Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
IronPort-PHdr: A9a23:eEZLuhJkiVNlqM5m39mcuChnWUAX0o4cQyYLv8N0w7sbaL+quo/iN
 RaCu6YlhwrTUIHS+/9IzPDbt6nwVGBThPTJvCUMapVRUR8Ch8gM2QsmBc+OE0rgK/D2KSc9G
 ZcKTwp+8nW2OlRSApy7aUfbv3uy6jAfAFD4Mw90Lf7yAYnck4G80OXhnv+bY1Bmnj24M597M
 BjklhjbtMQdndlHJ70qwxTE51pkKc9Rw39lI07Wowfk65WV3btOthpdoekg8MgSYeDfROEVX
 bdYBTIpPiUO6cvnuAPqYSCP63AfAQB02hBIVgPkyy3fecngmXTFuudWxHGTHtTJZJwGUA+Qx
 IowRj3V0AM7OhozqFDp0pwl38c56Bj0qzpC86feXtilBOR6V/33Jv8HHjsefvhcCnRGRYm/f
 5IjIeMFHLwDlamglUdU8jaROQutI/js1DR6gVnEmqo076N+Eg7sxTQlEYohl3n3po6yG7wvD
 v6N/rDYwxngQON//Rnns9fVdk96rsydf49tLePA6GAWLyXVhViAl4XcExOW9+crqlKD3/V4C
 Pv1lFY7lTohnB6k2uIAio6Zrb0Ww1Lc9GIi+942YuS7HR0zcZulCpxWryaAK85sT9g/R309o
 C8h0e5uUf+TeSELzNEqyxHSRabbNYaS6w/lVOGfLC0+iH82ML68hhPn6UG70aW8Tci71l9Ws
 zBI2sfBrHED1hHfq4CHR/Jx813n2GOn2Rra9+dEJk45j+zcLZsgyaQ3jZ0drQLIGSqepQ==
IronPort-SDR: 6538e32d_qqFUkNDfE+GaAo77s5JplLIbgmHxK1JyQ2+Knb8aIqCaohb
 4QUEFxf5fUoJMNQFxPw7VF3SLuqrO3ByhgM+XGA==
IronPort-PHdr: A9a23:6zXrWBT+0EVSYsnXMXNFXV55E9psovKeAWYlg6HP9ppQJ/3wt523J
 lfWoO5thQWUA9aT4Kdehu7fo63sHnYN5Z+RvXxRFf4EW0oLk8wLmQwnDsOfT0r9Kf/hdSshG
 8peElRi+iLzKh1OFcLzbEHVuCf34yQbBxP/MgR4PKHyHIvThN6wzOe859jYZAAb4Vj1YeZcN
 hKz/ynYqsREupZoKKs61knsr2BTcutbgEJEd3mUmQrx4Nv1wI97/nZ1mtcMsvBNS777eKJqf
 fl9N3ELI2s17cvkuFz4QA2D62E1fk4WnxFLUG2npBv6C5zQlRffkbRs83alMcDdUeg9ei2dx
 otZQSTaowpcORwEqEXrh+h61JNl+EL09Hkdi4SBbKeoBNN0QPrtTc0ebDRrBepMDH0eIr2xM
 tMISOACLf90gYD5hgFVlzvjNxX2W87A9j1JoWT1w6YI1MITVgbI4Et/HN0kqUzRoo3aE6oxW
 7vy47L1kiv7XepG1xvex5jhVj47+q6RWe0rfvfA63QySyrUr3ypkar1ND6F6O00n0iYzulGT
 Ni3u3E/9hgrvQCz+Px8tK/Cmqc5yleU3hp6yYQtJJrjcxZ4JuenRcgYp2SbLYxwWsQ4XyRyt
 T0nzqFToZegZ3tiIPUPwhfeb7mCb4Gry0izEuiLKCp+hHVrdaj5ixvhuUSjy+ipTsCvyx4Kt
 StKlNDQq2oAnwLe8MmJS/Zxvw+h1D+D2hqV67RsL1o9iKzbLJAs2Pg3kJ8Sul7EBSj4hAP9i
 6r+Sw==
IronPort-Data: A9a23:/4GW7K9XJWpSyEoPCj00DrUDBHqTJUtcMsCJ2f8bNWPcYEJGY0x3x
 jEYD2vXafyIamT3Kt1+bomwpEkHscDVyt83SgU++HpEQiMRo6IpJzg2wmQcn8+2BpeeJK6yx
 5xGMrEsFOhtEjmG4E3F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZg6mJTqYb/W1jlV
 e/a+ZWFYwb9gWMsawr41orawP9RlKSq0N8nlgFmDRx7lAe2v2UYCpsZOZawIxPQKmWDNrfnL
 wpr5OjRElLxp3/BOPv8+lrIWhFirorpAOS7oiE+t55OIvR1jndaPq4TbJLwYKrM4tmDt4gZJ
 N5l7fRcReq1V0HBsLx1bvVWL81xFaEY0o/pIimHjZeo9HbvVVrvxrI1L2hjaOX0+s4vaY1P3
 ecdNChLYwCIh6S42rumTOlriMk5asXmVG8dkig9lneIUrB/HsGFGv+VjTNb9G9YasRmGPfVZ
 8MUbXxwYRXbeDVGO0waA9Qwhu61gHn4fTBC7l6YzUYyyzGIkVQuj+mwYbI5fPS7QcZagEW6r
 1vl+kX8LU1ED8K87zyspyfEaujn2HmTtJgpPLS8++5jhlGe3EQWCR0fUVqwsP//gUm7M/pVM
 UUJ/Cc0has/7kqmSp/6RRLQiHefojYfVsBWHul87xuCooLM6hudLnANUzoEbdshrsJwTjsvv
 neFltXoCDhHsbqaRHuH/LCE6zW/JUA9JGkOfy4FZQgI+d/upMc0lB2nZtNqCrK0iJvxECzYx
 zGMsTh4i7gN5eYQ0KO01VPKmTShot7OVAFdzhTXRUqr5EVyY4vNT46v6V6d4/9bMI+TQ1+Nl
 HcBksmaqusJCPmllzSWQeMCHJmq6uyDPTmahkRgd7E6+zqF9HmkcoRdpjp5IS9BMs8DfSLuS
 EDUvgxV6dlYO37CRa1wZ5m4I8cn167tEZLiTP+8RsNTb55tdQmv/Tppe0eU0mbx1kMrlMkXJ
 5aBdu6+AHAbF+JjzTyrV6Eay7Bt2yNW7WbSRpT81Dy8w7eEaXKUD7cYWHOHa+Ejs/iFpC3a9
 t9eM42BzBA3ePbzeCba2Y4aKVQbKz4wApWeg8ZPeMadLQd8XmIsEfncxfUmYYMNt6BUkPrYu
 3KwQElVzHLhinDdbwaHcHZubPXoR5kXhXY6OzE8eFiz13U9bIKH8qgSbd00cKMh+eglyuR7J
 8TpYO3ZX68KG2uComtMKMCn88p8cVKgwwyUNjejYD8xcoQmSwGhFsLYQzYDPRImV0KfncUkq
 qCm1gTVTIBFQAJnDc3Mb+mowU/3tn8Y8N+elWOSSjWKUBS9rNpZOGbqg+UpIsoBDxzGy3HIn
 0yVGBoU762F6YM87NCD1+jOopaLAtlOOBNQP1DayrKqagjc3G6omrFbXMiyIDvyaWLT+YeZX
 9tz8c3SCvM8sWxxg9JOKIozlaMazPnzloBe1TVhTSnqbUz0K7ZOIUum/Mhot49Nz49/vTqnB
 0eE//cDM7CJJvHgLk81ITAhT+Wc1MM7nivZwuQ1LX7bug523uujemdDMyacjBdyKONOD7ok5
 uM6qegq6wCboTg7AOas1yx72TyFES0dbv8BqJofPr7OtiMq7VNzObrnFS785cC0WeVma0UFD
 Gedu/vfuu562EHHTnsUEErN18p7gbAlmkhD7H0GFmSztuv1vN0F9zwPzm1vVSVQ9AtN7MxrM
 GsyN0FVG7SHzw01uOd9BVKTCyNzLzzH3Hfuymk5tnzTFGipcW3vEFcTG8iw+GIhzmYNWQQDo
 Z+5zj7+XCfIbfPB+HI4eXRYpszJSf1z8Qz/m/6bIfmVIqliYRTZr/+vQUEqtyrYBdgAgRybh
 Otyo8d1R67JFQ8RhKwZGYOq76s0TS7YFTZNXMNn3qMFIjzbcmuA3TOPdkODQeJWBvnw6UTjI
 ddfFsFOcBWf1Si1sTEQA5AXEYJ0hPIE4NkjeKvhAGw774uksTtitazP+hjEhGMER8tkleA/I
 Njzcw2uP3Oxh3wOvUPwt+hBZ3SFZOcbaD3G3Oya9PsDE7QBurpOdWAwyr6FgGWHAjB4/h67v
 BLxWIGO9rZMkb9TporLFrlPIy6WKtmpDeSBz12VguR0NNjKNZ/DihMRplzZJD9pBLo2Welst
 LGzodXyjVLkvrE3bjjjoKO/NZJ1vOe8YOkGFfjMDih+vTCDU8rS8Rc86ziGCZhWouh8uOijZ
 SWFMfWVS/BEdetZ9nNvbwpmLy08EIXyN6fpmjO8pa+DCz8byg32E+mk/n7IM0BeWDcDYaP8L
 grGqsee2M1Rg9VJNi8lGsNJPp5cC33gUJsAaNfem2S5DG6po1XaoZrkt0Mqxg/qA0m+MvTRw
 Mz6VDmnUzrqo4DO7tVSk7Iqjy0tFHwn3NUBJBMMyeB5mxWRLTAgL91EFb4kF5sNsCj59K+gV
 QH3dGF4VBnMB2VVQy7dvubmcByUXNEVG9HDITcswUOYRgG2CK6EA5pj7i1Q2Gh3SBSy0NCYL
 cwixVOoMiiT2p1JQcMh1s6/i8pjxdLYwSss0mL5mMrQHR0fIOsr0FpMIQlzbhHEQvr9zBjzG
 WsIRG56GRDxDQa7FMt7YHdaFS0IpD6lnX1icS6Lx82ZoImBivFJzPrkIezoz7kfd4IwKaUTQ
 W/sDX64i4xMNqf/ZYNy0z7xvZJJNA==
IronPort-HdrOrdr: A9a23:1ECvRKM9OzLtw8BcTvyjsMiBIKoaSvp037By7TEVdfUnSL39qy
 nOpoVi6faaskdzZJhNo7y90cq7MAjhHPxOkOss1N6ZNWGM0gaVxepZg7cKtgeBJ8SIzI9gPM
 lbHJSWQ+eAamSSxfyKhjVQPexQueW6zA==
From:   =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
To:     Alexander Mikhalitsyn <alexander@mihalicyn.com>,
        Christian Brauner <brauner@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Paul Moore <paul@paul-moore.com>
CC:     Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        Quentin Monnet <quentin@isovalent.com>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        Miklos Szeredi <miklos@szeredi.hu>,
        Amir Goldstein <amir73il@gmail.com>,
        "Serge E. Hallyn" <serge@hallyn.com>, <bpf@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>,
        <gyroidos@aisec.fraunhofer.de>,
        =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
Subject: [RESEND RFC PATCH v2 10/14] lsm: Add security_sb_alloc_userns() hook
Date:   Wed, 25 Oct 2023 11:42:20 +0200
Message-Id: <20231025094224.72858-11-michael.weiss@aisec.fraunhofer.de>
In-Reply-To: <20231025094224.72858-1-michael.weiss@aisec.fraunhofer.de>
References: <20231025094224.72858-1-michael.weiss@aisec.fraunhofer.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZGoxQnZNVHcxbTIxU1NJY1NtUnpORWQ5ckJsRWxkcEVsTXJXVitHanI0eVNp?=
 =?utf-8?B?TklvK2gyOGpNNFptclU0OHBHUXhraHYxV1puSmJKbkowWjlhcE9TV0Y4UWJm?=
 =?utf-8?B?Y0JrSDBZTjVPbjdCeHR4OHpiRFNKUU1TL2FVTUN6UForOHlvYlM5Vkc1dVVG?=
 =?utf-8?B?S1JYZFIrUFBwak0xK21WN2NBM1JPUDZQMjhucU5BakpQWkFTQVBLWVNwTHpv?=
 =?utf-8?B?dDFlZG5jK0d1Z3AvNFBlUis1K0xxVmdoUlplVVY3NWNIM280eXBLSmFLL1lB?=
 =?utf-8?B?aG1KOWdkQTdkSTR5Q3Qxcmdaak5lQml5bmx5SDVUb3R6eERPdHBoUVlWZ1hQ?=
 =?utf-8?B?YjBDWVVmSk1MRDBSMVJxRlF6c2hneFlBakR3endyelc4dVdJZHdDSEFYVWt5?=
 =?utf-8?B?U0dPMnhJaEtVYzNrVUp4NGNrTzJJbHVNWlUvRWg1amFmWTV6Y0VGZ1gyb2V1?=
 =?utf-8?B?RHR5cFZrV3JEbEdnV3ZWQnNPNzBxdTRteEYyWnk3cXRZMitMd2V5R0pMdU91?=
 =?utf-8?B?eHpDUmFwb0dYa2JjUzZNNEsvYVVrWkxoN0tNOUFhMWwrV3poYlpOOEV3QzI3?=
 =?utf-8?B?bERQQUUrYzB2Ums2TUlGZ2dNbjg1Z0FJblRQenZHajBmLzlIUWR2RFhPTU1J?=
 =?utf-8?B?N3o2VEE1TCs2V2syVXNQbUdFajlRbW5OY2NUSFRmNXhlSk5wUW1MWWF2SnRl?=
 =?utf-8?B?UzRqdnJVOEM5Vm45Q3FvZUZjTkE1dWswWG4xSHV0bHg0dlJEaDN5ZThvbXRE?=
 =?utf-8?B?dHpkMWwxUVMzYTRCOUVvRU0rQnc0UStjbHprMlpUY2dEWEpwbUhzUFhOSi9w?=
 =?utf-8?B?bzBacm9zWkZqL0tCakNvejJzcWhvWjVtUXB6dEVFREx6QXFvMllSdjYwTUx5?=
 =?utf-8?B?UEhQSFMzOWx4dCtDMFVXNXFvejFRMy83WUhEbld5Q2VOYVZHcGR1OHZMVnVx?=
 =?utf-8?B?TDRoTlVqUHlUVHJKaEpQNjV0d0VEVXcyblZMU3VQRjJpT1JRTytMQ1BMTC9C?=
 =?utf-8?B?emMzU2FHMkxRYUpLWHFYdUtvMlA1amxGRm1EVm5pNmZXc05Sd05UaS9WdU9q?=
 =?utf-8?B?MU5CZktZVWFpUy9UelRkVHpVTGhhaG53c3NReHRQTnpoNGtYOXllQ3gyYTFU?=
 =?utf-8?B?TWZsck1hZFFBZWd3aEJ1ejBmK1RUUUFhWnFXT1dGaFJ1RnhCd051WURKNUts?=
 =?utf-8?B?QzFpdUNlazhId1FCM09iclVhS2ZyMWpsSHMyeDFNcmo3aEJPZmc3RTBVUkR1?=
 =?utf-8?B?TXJRUkZFeCs3Q2J0REpGclUvT1V3Zml1dGdhSVBtOUQrVnJBeGlVdnJ1Vmpy?=
 =?utf-8?B?bDV0blBTQU1RQTJLMXpteHFtbXhyT1JUTm9SdWxKZWdkQlQrNUI3TC8zYU1M?=
 =?utf-8?B?K001QWt0dEwrR2FRRHREMnlsUGx1Y0Z0T09BcHdFUVc0U1F6ZG1MemFBbmlp?=
 =?utf-8?B?amJ3YytnSm5Fc1ZXNUhTWm1FeE9zbk9leVVndVNrWUJGaEQ2V0F6VjQ2d3lC?=
 =?utf-8?B?MmJqQ0M3NkNmOXFTRGFiNVB4ang4VjJiSnNQcHprQnRwTENpTjVvdUVEdXd3?=
 =?utf-8?B?c05UUEJPc2lWNk9mdUszc1BabkxJVmtJZ1A3NmkycXFUMGhrSVpiM2J3Qmhr?=
 =?utf-8?B?ZE5YdFRPaVMzZGx5ckdxWnpzdk55WDNhbHFwZlI3SldhdzN4dENtWjR1eklL?=
 =?utf-8?B?UHM2dUE3TXpsTlVFMDlxK2YzVk9NaFZqU2R4bHB3cCtLaUQ5aFVRY2IzU21i?=
 =?utf-8?B?aEVwaklpZTJTUUtJenIwS0twVVVXcEtYLzdNRDRhSVNoRDM5ZldmUFlSR04y?=
 =?utf-8?B?SVUyZHpKVjRqWW9mVzVYa0U0K0pCbXpTYjlFMWltaEttWWFxdlkvbzc5SUs4?=
 =?utf-8?B?WFhuSDVlVGdHYmhpM1J3V1RscjNmaEkzUUk1dEw3WUlwT0VlOUhBOU5jVngv?=
 =?utf-8?B?Q2ZVUWgyWXdvVjZnMFlSWEh2Q0xzcnBramMrOXl0SlFjSmNnODJJR1B2Zmt3?=
 =?utf-8?B?LzI4bDVlS0JjWEZ6Mk43MWpRaC9wdURvOXJ1WnNETFRPTzA5WGFOTlhjelYw?=
 =?utf-8?B?bTlsbjlPVXFZNlpna2grWWFLN0J3NzZVT09PcExIcm4ySzRyM2FHc29XOXpi?=
 =?utf-8?B?bXhwYkc3UXFFbkdYcURXdUhIN3gzdm01Qk9tS0JtNVNvc2RpSjN5WW00cm83?=
 =?utf-8?B?dWkvWGdoUzJhd2QwaHV6SWdPc3ovd1QvS25CVDZDS0Mzdm8zYVhCWEx0Mith?=
 =?utf-8?Q?yn/+SlXnuLdx8E715HKeKC312uXWCAv5Czigv4Tq1A=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: ce86aa94-ab14-4c5e-f490-08dbd53ec8b5
X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2791.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2023 09:43:03.6216
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: JgeP67re2q74JkCUO30lzjbAs+YaH9mKGtX3aa1EDydjk67ULJNDox/xr3C+mEVtIbzR0v14mz4P5IHzheYMFWb9xw3QkIN/bArfkH1/gJ4+r/cHrfLfBk1yhrOHCDkF
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BE0P281MB0116
X-OriginatorOrg: aisec.fraunhofer.de
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Wed, 25 Oct 2023 02:45:48 -0700 (PDT)

Provide a new lsm hook which may be used to allow access to device
nodes for super blocks created in unprivileged namespaces if some
sort of device guard to control access is implemented.

By default this will return -EPERM if no lsm implements the hook.
A first lsm to use this will be the lately converted cgroup_device
module.

Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
---
 include/linux/lsm_hook_defs.h |  1 +
 include/linux/security.h      |  5 +++++
 security/security.c           | 26 ++++++++++++++++++++++++++
 3 files changed, 32 insertions(+)

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index f4fa01182910..0f734a0a5ebc 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -278,6 +278,7 @@ LSM_HOOK(int, 0, inode_getsecctx, struct inode *inode, void **ctx,
 LSM_HOOK(int, 0, dev_permission, umode_t mode, dev_t dev, int mask)
 LSM_HOOK(int, -EPERM, inode_mknod_nscap, struct inode *dir, struct dentry *dentry,
 	 umode_t mode, dev_t dev)
+LSM_HOOK(int, -EPERM, sb_alloc_userns, struct super_block *sb)
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
 LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,
diff --git a/include/linux/security.h b/include/linux/security.h
index bad6992877f4..0f66be1ed1ed 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -487,6 +487,7 @@ int security_locked_down(enum lockdown_reason what);
 int security_dev_permission(umode_t mode, dev_t dev, int mask);
 int security_inode_mknod_nscap(struct inode *dir, struct dentry *dentry,
 			       umode_t mode, dev_t dev);
+int security_sb_alloc_userns(struct super_block *sb);
 #else /* CONFIG_SECURITY */
 
 static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
@@ -1408,6 +1409,10 @@ static inline int security_inode_mknod_nscap(struct inode *dir,
 {
 	return -EPERM;
 }
+static inline int security_sb_alloc_userns(struct super_block *sb)
+{
+	return -EPERM;
+}
 #endif	/* CONFIG_SECURITY */
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
diff --git a/security/security.c b/security/security.c
index 7708374b6d7e..9d5d4ec28e62 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4065,6 +4065,32 @@ int security_inode_mknod_nscap(struct inode *dir, struct dentry *dentry,
 }
 EXPORT_SYMBOL(security_inode_mknod_nscap);
 
+/**
+ * security_sb_alloc_userns() - Grand access to device nodes on sb in userns
+ *
+ * If device access is provided elsewere, this hook will grand access to device nodes
+ * on the allocated sb for unprivileged user namespaces.
+ *
+ * Return: Returns 0 on success, error on failure.
+ */
+int security_sb_alloc_userns(struct super_block *sb)
+{
+	int thisrc;
+	int rc = LSM_RET_DEFAULT(sb_alloc_userns);
+	struct security_hook_list *hp;
+
+	hlist_for_each_entry(hp, &security_hook_heads.sb_alloc_userns, list) {
+		thisrc = hp->hook.sb_alloc_userns(sb);
+		if (thisrc != LSM_RET_DEFAULT(sb_alloc_userns)) {
+			rc = thisrc;
+			if (thisrc != 0)
+				break;
+		}
+	}
+	return rc;
+}
+EXPORT_SYMBOL(security_sb_alloc_userns);
+
 #ifdef CONFIG_WATCH_QUEUE
 /**
  * security_post_notification() - Check if a watch notification can be posted
-- 
2.30.2