On Tue, 2026-11-10 at 10:14 +0100, Christian Brauner wrote: > Initialize securityfs as a pseudo filesystem. This raises SB_I_PSEUDO > and > also SB_I_NOEXEC and SB_I_NODEV. securityfs never holds executables > or > device nodes. > > AppArmor puts a .null device node into securityfs but only ever opens > it via dentry_open() which doesn't care about SB_I_NODEV. > > Signed-off-by: Christian Brauner (Amutable) <[email protected]>
Reviewed-by: Alexander Mikhalitsyn <[email protected]> > --- > security/inode.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/security/inode.c b/security/inode.c > index 080402367674..93997a9f16fc 100644 > --- a/security/inode.c > +++ b/security/inode.c > @@ -14,6 +14,7 @@ > #include <linux/kobject.h> > #include <linux/fs.h> > #include <linux/fs_context.h> > +#include <linux/pseudo_fs.h> > #include <linux/mount.h> > #include <linux/pagemap.h> > #include <linux/init.h> > @@ -64,6 +65,7 @@ static const struct fs_context_operations > securityfs_context_ops = { > > static int securityfs_init_fs_context(struct fs_context *fc) > { > + fc_init_pseudo(fc); > fc->ops = &securityfs_context_ops; > return 0; > }
