Re: [PATCH v6 4/8] selinux: Convert from sb_mount to granular mount hooks

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The patch series unregisters the `sb_mount` and `move_mount` LSM hooks in SELinux and AppArmor, replacing them with new granular hooks (`mount_bind`, `mount_new`, etc.). However, it completely fails to update the VFS layer (`fs/namespace.c`) to actually call these new `security_mount_*` wrappers. Because the VFS still calls the legacy `security_sb_mount()` and `security_move_mount()` functions, and the LSMs no longer provide handlers for them, the LSM framework silently defaults to returning 0 (success). This causes a total bypass of all mount permission checks for both SELinux and AppArmor.
--

--- Patch [4]: [PATCH v6 4/8] selinux: Convert from sb_mount to granular mount hooks ---
commit 55260dac718bdd3a6181cc49259e13a6867345fb
Author: Song Liu <[email protected]>

selinux: Convert from sb_mount to granular mount hooks

This commit replaces the monolithic selinux_mount hook with granular
mount hooks such as mount_bind, mount_new, and mount_remount. It removes
the legacy sb_mount and move_mount hooks from the selinux_hooks array.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 0f704380a8c81..85c168c204364 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c

[ ... ]

> @@ -7558,13 +7577,16 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = {
>  	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
>  	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
>  	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
> -	LSM_HOOK_INIT(sb_mount, selinux_mount),
> +	LSM_HOOK_INIT(mount_bind, selinux_mount_bind),
> +	LSM_HOOK_INIT(mount_new, selinux_mount_new),
> +	LSM_HOOK_INIT(mount_remount, selinux_mount_remount),
> +	LSM_HOOK_INIT(mount_reconfigure, selinux_mount_reconfigure),
> +	LSM_HOOK_INIT(mount_change_type, selinux_mount_change_type),
> +	LSM_HOOK_INIT(mount_move, selinux_move_mount),
>  	LSM_HOOK_INIT(sb_umount, selinux_umount),
>  	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
>  	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
>  
> -	LSM_HOOK_INIT(move_mount, selinux_move_mount),
> -

[Severity: Critical]
Are there accompanying changes to the VFS layer in fs/namespace.c to actually
call these new security_mount_* wrappers?

If sb_mount and move_mount are unregistered here, but the VFS still calls the
legacy security_sb_mount() and security_move_mount(), will the LSM framework
silently default to returning 0 (success) because the handlers are gone?

Could this result in a complete bypass of all mount permission checks for
SELinux?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4