On Tue, Mar 24, 2026 at 6:02 PM Tetsuo Handa <[email protected]> wrote: [...] > >>>> I guess something like untested diff shown below would work. > >>> > >>> I think this doesn't work with erofs on file (requires > >>> CONFIG_EROFS_FS_BACKED_BY_FILE). erofs may not be the > >>> only one that has this problem. > >> > >> This is incomplete but I think this is better than now because currently > >> mount() operation likely fails with -ENOENT if the requested filesystem > >> does not interpret fc->source as a pathname despite tomoyo_mount_acl() > >> always interprets fc->source as a pathname when FS_REQUIRES_DEV is set. > > > > If I understand Christian correctly, the main challenge here is that > > FS_REQUIRES_DEV doesn't imply fc->source is the path of a device. > > Correct. FS_REQUIRES_DEV no longer implies that fc->source is a pathname. > > > Changing this assumption is a major change between VFS and many > > filesystems. > > Wrong. I'm not trying to change this assumption. I'm trying to move LSM hook > to a location after fc->source was interpreted by individual filesystem.
OK, I can understand your point now. And I don't see a big red flag with it. > > > > I was thinking about something like: > > > > diff --git i/fs/super.c w/fs/super.c > > index 378e81efe643..91ce3003bc23 100644 > > --- i/fs/super.c > > +++ w/fs/super.c > > @@ -1676,6 +1676,9 @@ int get_tree_bdev_flags(struct fs_context *fc, > > errorf(fc, "%s: Can't lookup blockdev", fc->source); > > return error; > > } > > + error = security_mount_dev(fc, dev); > > + if (error) > > + return error; > > fc->sb_flags |= SB_NOSEC; > > s = sget_dev(fc, dev); > > if (IS_ERR(s)) > > > > This allows the LSMs to monitor the dev being mounted in a new mount. > > Splitting into multiple LSM hooks does not work, for TOMOYO wants to check > all parameters (parameters currently passed to security_mount_new() + the > "struct path" which was resolved by individual filesystem from fc->source > parameter) in one location. > > I'm not sure how security_mount_new() is called for fsconfig() case. > Does https://man7.org/linux/man-pages/man2/fsconfig.2.html#EXAMPLES mean > TOMOYO cannot check all parameters until move_mount() is called? We need to add hooks for fsopen(), fsconfig(), etc. I have some basic code for these. But I would rather we address this set first. After this, the other hooks should be more straightforward. Thanks, Song
