security_create_user_ns(9)

💅 security_create_user_ns(9) 💅

okay bestie, welcome to the Kernel API Manual — yes that's the manual name, we're in the kernel docs section and it is exactly as glamorous as it sounds 🎀

---

✨ NAME ✨

security_create_user_ns — the little gremlin that checks whether creating a new userns is even allowed 😤 like security's whole job is standing at the velvet rope going "name on the list?"

---

🌸 SYNOPSIS 🌸

int security_create_user_ns (const struct cred *cred );

that's it. one arg. one int back. the way that signature just sits there being simple? obsessed ✨

---

🦋 ARGUMENTS 🦋

• cred — prepared creds 💖 like, already prepped and ready, don't come at it with raw un-prepped creds, that's not the vibe.

---

💜 DESCRIPTION 💜

so literally what this does is check permission prior to creating a new user namespace 🫶 that's it, that's the whole gig. it's the bouncer at the door before the userns even gets to exist. no cap, it's giving gatekeeping but make it kernel security 💅

---

👑 RETURN 👑

• returns 0 if successful 😌 slay, we love a clean success
• otherwise returns < 0 error code 💀 so like if it's negative, something said no, and you should probably read that error code instead of ignoring it fr fr

---

🌈 SEE ALSO 🌈

bestie. sit down. there is a list. and it is long. like, the whole LSM fam showed up to this party and honestly? main character energy from every single one of them.

first up, straight from the kernel file ./security/security.c, then the entire extended family 👑

lsm_file_alloc(9), lsm_backing_file_alloc(9), lsm_blob_alloc(9),
lsm_cred_alloc(9), lsm_inode_alloc(9), lsm_task_alloc(9), lsm_ipc_alloc(9),
lsm_key_alloc(9), lsm_msg_msg_alloc(9), lsm_bdev_alloc(9),
lsm_bpf_map_alloc(9), lsm_bpf_prog_alloc(9), lsm_bpf_token_alloc(9),
lsm_superblock_alloc(9), lsm_fill_user_ctx(9),
security_binder_set_context_mgr(9), security_binder_transaction(9),
security_binder_transfer_binder(9), security_binder_transfer_file(9),
security_ptrace_access_check(9), security_ptrace_traceme(9),
security_capget(9), security_capset(9), security_capable(9),
security_quotactl(9), security_quota_on(9), security_syslog(9),
security_settime64(9), security_vm_enough_memory_mm(9),
security_bprm_creds_for_exec(9), security_bprm_creds_from_file(9),
security_bprm_check(9), security_bprm_committing_creds(9),
security_bprm_committed_creds(9), security_fs_context_submount(9),
security_fs_context_dup(9), security_fs_context_parse_param(9),
security_sb_alloc(9), security_sb_delete(9), security_sb_free(9),
security_free_mnt_opts(9), security_sb_eat_lsm_opts(9),
security_sb_mnt_opts_compat(9), security_sb_remount(9),
security_sb_kern_mount(9), security_sb_show_options(9),
security_sb_statfs(9), security_sb_mount(9), security_sb_umount(9),
security_sb_pivotroot(9), security_sb_set_mnt_opts(9),
security_sb_clone_mnt_opts(9), security_move_mount(9),
security_path_notify(9), security_inode_alloc(9),
security_inode_free(9), security_dentry_init_security(9),
security_dentry_create_files_as(9), security_inode_init_security(9),
security_inode_init_security_anon(9), security_path_mknod(9),
security_path_post_mknod(9), security_path_mkdir(9),
security_path_rmdir(9), security_path_unlink(9),
security_path_symlink(9), security_path_link(9),
security_path_rename(9), security_path_truncate(9),
security_path_chmod(9), security_path_chown(9), security_path_chroot(9),
security_inode_create(9), security_inode_post_create_tmpfile(9),
security_inode_link(9), security_inode_unlink(9),
security_inode_symlink(9), security_inode_mkdir(9),
security_inode_rmdir(9), security_inode_mknod(9),
security_inode_rename(9), security_inode_readlink(9),
security_inode_follow_link(9), security_inode_permission(9),
security_inode_setattr(9), security_inode_post_setattr(9),
security_inode_getattr(9), security_inode_setxattr(9),
security_inode_set_acl(9), security_inode_post_set_acl(9),
security_inode_get_acl(9), security_inode_remove_acl(9),
security_inode_post_remove_acl(9), security_inode_post_setxattr(9),
security_inode_getxattr(9), security_inode_listxattr(9),
security_inode_removexattr(9), security_inode_post_removexattr(9),
security_inode_file_setattr(9), security_inode_file_getattr(9),
security_inode_need_killpriv(9), security_inode_killpriv(9),
security_inode_getsecurity(9), security_inode_setsecurity(9),
security_inode_listsecurity(9), security_inode_getlsmprop(9),
security_inode_copy_up(9), security_inode_copy_up_xattr(9),
security_inode_setintegrity(9), security_kernfs_init_security(9),
security_file_permission(9), security_file_alloc(9),
security_file_release(9), security_file_free(9),
security_backing_file_alloc(9), security_backing_file_free(9),
security_file_ioctl(9), security_file_ioctl_compat(9),
security_mmap_file(9), security_mmap_backing_file(9),
security_mmap_addr(9), security_file_mprotect(9), security_file_lock(9),
security_file_fcntl(9), security_file_set_fowner(9),
security_file_send_sigiotask(9), security_file_receive(9),
security_file_open(9), security_file_post_open(9),
security_file_truncate(9), security_task_alloc(9),
security_task_free(9), security_cred_alloc_blank(9),
security_cred_free(9), security_prepare_creds(9),
security_transfer_creds(9), security_cred_getsecid(9),
security_cred_getlsmprop(9), security_kernel_act_as(9),
security_kernel_create_files_as(9), security_kernel_module_request(9),
security_kernel_read_file(9), security_kernel_post_read_file(9),
security_kernel_load_data(9), security_kernel_post_load_data(9),
security_task_fix_setuid(9), security_task_fix_setgid(9),
security_task_fix_setgroups(9), security_task_setpgid(9),
security_task_getpgid(9), security_task_getsid(9),
security_current_getlsmprop_subj(9), security_task_getlsmprop_obj(9),
security_task_setnice(9), security_task_setioprio(9),
security_task_getioprio(9), security_task_prlimit(9),
security_task_setrlimit(9), security_task_setscheduler(9),
security_task_getscheduler(9), security_task_movememory(9),
security_task_kill(9), security_task_prctl(9),
security_task_to_inode(9), security_ipc_permission(9),
security_ipc_getlsmprop(9), security_msg_msg_alloc(9),
security_msg_msg_free(9), security_msg_queue_alloc(9),
security_msg_queue_free(9), security_msg_queue_associate(9),
security_msg_queue_msgctl(9), security_msg_queue_msgsnd(9),
security_msg_queue_msgrcv(9), security_shm_alloc(9),
security_shm_free(9), security_shm_associate(9), security_shm_shmctl(9),
security_shm_shmat(9), security_sem_alloc(9), security_sem_free(9),
security_sem_associate(9), security_sem_semctl(9),
security_sem_semop(9), security_d_instantiate(9),
security_getselfattr(9), security_setselfattr(9),
security_getprocattr(9), security_setprocattr(9),
security_ismaclabel(9), security_secid_to_secctx(9),
security_lsmprop_to_secctx(9), security_secctx_to_secid(9),
security_release_secctx(9), security_inode_invalidate_secctx(9),
security_inode_notifysecctx(9), security_inode_setsecctx(9),
security_inode_getsecctx(9), security_post_notification(9),
security_watch_key(9), security_netlink_send(9),
security_unix_stream_connect(9), security_unix_may_send(9),
security_socket_create(9), security_socket_post_create(9),
security_socket_socketpair(9), security_socket_bind(9),
security_socket_connect(9), security_socket_listen(9),
security_socket_accept(9), security_socket_sendmsg(9),
security_socket_recvmsg(9), security_socket_getsockname(9),
security_socket_getpeername(9), security_socket_getsockopt(9),
security_socket_setsockopt(9), security_socket_shutdown(9),
security_sock_rcv_skb(9), security_socket_getpeersec_stream(9),
security_socket_getpeersec_dgram(9), lsm_sock_alloc(9),
security_sk_alloc(9), security_sk_free(9), security_sk_clone(9),
security_sk_classify_flow(9), security_req_classify_flow(9),
security_sock_graft(9), security_inet_conn_request(9),
security_inet_csk_clone(9), security_inet_conn_established(9),
security_secmark_relabel_packet(9), security_secmark_refcount_inc(9),
security_secmark_refcount_dec(9), security_tun_dev_alloc_security(9),
security_tun_dev_free_security(9), security_tun_dev_create(9),
security_tun_dev_attach_queue(9), security_tun_dev_attach(9),
security_tun_dev_open(9), security_sctp_assoc_request(9),
security_sctp_bind_connect(9), security_sctp_sk_clone(9),
security_sctp_assoc_established(9), security_mptcp_add_subflow(9),
security_unix_find(9), security_ib_pkey_access(9),
security_ib_endport_manage_subnet(9), security_ib_alloc_security(9),
security_ib_free_security(9), security_xfrm_policy_alloc(9),
security_xfrm_policy_clone(9), security_xfrm_policy_free(9),
security_xfrm_policy_delete(9), security_xfrm_state_alloc(9),
security_xfrm_state_alloc_acquire(9), security_xfrm_state_delete(9),
security_xfrm_state_free(9), security_xfrm_policy_lookup(9),
security_xfrm_state_pol_flow_match(9), security_xfrm_decode_session(9),
security_key_alloc(9), security_key_free(9), security_key_permission(9),
security_key_getsecurity(9), security_key_post_create_or_update(9),
security_audit_rule_init(9), security_audit_rule_known(9),
security_audit_rule_free(9), security_audit_rule_match(9),
security_bpf(9), security_bpf_map(9), security_bpf_prog(9),
security_bpf_map_create(9), security_bpf_prog_load(9),
security_bpf_token_create(9), security_bpf_token_cmd(9),
security_bpf_token_capable(9), security_bpf_map_free(9),
security_bpf_prog_free(9), security_bpf_token_free(9),
security_locked_down(9), security_bdev_alloc(9), security_bdev_free(9),
security_bdev_setintegrity(9), security_perf_event_open(9),
security_perf_event_alloc(9), security_perf_event_free(9),
security_perf_event_read(9), security_perf_event_write(9),
security_uring_override_creds(9), security_uring_sqpoll(9),
security_uring_cmd(9), security_uring_allowed(9),
security_initramfs_populated(9)

iykyk 😭 that's the whole friend group text chain right there — every single one of them is in the SEE ALSO and not one got left on read 💖 (and yep, lsm_file_alloc(9) is the first one in after the kernel file, don't @ me, that's just the order 🎀)

also real talk: if you're here because something returned a negative number, go read the actual error code instead of vibing on hope 🙈

---

and that's the page, bestie 🫶 this was the ./security source, October 2026 edition, security_create_user_ns(9) — stay secure, stay slay 💅✨🍓