Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5;
IronPort-PHdr: A9a23:5HLOhRIdfDTsVc70ZdmcuDdnWUAX0o4cQyYLv8N0w7sbaL+quo/iN
 RaCu6YlhwrTUIHS+/9IzPDbt6nwVGBThPTJvCUMapVRUR8Ch8gM2QsmBc+OE0rgK/D2KSc9G
 ZcKTwp+8nW2OlRSApy7aUfbv3uy6jAfAFD4Mw90Lf7yAYnck4G80OXhnv+bY1Bmnj24M597M
 BjklhjbtMQdndlHJ70qwxTE51pkKc9Rw39lI07Wowfk65WV3btOthpdoekg8MgSYeDfROEVX
 bdYBTIpPiUO6cvnuAPqYSCP63AfAQB02hBIVkva3TiiD7rj9RTbi+cm9BehfsexT+1sUw2t4
 Jt2agK4kj4VOxQ03VCQ18Ml38c56Bj0lgQv7rzZfMK2NthmfKfRc/UFHDRIZMoNbyhuXoOgQ
 bQDC7AQOudSvbajjFUUoDiTPwqiG83UwDJzoXXd4LQ66uInVifZ/Qp+P/Ict3v5j4zzH7cRD
 d64yIPi4DbgV+193R2stKn4Sw4ThNOUdqhUf9iJzRZyEDHAtASIsKzAFje5/d82sGOEt/Rva
 LqV1XcssyNU+Gadm54Uh67j15w0zH2Y5HhC7J8fZoKRHR0zcZulCpxWryaAK85sT9g/R309o
 C8h0e5uUf+TeSELzNEqyxHSaPXdL86G+Bv+UuaWLzpiwn5oK/qzhBe3pFCp0fa0FtK131BDs
 jdfn5HSu2oM2R3e5onPSvZ08kq7nzfa/w7J4/xCIUc6mLCdLJgkw7UqkYEUv1iFFSjz8Hg=
IronPort-SDR: 6538e32b_U3zacnnPsKZ3xGk6c341IlpSq4jaFx0096SuLkK3RE68Uhn
 ysGwwLRSC6fEcG6NC/egrYu1QmrmcISluIu582Q==
IronPort-PHdr: A9a23:lm+lThVn8LMB/Akmi+IVZ2jSJojV8KyzVDF92vMcY89mbPH6rNzra
 VbE7LB2jFaTANuIo/kRkefSurDtVSsa7JKIoH0OI/kuHxNQh98fggogB8CIEwv8KvvrZDY9B
 8NMSBlu+HToeVMAA8v6albOpWfoqDAIEwj5NQ17K/6wHYjXjs+t0Pu19YGWaAJN11/fKbMnA
 g+xqFf9v9Ub07B/IKQ8wQebh3ZTYO1ZyCZJCQC4mBDg68GsuaJy6ykCntME2ot+XL/hfqM+H
 4wdKQ9jHnA+5MTtuhSGdgaJ6nYGe0k9khdDAFugjlnwXsKyrRrT7rtQym6lHPD7FpwKYneoq
 KU2EBXRhyg7KhwkoHvOmMBagY9q50+u8k8aocbeNbCNZNdMc7+eXtE4XWhFUsh3SHUfC7mwM
 7MLILYBIchno42ntlwPpwmBWyKiHu7M5wVLiGDY5qc36MMrOjzf3DUmGZUor1XS8vXVJqAdf
 MPsyoLYzmn9Yvd88xr+y7DWWRQL8K2tbYtuQ+/z0WI1Mw3X1lHP9IvXOgnEzv0tlkGfw8Fbb
 uGklDY5pDwpmGa2zd8Or9OXtN9M8l3j33Rn4YAYeczlc2JiS537Oc4D/zHfNpFxRNslWX0to
 ish17ka7IayZzNZoHxG7xvWavjCdpSBzj65CaCfOz5lgnJidr+lwRq/ogCsyez5A9G9y00C7
 jFEnd/Fqm0X2lTN59KGRPpw8gbp2TuG2w3JrOARCU4unLfdK5kvz6R2kZwWsE/ZGTTxllmwh
 6iTHng=
IronPort-Data: A9a23:Qt00ray91deCC1/K5pp6t+ezwirEfRIJ4+MujC+fZmUNrF6WrkUEn
 GQbXD2AOfzZNmLzKYxyPo6x8UoF7cCAnd5jQAZtqFhgHilAwSbn6Xt1DatQ0we6dJCroJdPt
 p1GAjX4BJloCCWa/H9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7dRbrVA357hWGthh
 fuo+5eEYQf/hmYtWo4pw/vrRC1H7KyaVAww4wRWicBj5Df2i3QTBZQDEqC9R1OQrl58R7PSq
 07rldlVz0uBl/sfIorNfoXTLiXmdoXv0T2m0RK6bUQCbi9q/UTe2o5jXBYVhNw+Zz+hx7idw
 /0V3XC8pJtA0qDkwIwgvxdk/y5WO+pKo7DsJSOFgZaK8w75dGvx7rZNNRRjVWEY0r4f7WBm7
 vkEMHYAfhuDweysya+9Su5ii95lIMSD0IE34yw7i2CGS695ENaaGfqiCdxwhF/cguhLHP3eb
 scdLyVibQ/bSxROIVocTpwklfquhn7xficepF/9Sa8fujiDkF0ojuC1WDbTUoG7HttNvWOFn
 1z59lnyHSg1H+Xc1CXQpxpAgceKx0sXQrk6Hbm15vdsjFCJ7mkSCBQSVFCqp7+yjUvWc9hFI
 lES9zAGrqUo8kGvCN7nUHWQqWWYlh0RQdxdF6s98g7l4rLd/gKxHmEZSntEb9s8uYk9QjlC/
 lOAmdLkARRut7KYQGiX8afSqz6uUQAcK2MYZC4sTgYf5dTn5oYpgXrnS995DK+zyNn8BBn0w
 jaXvG4yiqt7pdUM0aqT/l3dhT+o4J/TQWYd9wXMdmyvqAh+YeaNZYuo7x7V5O1cJYyUSFWps
 30NmszY5+cLZbmOjDeMRuoNNLKk/fCINHvbm1EHN4It+Ryi/HmseY0W6zZ7TG9pO8EAZDjBb
 0jUtgdcopRUOROCb6hzeIuZCMkwy6XkU9P/WZj8d8dDZIRwcieG5yZwbEqd2Xyrm08p+YkhO
 I2cWdShC3cET6BmyiemAeAH3vk2xUgWwGLQQZfg5w+13KCTaH/TSaptGFKLb/pmt6KAiArQ+
 tdbccCNzn13S+DkbST/8YcXKUEMa3M8APjeodRZXvCMLxAgG2w7DfLVh7Q7dORNm6VTi/eN/
 XynXEJc4ETwiGeBKgiQbH1nLrT1Uv5XqXM9IDxpM02k1mYuZa6x46oFMZg6Z78q8Kpk1/Ecc
 hUeU5zdWbEeFXGepGVYNMOi6pJnMh/tixiHIiylZzYyZdhsSmQl5+PZQ+cmzwFXZgKfu9E3v
 rug0Q3WW9wEQQFjB9zRc/Wh0xW6un11pQ64dxGgzgB7KRSwort5YTf8lOE2KMwqIBDOjGnSn
 QWPDBtS4aGHr4Yp+ZObzeqJvqW4IdtYR0B6Jmj86arpFC/4+mH4/5RMftzVdh/gVUT12p6YW
 8Nr89/GPsYqpm1667hHL+4zzIYVxcfemLtB/wE1QFTJdwuKD51jEFmn3O5OlK1E9pldiBrrX
 0mK1IBQPLWXCsbbAXoUHg4Eb/uC594QiDL9/fQ4G2SkxS5VrZ6sc1ReAAmIswNZdIBKCYICx
 fwwnvIW5yiUqAsYAvzfgg96r22zf2E9CYM5vZQkMarXowsMyGAaR6fDCyXzsaq9W/8VPmYEe
 jar1bf/3ZJCzU//cl02J3jH/cxZob8s4Blq7lszF26lq+r/pM0c/UNuqGwsbwFv0B94/fp5O
 TFrO21LNKy+xWpUq/YZbV+8OTNqJUO/wVPw+WsrhWeCbkiPV07xFkMfF9uJ3ngk9zN7QmAG0
 pCekH3oQBT7TvHXhyESY3Nom9bnbN529zDBpvyZItS4L8EERgTh04CTZjsuihr4AMkOqlXNi
 st08c1RN6DqFy4ijJcqKoud1IUvTAK2G0lfc/dD/K82QGbWIgO20jnTKHKKW9hsIsbS+hSSE
 P1eJcNoVjW/2h2RrzsdO7U+Hr9skNMt5/sAYrnOJ1Nag4CArzFsjo3cxhL+iEAvXd9qt8Q3c
 aHVSB6vDU2SgiFyt1LWjcwZJFe9X8YIVDf80M+x7u8NMZAJ68NoUEMq14qLr2enCxRm8z2Ur
 TH8SffvlcI68rtVnqzoDqlnLCe3I4mqVO23rSaCg+4XZtbLacrzpwcZr2f8BDtvPJwTZs9Wk
 Iqcu9umzWLHu7cLC1rioaejLJUQx8uOX7twCPnVfV16hiqJXfH+7yQTo16YLYN7q/IDx82Fa
 TbhVu6OW480YepN/FxUdClULDgFAYvVcKrLhH2wvtaMODcnwC3FK9KsryaxZkoGciInHZraD
 z3lisaQ+9l3/YF+ND4ZNd5bArtTAlzqaY05ffLf6BiaCWiJhAuZm73AzBAP1xDCOkOmIu3bv
 63XZ0HZWkypmafqyNp5jdRDjicPBiwgvdhqL1MvxdFmrhubUkgEFL05GrcbAMh2lifS6snJV
 AvVZjF/NRSnDCV2SjSi0tHNRQzFO/cvPO3+LTkX/0+5TSe6KYeDIbl5/Bdb/HZEVWr//d6jN
 O0h1CX8DjqpzrFtYNQj1PixrONk5/Hdn1Yj20T2le7sCBc/X5QO8lFcHzR2aC+WKPGVyX33J
 lU0S14dEQv/AQT0HN17cnFYJAABsXm9h380ZCOI25DEt5/d0OREz+blNvru1qEYKv4HP6MKW
 Wi9Ul7lD7p6AZDPkfBBVwoVvJJJ
IronPort-HdrOrdr: A9a23:udbVVazkvSrN4imnzHDpKrPwKL1zdoMgy1knxilNoHtuA6qlfq
 GV7ZMmPHrP4gr5N0tPpTntAsa9qBDnhPxICOsqTNOftWDd0QPFEGgF1/qA/9SJIUbDH4VmtJ
 uIHZIfNDShNzVHZYST2njcL+od
From:   =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
To:     Alexander Mikhalitsyn <alexander@mihalicyn.com>,
        Christian Brauner <brauner@kernel.org>,
        Alexei Starovoitov <ast@kernel.org>,
        Paul Moore <paul@paul-moore.com>
CC:     Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        Quentin Monnet <quentin@isovalent.com>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        Miklos Szeredi <miklos@szeredi.hu>,
        Amir Goldstein <amir73il@gmail.com>,
        "Serge E. Hallyn" <serge@hallyn.com>, <bpf@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>,
        <gyroidos@aisec.fraunhofer.de>,
        =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
Subject: [RESEND RFC PATCH v2 09/14] lsm: Add security_inode_mknod_nscap() hook
Date:   Wed, 25 Oct 2023 11:42:19 +0200
Message-Id: <20231025094224.72858-10-michael.weiss@aisec.fraunhofer.de>
In-Reply-To: <20231025094224.72858-1-michael.weiss@aisec.fraunhofer.de>
References: <20231025094224.72858-1-michael.weiss@aisec.fraunhofer.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?R3V1VFpiZjRaSFJqTlYzYzJML3RMZHNHQ2k1dUxTYnk3WXlEdmg2ODJHT3Uz?=
 =?utf-8?B?ZWQvQWNSNnhsdHV0UDdPYVU5cnZOSzJXd2l0Y0VBOTdHK3VLdWpDaDMvUDR1?=
 =?utf-8?B?ZndZTlh6Y0U0bm9Rc0N2azE0ZCtUQTJoNmxRNWltUEZoNEpkcm11TDlsT0hk?=
 =?utf-8?B?ZHpLLzRISGtURzVZUXh0OHMyZFIwaDlOWFJBVDBuUGN6Q2VNSCtXSHdDdWNL?=
 =?utf-8?B?d0tIV2hXbjdLMVROZWpobHdFdzUyWGpyanliRjd3b1htZFhVNmdOOTg2NVZM?=
 =?utf-8?B?bVFUZjBPNDYxbzNNZkp3eFBqVWRWcTg4Y3hpcFlqUnlySGpsdmZ6NTN0eVNG?=
 =?utf-8?B?Z1owWG1La01ydkQzaXAwV3o0Ly90OFhnMU9NODJyeGxUZUtoTEl2YWpEdlhM?=
 =?utf-8?B?clhaVXBKY0U3NEhmSS90RitsOG80cnAweWFuNmdVVW9Xd1JPNkFJS3BVQ0l2?=
 =?utf-8?B?QUtNSms1enlrb054cTdyUVdYbzRleG9lTkRxbDB3SnZUSXJsR3NCRWM1Q2Nw?=
 =?utf-8?B?SGIvRUFLaFdQN0l0Slh5ZW55eHVZdVYwb2RRR2ZYOVZuT1VvSWZWeFF0WkVq?=
 =?utf-8?B?T0lmb1B2enpIbWR6STNmM1NjdDEydFBwMkJXUnFDYmo0am9qbXc4UEZGZzFV?=
 =?utf-8?B?NFVUZmU1NjJBQmc5SWVMZHhZMTk2ZkxHVTVJUVRpOW1Yb1lGOHJnbjBPQVV3?=
 =?utf-8?B?L2wxRXgxNk1rMi9pK2JtSkFqdS91aDVGd1JzaFBlaWdmVEFxRWZXQXRUQUtt?=
 =?utf-8?B?M2MyRFRmNUk5cHpnNDRMVDVFUHZoejZxN0Q4cG9iYk1BV3ZYOWNNb2VNTHEw?=
 =?utf-8?B?S2FvUTZBS2NmTzBQK013N3VUWDJ5SXVuZGYzSEZUalA0M2d3elc3K0owazdm?=
 =?utf-8?B?NEVTaXhTa1VxL0FsdnFVTGhHbDJlS1ZGV1hMeXFLdnVtSlIrZlBpM1U0cnU5?=
 =?utf-8?B?aXFvWVdaY0svWVhoVDdzaXVhKzBCTEs0OGo3UnppdGQ1cmx3eWt5ekdIanp2?=
 =?utf-8?B?bkx1TEY1UzhCVlN6MFd1emxvck41MWc2MHF2SVZKSmFZczE2SXJUUnE2c2JF?=
 =?utf-8?B?QjRaUlViNE51dVY3WFVJK29IUkdpRWhLR3o5TWJRam03R3dkSVRPMVM2OTRM?=
 =?utf-8?B?UmtCdkdiREdvbDlvSzBodkVZMjFLNjNjd0FRS0RER1ZGdFV4SzJSV1lNbnR3?=
 =?utf-8?B?ZHUrUzJZTFM1U0lWTDh5NHNBMTl0d2FkZ3l0L3RzT05RVG5JSUwrS0VTdDNF?=
 =?utf-8?B?dllUSHJFVW9ZUnd2VEovc0paUCtmRFhOb1BpU3N1ZzZLTWdITUFqMUEyOTFi?=
 =?utf-8?B?RUgwK1RYMlhlRXRYeGtQenhFNW8ycmorSFBzMjNTajZCRE1zR3pWdUkvcGMv?=
 =?utf-8?B?bVVJWUpteUlrSEtheWZaU1ozSmFMTTFZTVlJWHpDRERvNUYxTU5wOE9Bd1hI?=
 =?utf-8?B?YWJQK0NwOUdzTTBqUXZaVTdCZW5MOW5wMGIrSDFHVWoyMDdUWW5ZN3d5WFI5?=
 =?utf-8?B?UHdma1RmZjI4VFVOM1JNckQ5TXJVcEx2cm84SWxJWllLMGVaekFqOEYxSGJz?=
 =?utf-8?B?SzBYdnVybVJwY3JSUTU0ZVZYUUl2U0VycW5IM0lzNDl0S2M1eThKZkF6UEpM?=
 =?utf-8?B?N3ZKclVTbmlka1FGaGs3TE5TK0RtbGowRlcvc2V2SGQ3MElHcVcreWpLdlpq?=
 =?utf-8?B?dDdzSE8rcDZKb244cWpJbnRDNmlzZmxMajdqS1kzS3djSjh1c0VxQUtRRTNo?=
 =?utf-8?B?UmhMQTJ2TUY0VFFId0duOWViV21NcWRSVEowZW1SakpaWXF1SDV0ck1yRE02?=
 =?utf-8?B?aWVnRmZIeGtiK0JEUVpvdHo4Vm5OUDZiY0hPSkM2Zjl6YXNVR1JpNGhrNjdZ?=
 =?utf-8?B?WksyU3dhU2lZc1N1YWhLRmJ6YnNna1UyUWd1VmNCOFA3UTdjTVl1Q1lOQ3pR?=
 =?utf-8?B?QmJIMCtjN242NDNFOEdNVjhaZlVhUTN0TFZiM0tySHdPYzJrR2xSZHM0NXdi?=
 =?utf-8?B?WlZSZHMyQlhZN1ZhQlNTamowMEhyRnZOMkdILzJtbzA3aHdDdTJadXQ1djFz?=
 =?utf-8?B?R1RJQVp6WTQzNXRuTWFwcDF6SDFmWUFmT0kwRkpvMWNuRlpwaG53eTVub1BY?=
 =?utf-8?B?YlhUMHFXU05HZjBTNjN3RktsMkVUZ0NvVTFaMzlqeUpQYkZvZ3RrRkpHdXNu?=
 =?utf-8?B?OUNnZlMxK09zN2x1Z0hoaU5zaTJBY1FuSUc3eVpYQ0JvM3ZLZkY5VGc2MXlY?=
 =?utf-8?Q?UcVBKl6QPIWrX+Q2m5BXtBGt00CNHFfqEKAf7UzxhE=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: fd20babc-28cd-4fe9-8807-08dbd53ec7a8
X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2791.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2023 09:43:01.9232
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: i17tVnSt+K4uX1eDD0MLlzzeLFTb3HVld8pidfmBqZ3Zv8IBBg7K/qOE/+PGE44wqbS8uBu74a0sSfiCFRjlXwy5O+TeZZOIRxP5HA29c+TK5MFchOdoPqFk/inlWUO9
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BE0P281MB0116
X-OriginatorOrg: aisec.fraunhofer.de
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,
	SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Wed, 25 Oct 2023 02:45:36 -0700 (PDT)

Provide a new lsm hook which may be used to allow mknod in
non-initial userns. If access to the device is guarded by this
hook, access to mknod may be granted by checking cap mknod for
unprivileged user namespaces.

By default this will return -EPERM if no lsm implements the
hook. A first lsm to use this will be the lately converted
cgroup_device module.

Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
---
 include/linux/lsm_hook_defs.h |  2 ++
 include/linux/security.h      |  8 ++++++++
 security/security.c           | 31 +++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+)

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index a868982725a9..f4fa01182910 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -276,6 +276,8 @@ LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
 LSM_HOOK(int, 0, inode_getsecctx, struct inode *inode, void **ctx,
 	 u32 *ctxlen)
 LSM_HOOK(int, 0, dev_permission, umode_t mode, dev_t dev, int mask)
+LSM_HOOK(int, -EPERM, inode_mknod_nscap, struct inode *dir, struct dentry *dentry,
+	 umode_t mode, dev_t dev)
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
 LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,
diff --git a/include/linux/security.h b/include/linux/security.h
index 8bc6ac8816c6..bad6992877f4 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -485,6 +485,8 @@ int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
 int security_locked_down(enum lockdown_reason what);
 int security_dev_permission(umode_t mode, dev_t dev, int mask);
+int security_inode_mknod_nscap(struct inode *dir, struct dentry *dentry,
+			       umode_t mode, dev_t dev);
 #else /* CONFIG_SECURITY */
 
 static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
@@ -1400,6 +1402,12 @@ static inline int security_dev_permission(umode_t mode, dev_t dev, int mask)
 {
 	return 0;
 }
+static inline int security_inode_mknod_nscap(struct inode *dir,
+					     struct dentry *dentry,
+					     umode_t mode, dev_t dev);
+{
+	return -EPERM;
+}
 #endif	/* CONFIG_SECURITY */
 
 #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
diff --git a/security/security.c b/security/security.c
index 40f6787df3b1..7708374b6d7e 100644
--- a/security/security.c
+++ b/security/security.c
@@ -4034,6 +4034,37 @@ int security_dev_permission(umode_t mode, dev_t dev, int mask)
 }
 EXPORT_SYMBOL(security_dev_permission);
 
+/**
+ * security_inode_mknod_nscap() - Check if device is guarded
+ * @dir: parent directory
+ * @dentry: new file
+ * @mode: new file mode
+ * @dev: device number
+ *
+ * If access to the device is guarded by this hook, access to mknod may be granted by
+ * checking cap mknod for unprivileged user namespaces.
+ *
+ * Return: Returns 0 on success, error on failure.
+ */
+int security_inode_mknod_nscap(struct inode *dir, struct dentry *dentry,
+			       umode_t mode, dev_t dev)
+{
+	int thisrc;
+	int rc = LSM_RET_DEFAULT(inode_mknod_nscap);
+	struct security_hook_list *hp;
+
+	hlist_for_each_entry(hp, &security_hook_heads.inode_mknod_nscap, list) {
+		thisrc = hp->hook.inode_mknod_nscap(dir, dentry, mode, dev);
+		if (thisrc != LSM_RET_DEFAULT(inode_mknod_nscap)) {
+			rc = thisrc;
+			if (thisrc != 0)
+				break;
+		}
+	}
+	return rc;
+}
+EXPORT_SYMBOL(security_inode_mknod_nscap);
+
 #ifdef CONFIG_WATCH_QUEUE
 /**
  * security_post_notification() - Check if a watch notification can be posted
-- 
2.30.2