On Wed, Mar 18, 2026 at 2:44 PM Song Liu <[email protected]> wrote: > > Now that all LSMs have been converted to granular mount hooks, > remove the old hooks: > > - security_sb_mount(): removed from lsm_hook_defs.h, security.h, > security.c, and its call in path_mount(). > - security_move_mount(): removed and replaced by security_mount_move() > in do_move_mount(). All LSMs now use mount_move exclusively. > > Code generated with the assistance of Claude, reviewed by human. > > Signed-off-by: Song Liu <[email protected]>
Reviewed-by: Stephen Smalley <[email protected]> Tested-by: Stephen Smalley <[email protected] # for selinux only > --- > fs/namespace.c | 6 +----- > include/linux/lsm_hook_defs.h | 4 ---- > include/linux/security.h | 16 --------------- > kernel/bpf/bpf_lsm.c | 2 -- > security/apparmor/lsm.c | 1 - > security/landlock/fs.c | 1 - > security/security.c | 38 ----------------------------------- > security/selinux/hooks.c | 2 -- > 8 files changed, 1 insertion(+), 69 deletions(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index de33070e514a..ba5baccdde67 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -4108,7 +4108,6 @@ int path_mount(const char *dev_name, const struct path > *path, > const char *type_page, unsigned long flags, void *data_page) > { > unsigned int mnt_flags = 0, sb_flags; > - int ret; > > /* Discard magic */ > if ((flags & MS_MGC_MSK) == MS_MGC_VAL) > @@ -4121,9 +4120,6 @@ int path_mount(const char *dev_name, const struct path > *path, > if (flags & MS_NOUSER) > return -EINVAL; > > - ret = security_sb_mount(dev_name, path, type_page, flags, data_page); > - if (ret) > - return ret; > if (!may_mount()) > return -EPERM; > if (flags & SB_MANDLOCK) > @@ -4538,7 +4534,7 @@ static inline int vfs_move_mount(const struct path > *from_path, > { > int ret; > > - ret = security_move_mount(from_path, to_path); > + ret = security_mount_move(from_path, to_path); > if (ret) > return ret; > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h > index 6bb67059fb43..95537574c40b 100644 > --- a/include/linux/lsm_hook_defs.h > +++ b/include/linux/lsm_hook_defs.h > @@ -69,8 +69,6 @@ LSM_HOOK(int, 0, sb_remount, struct super_block *sb, void > *mnt_opts) > LSM_HOOK(int, 0, sb_kern_mount, const struct super_block *sb) > LSM_HOOK(int, 0, sb_show_options, struct seq_file *m, struct super_block *sb) > LSM_HOOK(int, 0, sb_statfs, struct dentry *dentry) > -LSM_HOOK(int, 0, sb_mount, const char *dev_name, const struct path *path, > - const char *type, unsigned long flags, void *data) > LSM_HOOK(int, 0, sb_umount, struct vfsmount *mnt, int flags) > LSM_HOOK(int, 0, sb_pivotroot, const struct path *old_path, > const struct path *new_path) > @@ -79,8 +77,6 @@ LSM_HOOK(int, 0, sb_set_mnt_opts, struct super_block *sb, > void *mnt_opts, > LSM_HOOK(int, 0, sb_clone_mnt_opts, const struct super_block *oldsb, > struct super_block *newsb, unsigned long kern_flags, > unsigned long *set_kern_flags) > -LSM_HOOK(int, 0, move_mount, const struct path *from_path, > - const struct path *to_path) > LSM_HOOK(int, 0, mount_bind, const struct path *from, const struct path *to, > bool recurse) > LSM_HOOK(int, 0, mount_new, struct fs_context *fc, const struct path *mp, > diff --git a/include/linux/security.h b/include/linux/security.h > index 6e31de9b3d68..3610a49304c6 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -372,8 +372,6 @@ int security_sb_remount(struct super_block *sb, void > *mnt_opts); > int security_sb_kern_mount(const struct super_block *sb); > int security_sb_show_options(struct seq_file *m, struct super_block *sb); > int security_sb_statfs(struct dentry *dentry); > -int security_sb_mount(const char *dev_name, const struct path *path, > - const char *type, unsigned long flags, void *data); > int security_sb_umount(struct vfsmount *mnt, int flags); > int security_sb_pivotroot(const struct path *old_path, const struct path > *new_path); > int security_sb_set_mnt_opts(struct super_block *sb, > @@ -384,7 +382,6 @@ int security_sb_clone_mnt_opts(const struct super_block > *oldsb, > struct super_block *newsb, > unsigned long kern_flags, > unsigned long *set_kern_flags); > -int security_move_mount(const struct path *from_path, const struct path > *to_path); > int security_mount_bind(const struct path *from, const struct path *to, > bool recurse); > int security_mount_new(struct fs_context *fc, const struct path *mp, > @@ -818,13 +815,6 @@ static inline int security_sb_statfs(struct dentry > *dentry) > return 0; > } > > -static inline int security_sb_mount(const char *dev_name, const struct path > *path, > - const char *type, unsigned long flags, > - void *data) > -{ > - return 0; > -} > - > static inline int security_sb_umount(struct vfsmount *mnt, int flags) > { > return 0; > @@ -852,12 +842,6 @@ static inline int security_sb_clone_mnt_opts(const > struct super_block *oldsb, > return 0; > } > > -static inline int security_move_mount(const struct path *from_path, > - const struct path *to_path) > -{ > - return 0; > -} > - > static inline int security_mount_bind(const struct path *from, > const struct path *to, bool recurse) > { > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c > index 65235d70ee23..3e61c54f9b48 100644 > --- a/kernel/bpf/bpf_lsm.c > +++ b/kernel/bpf/bpf_lsm.c > @@ -350,7 +350,6 @@ BTF_ID(func, bpf_lsm_release_secctx) > BTF_ID(func, bpf_lsm_sb_alloc_security) > BTF_ID(func, bpf_lsm_sb_eat_lsm_opts) > BTF_ID(func, bpf_lsm_sb_kern_mount) > -BTF_ID(func, bpf_lsm_sb_mount) > BTF_ID(func, bpf_lsm_sb_remount) > BTF_ID(func, bpf_lsm_sb_set_mnt_opts) > BTF_ID(func, bpf_lsm_sb_show_options) > @@ -383,7 +382,6 @@ BTF_ID(func, bpf_lsm_task_prctl) > BTF_ID(func, bpf_lsm_task_setscheduler) > BTF_ID(func, bpf_lsm_task_to_inode) > BTF_ID(func, bpf_lsm_userns_create) > -BTF_ID(func, bpf_lsm_move_mount) > BTF_ID(func, bpf_lsm_mount_bind) > BTF_ID(func, bpf_lsm_mount_new) > BTF_ID(func, bpf_lsm_mount_remount) > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > index 7fe774535992..13a8049b1b59 100644 > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -1713,7 +1713,6 @@ static struct security_hook_list apparmor_hooks[] > __ro_after_init = { > LSM_HOOK_INIT(capget, apparmor_capget), > LSM_HOOK_INIT(capable, apparmor_capable), > > - LSM_HOOK_INIT(move_mount, apparmor_move_mount), > LSM_HOOK_INIT(mount_bind, apparmor_mount_bind), > LSM_HOOK_INIT(mount_new, apparmor_mount_new), > LSM_HOOK_INIT(mount_remount, apparmor_mount_remount), > diff --git a/security/landlock/fs.c b/security/landlock/fs.c > index 6e810550efcb..5f723a70baa4 100644 > --- a/security/landlock/fs.c > +++ b/security/landlock/fs.c > @@ -1857,7 +1857,6 @@ static struct security_hook_list landlock_hooks[] > __ro_after_init = { > LSM_HOOK_INIT(mount_reconfigure, hook_mount_reconfigure), > LSM_HOOK_INIT(mount_change_type, hook_mount_change_type), > LSM_HOOK_INIT(mount_move, hook_move_mount), > - LSM_HOOK_INIT(move_mount, hook_move_mount), > LSM_HOOK_INIT(sb_umount, hook_sb_umount), > LSM_HOOK_INIT(sb_remount, hook_sb_remount), > LSM_HOOK_INIT(sb_pivotroot, hook_sb_pivotroot), > diff --git a/security/security.c b/security/security.c > index 356ef228d5de..af95868af34d 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -1039,29 +1039,6 @@ int security_sb_statfs(struct dentry *dentry) > return call_int_hook(sb_statfs, dentry); > } > > -/** > - * security_sb_mount() - Check permission for mounting a filesystem > - * @dev_name: filesystem backing device > - * @path: mount point > - * @type: filesystem type > - * @flags: mount flags > - * @data: filesystem specific data > - * > - * Check permission before an object specified by @dev_name is mounted on the > - * mount point named by @nd. For an ordinary mount, @dev_name identifies a > - * device if the file system type requires a device. For a remount > - * (@flags & MS_REMOUNT), @dev_name is irrelevant. For a loopback/bind mount > - * (@flags & MS_BIND), @dev_name identifies the pathname of the > object being > - * mounted. > - * > - * Return: Returns 0 if permission is granted. > - */ > -int security_sb_mount(const char *dev_name, const struct path *path, > - const char *type, unsigned long flags, void *data) > -{ > - return call_int_hook(sb_mount, dev_name, path, type, flags, data); > -} > - > /** > * security_sb_umount() - Check permission for unmounting a filesystem > * @mnt: mounted filesystem > @@ -1141,21 +1118,6 @@ int security_sb_clone_mnt_opts(const struct > super_block *oldsb, > } > EXPORT_SYMBOL(security_sb_clone_mnt_opts); > > -/** > - * security_move_mount() - Check permissions for moving a mount > - * @from_path: source mount point > - * @to_path: destination mount point > - * > - * Check permission before a mount is moved. > - * > - * Return: Returns 0 if permission is granted. > - */ > -int security_move_mount(const struct path *from_path, > - const struct path *to_path) > -{ > - return call_int_hook(move_mount, from_path, to_path); > -} > - > /** > * security_mount_bind() - Check permissions for a bind mount > * @from: source path > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 415b5541ab9e..446e9e242134 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -7477,8 +7477,6 @@ static struct security_hook_list selinux_hooks[] > __ro_after_init = { > LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts), > LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts), > > - LSM_HOOK_INIT(move_mount, selinux_move_mount), > - > LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security), > LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as), > > -- > 2.52.0 >
