457 common statmount sys_statmount
+458 common listmount sys_listmount
++459 common lsm_get_self_attr sys_lsm_get_self_attr
++460 common lsm_set_self_attr sys_lsm_set_self_attr
++461 common lsm_list_modules sys_lsm_list_modules
diff --cc include/uapi/asm-generic/unistd.h
index b67b18e71fbd,55cc0bcfb58d..000000000000
--- a/include/uapi/asm-generic/unistd.h
+++ b/include/uapi/asm-generic/unistd.h
@@@ -829,14 -829,15 +829,21 @@@ __SYSCALL(__NR_futex_wait, sys_futex_wa
#define __NR_futex_requeue 456
__SYSCALL(__NR_futex_requeue, sys_futex_requeue)
-#define __NR_lsm_get_self_attr 457
+#define __NR_statmount 457
+__SYSCALL(__NR_statmount, sys_statmount)
+
+#define __NR_listmount 458
+__SYSCALL(__NR_listmount, sys_listmount)
+
++#define __NR_lsm_get_self_attr 459
+ __SYSCALL(__NR_lsm_get_self_attr, sys_lsm_get_self_attr)
-#define __NR_lsm_set_self_attr 458
++#define __NR_lsm_set_self_attr 460
+ __SYSCALL(__NR_lsm_set_self_attr, sys_lsm_set_self_attr)
-#define __NR_lsm_list_modules 459
++#define __NR_lsm_list_modules 461
+ __SYSCALL(__NR_lsm_list_modules, sys_lsm_list_modules)
+
#undef __NR_syscalls
- #define __NR_syscalls 459
-#define __NR_syscalls 460
++#define __NR_syscalls 462
/*
* 32 bit systems traditionally used different
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: linux-next: manual merge of the security tree with the vfs-brauner tree 2023-11-20 3:31 Stephen Rothwell @ 2023-11-20 21:09 ` Paul Moore 0 siblings, 0 replies; 9+ messages in thread From: Paul Moore @ 2023-11-20 21:09 UTC (permalink / raw) To: Stephen Rothwell Cc: Christian Brauner, Casey Schaufler, Linux Kernel Mailing List, Linux Next Mailing List, Miklos Szeredi On Sun, Nov 19, 2023 at 10:31 PM Stephen Rothwell <sfr@canb.auug.org.au> wrote: > > Hi all, > > Today's linux-next merge of the security tree got conflicts in: > > arch/alpha/kernel/syscalls/syscall.tbl > arch/arm/tools/syscall.tbl > arch/arm64/include/asm/unistd32.h > arch/m68k/kernel/syscalls/syscall.tbl > arch/microblaze/kernel/syscalls/syscall.tbl > arch/mips/kernel/syscalls/syscall_n32.tbl > arch/mips/kernel/syscalls/syscall_n64.tbl > arch/mips/kernel/syscalls/syscall_o32.tbl > arch/parisc/kernel/syscalls/syscall.tbl > arch/powerpc/kernel/syscalls/syscall.tbl > arch/s390/kernel/syscalls/syscall.tbl > arch/sh/kernel/syscalls/syscall.tbl > arch/sparc/kernel/syscalls/syscall.tbl > arch/x86/entry/syscalls/syscall_32.tbl > arch/x86/entry/syscalls/syscall_64.tbl > arch/xtensa/kernel/syscalls/syscall.tbl > include/uapi/asm-generic/unistd.h > > between commit: > > 9fa5392c080e ("wire up syscalls for statmount/listmount") > > from the vfs-brauner tree and commit: > > 5f42375904b0 ("LSM: wireup Linux Security Module syscalls") > > from the security tree. > > I fixed it up (see below) and can carry the fix as necessary. This > is now fixed as far as linux-next is concerned, but any non trivial > conflicts should be mentioned to your upstream maintainer when your tree > is submitted for merging. You may also want to consider cooperating > with the maintainer of the conflicting tree to minimise any particularly > complex conflicts. Thanks Stephen. -- paul-moore.com ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2026-09-23 15:39 UTC | newest] Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-09-23 13:25 linux-next: manual merge of the security tree with the vfs-brauner tree Mark Brown 2026-09-23 15:39 ` Mark Brown -- strict thread matches above, loose matches on Subject: below -- 2026-09-14 11:48 Mark Brown 2026-09-14 13:18 ` Jori Koolstra 2026-04-06 14:05 Mark Brown 2024-09-10 3:27 Stephen Rothwell 2024-09-10 19:45 ` Paul Moore 2023-11-20 3:31 Stephen Rothwell 2023-11-20 21:09 ` Paul Moore
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®