Quoting Richard Guy Briggs (rgb(a)redhat.com):
Most of this looks reasonable, but I'm curious about something,
 +/**
 + * ns_serial - compute a serial number for the namespace
 + *
 + * Compute a serial number for the namespace to uniquely identify it in
 + * audit records.
 + */
 +unsigned int ns_serial(void)
 +{
 +	static DEFINE_SPINLOCK(serial_lock);
 +	static unsigned int serial = 4; /* reserved for IPC, UTS, user, PID */
 +
 +	unsigned long flags;
 +	unsigned int ret;
 +
 +	spin_lock_irqsave(&serial_lock, flags);
 +	do {
 +		ret = ++serial;
 +	} while (unlikely(!ret)); 
Why exactly are you doing this?  Surely if serial is going to
wrap around we've got a bigger problem than just wanting go
bump one more time?
 +	spin_unlock_irqrestore(&serial_lock, flags);
 +
 +	return ret;
 +}