From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sonic317-32.consmr.mail.bf2.yahoo.com (sonic317-32.consmr.mail.bf2.yahoo.com [74.6.129.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7005372B2F for ; Tue, 17 Feb 2026 17:59:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.6.129.87 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771351190; cv=none; b=NVaJRH0GbIZlc2w96DCCqQZPEFj6w32E2aYLkeFln+ciODbmkHVUvYVTQKyzeDR9yPuIKmnXA6u82YgF6nInw/1KaVDj90CcKJrgpZcH38FG8BIGzHOCkZkcN6dMxDu/alRn4jn1B1Mj/6YumSzLQoOZFps5W5Tg3/mexI09Q5s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771351190; c=relaxed/simple; bh=LXAaA6UfhsfUCQ8ySjuTNnwtOh6Kdjuq+P9PBoM2Eos=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=BCpC+UpkcLylC8hNUzPVnUAoxl3tdF8Z1fpBcQ/KKkdmI5rE7UnrsE6ZkL6YOeBfxNMYQAumksVXMX8+3s1c+XqIblwy1MMzDTBi2g+EBITuZrOdjSKhrg05J1YiLEjvGw0CPKQSg2FTDjZ4ofzqIa1CUnzQ8XYMLR39QzMyeTc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com; spf=none smtp.mailfrom=schaufler-ca.com; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b=Es38Be21; arc=none smtp.client-ip=74.6.129.87 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=schaufler-ca.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="Es38Be21" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1771351187; bh=EK9AHzFKgwkJiODkk798f35egRzjNc9C4yeF5yhWtdI=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From:Subject:Reply-To; b=Es38Be211x2DRRJr12/P1YpXyKXA6wvu/MZ007BGoOreA3m98QsphgLRLp98Ghvbv1sh7hNsag4asAkXPgmPK8es1fWsB2yXXwuEUSl6jPBgnnqEV+GavK/czMRmLWsBH+pTOAsBUQugd3tJc7gQJGtZn7jTmcgZhM4gptpXUEJJ7EgIXBImO6lW0mgnFXoWhB0FXO0K2CdnNQM6mNsYU3dpv8i0jI4hnNank7TKMYfhVhMomYp8b+N0zMT3J6LmydswQmLLeWwtChLHFCNhREIiOvlbqRo7bipMuepy3uDt3Zs+qt5bG3hCFKLSf2IM0bcJxFpM2x1uu0kDgqRMsA== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1771351187; bh=1upw2y770fwsT4eJ5BVAItm17XXU+4vRv2s2pFIUZ1z=; h=X-Sonic-MF:Date:Subject:To:From:From:Subject; b=YSdgYP6xVsXACLMiACq7dxBQMAthFaQIWGsQ1VyKY/NbQSLEwtKc17gqT2opeZmUnhNjYstQX+1GLbvdyC0AiRL004dLzk89r99/ELztxzZrreA+PSK7VXifil6PSSE9m+Eee9L93Jnn5KtdjUkqx8ulpSyoCaILsDeQ2ggqRochoskMJC+exGo2rZ3WkIwOHzzD4VTzE3yZddIfK8H/NWrgfw/e997J7VzdlQ5PPE/G0m/rpI7unxGvp6tmiz0+djUuRfbri4k1yMgM2u9q7cmBDMb8YV4RtEs8AjC9HzdSnpZWTGMyfoZDuvg1LzOvUKsgHdziUNN70YD2SIZOoQ== X-YMail-OSG: v4Jt16MVM1msjb1OgM5OZPHixaZPDazpUHJMK0bb.iUzj1koMDII6s25ufBOVBN VtzXpf.BaBimH.1Nwy6gRVt1swqlaA3DBarmpKLnihPBOX9jYt_4SguUZ.llwwlUxWaSMKISN8YL 50RiK2zXDC9sUQDU2nOJzG0emn0y4E_8lXKuv43yCJS_jusx6fz02EeyPZpckK97.oubbqO0ggoq lRcm7LRTcyXNFVGBkymE71cMmv2zh6dTCWKgyYTNuE7NrIYIupWZIk1i5.z1Adu.DD20EgdYYkCj a7eSmNyl5NlOrY_zjfVkImCmbcy2bUxpfvmVNvtopdaE7sUzniV.VS0.UnWhU4k3Aqzkl_PfVYz7 dZhsDUbi8RbKFod82sGy5p4hx438k5oQn7WwmRGfy8y.CuJoOLKXZwbOKfeHf_kAy71KzmHzA28C Vur1Q8uO.4GHbQ59B6l9lROqDvV3kj1ke20ecMf5y9Qjp41YPBzTn97xE5H8NTaKzDH1Vj.AHWj. OzVWRHOla8ah6.I7URukdLmQdfch03SJxo9QrWCwuU1z0IgHSiq3pWAsDKUsj9zrHUK7o2utntIb ogb1iTVGyqvuF4NOvYRkI.xzJdkrscLbTwm5yjX_VxR4KuT1zvM75tXzNp4AHx.LWjd869ahvrXS 4hc3DQ9lnC3WRgReTeS6g9ln3HzzaQ0HK_GWjeBDEe4P0pOZLWxUfkbRZQcs32D_KhwyZSSOJZkq LDEAbpbP1GnoCA9uCQoJviEdbpct0wDA6VfHHXyla3x9v0I1YJG.Kq04RltDdRbol_kEfbPDkKE6 ffw0QTQmSltOfYgGXjrRP2fsAfJPgV06KUBFYrc2SPlIB6Swo1bNIgTo5E5B6R_uEMCFWcmo0WOD 2na2PF30MSxjRbW0AtPtEKTgQOqEv.Ft6uswOFNS4r08uBSQ6WIkfhFHPwq2dgvJq5v0RHkVvsZ6 _iVA7gRhJTfQp9N5l8mpU292kf_yFUN.WiIzd0ZVlDbh9ApnIlyWIr9Vi9l.oWu7WOqZGP4SM7ga g3.wJjMLBv8FfuRp3QJZaRmLiLVRg1SvlO_Bv.IA9yw2e4lT8Pso63F4stlskFmlKRkZw7VO2mSC f0kgBNnsYX3JNuDBO5TGcBoa3CXdBz72bvdhTB3I9_eYyY0W5R_Jnm5.kPzGWgshX2gYNGKCytgk UxG0IwbxlFmeyYLGVFA4c6tSNYmTNNiVlb5288r2QgFOaedEdFvZihrwqpeACXiE2CSMi0_XtCjH L5u2CA4ucxPPArZeFm7y9LxLrIUBlH4HPerNJnl0d_4VwjAv440QWrWGyQyvZsV8zYeMtGe3ztJP yjdh55LgODcMhDXJT9rZ2VL.IFtvhvk8KKV4IGNfUWKUO_s7OGPk6hjBgxaO7CPRsOMCxkQdrLXq DRZGIimPtFlC0.jb._BpvRzToR6PuOpcqK1cyNoJxktpplobZNPTTAU1a18Xqm7zp16Ko8odEHqd 8vY3.b8N9WIWf.T_tQxJklwPvF1AVG4_Bay3FKo7VjY1ApzDe0BZaxJmz9OH86w.Pj9CeBo_Q4Yu lHlxeMItl2nmlBvE.JEXDPDH92HMn9bi.6nF4GmAT3LfXscENbJhmm.Mxs8cx9jIblzwV_YvyMoc 63sntHOiCL9QXW1JdMFQfhcGRUu5c1mH2S0ifWl7CDgT6WQ8Ny2GIcpDTV3i1rA72df8M4Xe5IQw o3Mp5K5lYekGhFoq_ZawgV62GPWLaUkbNR8Zc43q.IaSd5O8XQKuB0158TGQOHXIeixuW1ezw_fZ R9n3hZgx.xtXB5IAmGepM2up6HgVvmKKqejFcydB41e6UnY_.TZ2DGC6OzhTxcCuwQs9c9RAaKRJ hX62HGkOekf7djsM5zkLcXXWxu5xcqbTHZ1fHOgiJGXSY9KBw7AnbdBFzK.taqLw_5nglIwU2lhh Td6b3nAls9_ZlgJkQDSiSQ25tlPObFzzg95YV12vk_iv6eLnqHomwjhC9O485TtMl5L5MK8E5wI_ e_phPHjZnntKhfNkKBAqKqKtIak8OZoUHkctKWXmc_D9bRRPu8WW2z2YR0FEzyUVjj2uvfFt5kpd yPi9zRvMSc2aj.Eg3XLNBrWxNAC0sAH0H62bxJZrtvJEYlU.IPreerHvofEv7_bd_1w6obEST..u JdrfpCMdxXVyOZ2rGGqSRpexL55lVMizIL_F_BQO77POkcvJSyAYeNgcx70KW_tkt2uj7V2A8zoA ueTJCdgS5zCU59lWIwK2XYrdT0VVrE.dj1y1nlJRoSVL9Cfy0TKJ8x_Xdg_GuuHWNahNAlToromC mkRY- X-Sonic-MF: X-Sonic-ID: 4108eaf2-1edd-45bf-b6b4-7dac18693e9e Received: from sonic.gate.mail.ne1.yahoo.com by sonic317.consmr.mail.bf2.yahoo.com with HTTP; Tue, 17 Feb 2026 17:59:47 +0000 Received: by hermes--production-gq1-6dfcf9f8b-xs62w (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID e2fe6b038456c66677c514cbe68907e1; Tue, 17 Feb 2026 17:29:21 +0000 (UTC) Message-ID: Date: Tue, 17 Feb 2026 09:29:19 -0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH RFC] security: add LSM blob and hooks for namespaces To: Christian Brauner Cc: Paul Moore , James Morris , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Casey Schaufler References: <20260216-work-security-namespace-v1-1-075c28758e1f@kernel.org> <20260217-glasur-hinnimmt-ac72b3e67661@brauner> Content-Language: en-US From: Casey Schaufler In-Reply-To: <20260217-glasur-hinnimmt-ac72b3e67661@brauner> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Mailer: WebService/1.1.25198 mail.backend.jedi.jws.acl:role.jedi.acl.token.atz.jws.hermes.yahoo On 2/17/2026 1:38 AM, Christian Brauner wrote: > On Mon, Feb 16, 2026 at 09:34:57AM -0800, Casey Schaufler wrote: >> On 2/16/2026 5:52 AM, Christian Brauner wrote: >>> All namespace types now share the same ns_common infrastructure. Extend >>> this to include a security blob so LSMs can start managing namespaces >>> uniformly without having to add one-off hooks or security fields to >>> every individual namespace type. >> The implementation appears sound. >> >> I have to question whether having LSM controls on namespaces is reasonable. > This is already in active use today but only in a very limited capacity. > This generalizes it. > >> I suppose that you could have a system where (for example) SELinux runs >> in permissive mode except within a specific user namespace, where it would >> enforce policy. Do you have a use case in mind? > We will use it in systemd services and containers to monitor and > supervise namespaces. While I am not among them, many people have objected strongly to making containers an identified entity in the kernel. If these hooks were available implementing a container scheme completely within the kernel would be reasonably strait forward. I might consider tackling it myself. I am also reminded of the kdbus effort of a decade ago: https://www.linuxfoundation.org/blog/blog/kdbus-details Are we ready for ksystemd? UNIX systems of the 1980's suffered greatly from an excessive enthusiasm for pushing user space functionality (e.g. STREAMS) into the kernel. Systemd is a fine scheme, but so was inittab, in a very different way. Adding kernel facilities to support particular application schemes is very tempting, but often leads to dead code and interfaces that require maintenance long after the user space scheme has moved on.