[PATCH] userns: security: Inform LSMs of capability check during userns creation

[PATCH] userns: security: Inform LSMs of capability check during userns creation

[Bradley Morgan]

Right now security_capable() gets called in create_user_ns() to snapshot
whether the parent could setfcap, but the LSM gets zero context on where
the check actually came from. It is the same story as setid: without a
dedicated flag, security modules cannot tell this apart from regular
capability checks.

Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().

Suggested-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
---
Thanks Christian for the suggestion :).
---
 include/linux/security.h | 2 ++
 kernel/user_namespace.c  | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index 40831fab54709..d24666a0b4833 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -75,6 +75,8 @@ struct nsset;
 #define CAP_OPT_NOAUDIT BIT(1)
 /* If capable is being called by a setid function */
 #define CAP_OPT_INSETID BIT(2)
+/* Is capable being called from the user namespace creation path? */
+#define CAP_OPT_USERNS_CREATE BIT(3)
 
 /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
 #define SECURITY_LSM_NATIVE_LABELS	1
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 57b7f10be74e1..37480f6d8369f 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
 	 * audit: the creator may never map uid 0.
 	 */
 	ns->parent_could_setfcap =
-		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
+		!security_capable(new, parent_ns, CAP_SETFCAP,
+				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
 
 	ret = ns_common_init(ns);
 	if (ret)
-- 
2.53.0

Re: [PATCH] userns: security: Inform LSMs of capability check during userns creation

[Serge E. Hallyn]

On Wed, Nov 11, 2026 at 08:58:14PM +0000, Bradley Morgan wrote:
> Right now security_capable() gets called in create_user_ns() to snapshot
> whether the parent could setfcap, but the LSM gets zero context on where
> the check actually came from. It is the same story as setid: without a
> dedicated flag, security modules cannot tell this apart from regular
> capability checks.
> 
> Add CAP_OPT_USERNS_CREATE and pass it along from create_user_ns().

This should be patch 1/N in a set that introduces a user of it
in some lsm.

> Suggested-by: Christian Brauner <brauner@kernel.org>
> Link: https://lore.kernel.org/all/20261111-kommt-gischt-ohnedies-469998d2f219@brauner/
> Signed-off-by: Bradley Morgan <bradley.morgan@linux.dev>
> ---
> Thanks Christian for the suggestion :).
> ---
>  include/linux/security.h | 2 ++
>  kernel/user_namespace.c  | 3 ++-
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 40831fab54709..d24666a0b4833 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -75,6 +75,8 @@ struct nsset;
>  #define CAP_OPT_NOAUDIT BIT(1)
>  /* If capable is being called by a setid function */
>  #define CAP_OPT_INSETID BIT(2)
> +/* Is capable being called from the user namespace creation path? */
> +#define CAP_OPT_USERNS_CREATE BIT(3)
>  
>  /* LSM Agnostic defines for security_sb_set_mnt_opts() flags */
>  #define SECURITY_LSM_NATIVE_LABELS	1
> diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
> index 57b7f10be74e1..37480f6d8369f 100644
> --- a/kernel/user_namespace.c
> +++ b/kernel/user_namespace.c
> @@ -134,7 +134,8 @@ int create_user_ns(struct cred *new)
>  	 * audit: the creator may never map uid 0.
>  	 */
>  	ns->parent_could_setfcap =
> -		!security_capable(new, parent_ns, CAP_SETFCAP, CAP_OPT_NOAUDIT);
> +		!security_capable(new, parent_ns, CAP_SETFCAP,
> +				  CAP_OPT_NOAUDIT | CAP_OPT_USERNS_CREATE);
>  
>  	ret = ns_common_init(ns);
>  	if (ret)
> -- 
> 2.53.0