imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-28 12:53:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

Browse Source 
When an NFSv4 filesystem exported with security_label is mounted a
second time, sget_fc() returns the existing superblock and
nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
early exit without setting SECURITY_LSM_NATIVE_LABELS in
*set_kern_flags. nfs_get_root() then sees kflags without
SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
the shared nfs_server, silently disabling per-file labeling for both
the new and the original mount.

Commit 3815a245b5 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
on reused superblock") fixed the same problem in
selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
second mount now goes through sb_set_mnt_opts rather than
sb_clone_mnt_opts, so it needs the same treatment: on both
SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
*set_kern_flags when the superblock was already using
SECURITY_FS_USE_NATVE.

Cc: [email protected]
Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
Closes: https://github.com/SELinuxProject/selinux-kernel/issues/70
Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/91
Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92
Fixes: eb9ae68650 ("SELinux: Add new labeling type native labels")
Signed-off-by: Stephen Smalley <[email protected]>
Signed-off-by: Paul Moore <[email protected]>
This commit is contained in:
Stephen Smalley authored and Paul Moore committed 2026-09-30 15:10:41 -04:00
1 parent 1ca924044b
commit 28b7260548
1 file changed
+8 -1
Download Patch File Download Diff File Expand all files Collapse all files
security/selinux/hooks.c
+8 -1
View File
@@ -690,8 +690,12 @@ static int selinux_set_mnt_opts(struct super_block *sb,
* will be used for both mounts)
*/
if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
&& !opts)
&& !opts) {
if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) &&
sbsec->behavior == SECURITY_FS_USE_NATIVE)
*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
goto out;
}
root_isec = backing_inode_security_novalidate(root);
@@ -735,6 +739,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
/* previously mounted with options, but not on this attempt? */
if ((sbsec->flags & SE_MNTMASK) && !opts)
goto out_double_mount;
if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) &&
sbsec->behavior == SECURITY_FS_USE_NATIVE)
*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
rc = 0;
goto out;
}