Re: [PATCH v6 6/8] tomoyo: Convert from sb_mount to granular mount hooks

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The patch series introduces a complete access control bypass for mount operations across all LSMs (Tomoyo, AppArmor, SELinux, Landlock).
--

--- Patch [6]: [PATCH v6 6/8] tomoyo: Convert from sb_mount to granular mount hooks ---
commit b14cd8de9e00724d26864e133cbd2962345e3c1c
Author: Song Liu <[email protected]>

tomoyo: Convert from sb_mount to granular mount hooks

This patch replaces tomoyo_sb_mount() with granular mount hooks. Each hook
reconstructs the MS_* flags expected by tomoyo_mount_permission() to perform
security checks for bind mounts, new mounts, remounts, and other operations.

> diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
> index c66e02ed8ee3b..eec3df35e28e5 100644
> --- a/security/tomoyo/tomoyo.c
> +++ b/security/tomoyo/tomoyo.c
[ ... ]
> @@ -576,7 +662,12 @@ static struct security_hook_list tomoyo_hooks[] __ro_after_init = {
>  	LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
>  	LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
>  	LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
> -	LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
> +	LSM_HOOK_INIT(mount_bind, tomoyo_mount_bind),
> +	LSM_HOOK_INIT(mount_new, tomoyo_mount_new),
> +	LSM_HOOK_INIT(mount_remount, tomoyo_mount_remount),
> +	LSM_HOOK_INIT(mount_reconfigure, tomoyo_mount_reconfigure),
> +	LSM_HOOK_INIT(mount_change_type, tomoyo_mount_change_type),
> +	LSM_HOOK_INIT(mount_move, tomoyo_mount_move),
>  	LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),

[Severity: Critical]
By removing the sb_mount hook here, does this introduce a regression where
mount access control policies are entirely bypassed during a git bisect?

Looking at path_mount() in fs/namespace.c, the VFS layer still relies on the
legacy security_sb_mount() wrapper which calls the sb_mount hook:

fs/namespace.c:path_mount() {
    ...
    ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
    if (ret)
        return ret;
    ...
}

If this patch is applied before the VFS layer is updated to invoke the new
security_mount_* hooks, wouldn't security_sb_mount() simply evaluate to 0
since the LSM no longer implements sb_mount? This seems to unconditionally
allow mounts that should be denied by policy.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=6