> The only thing that is not clear to me about the sb_device_access hook is, what we can check inside it practically? > Yes, we have an access to struct super_block, but at this point this structure is not filled with anything useful. We only > can determine a filesystem type and that's all. It means that we can use this hook as a flag that says "ok, we do care about device permissions, > kernel, please do not set SB_I_NODEV for us". Am I correct? What the the LSM needs to definitely know is what filesystem type and what user namespace are relevant. Because this whole thing is mostly interesting for the != init_user_ns case here. And both things are already present at that point in time (Technically, kernfs stuff can be a bit different but kernfs stuff does have SB_I_NODEV unconditionally so it really doesn't matter.).The thing is though that you want device access settled as soon as possible when the superblock isn't yet exposed anywhere. And for that alloc_super() is pretty convenient. Then you don't have to put much thought into it. But we can always move the hook to another place. It's also feasible to do this in vfs_get_tree() for example and provide the fs_context but again. I don't see why we need to do this now.
