On Feb 24, 2025 Miklos Szeredi <mszeredi@xxxxxxxxxx> wrote: > > Watching mount namespaces for changes (mount, umount, move mount) was added > by previous patches. > > This patch adds the file/watch_mountns permission that can be applied to > nsfs files (/proc/$$/ns/mnt), making it possible to allow or deny watching > a particular namespace for changes. > > Suggested-by: Paul Moore <paul@xxxxxxxxxxxxxx> > Link: https://lore.kernel.org/all/CAHC9VhTOmCjCSE2H0zwPOmpFopheexVb6jyovz92ZtpKtoVv6A@xxxxxxxxxxxxxx/ > Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> > --- > security/selinux/hooks.c | 3 +++ > security/selinux/include/classmap.h | 2 +- > 2 files changed, 4 insertions(+), 1 deletion(-) Thanks Miklos, this looks good to me. VFS folks / Christian, can you merge this into the associated FSNOTIFY_OBJ_TYPE_MNTNS branch you are targeting for linux-next? Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx> -- paul-moore.com
