selinux: fix setting of security labels on NFS
Subsystems (3)
PATCH 1/1 selinux: fix setting of security labels on NFS
From: "J. Bruce Fields" <[email protected]>
Before calling into the filesystem, vfs_setxattr calls security_inode_setxattr, which ends up calling selinux_inode_setxattr in our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set. SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it only if selinux_is_sblabel_mnt returns true.
The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do all flags twiddling in one place", which didn't take into the account the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs with eb9ae686507b "SELinux: Add new labeling type native labels".
This caused setxattr's of security labels over NFSv4.2 to fail.
--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)
security/selinux/hooks.c +1 -0
@@ -403,6 +403,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)return sbsec->behavior ==SECURITY_FS_USE_XATTR || sbsec->behavior ==SECURITY_FS_USE_TRANS || sbsec->behavior ==SECURITY_FS_USE_TASK || + sbsec->behavior ==SECURITY_FS_USE_NATIVE ||/* Special handling. Genfs but also in-core setxattr handler */ !strcmp (sb->s_type->name,"sysfs" ) || !strcmp(sb->s_type->name, "pstore") ||
Signature · 1 line
1.9.3
Quoted 13 lines · J. Bruce Fields
From: "J. Bruce Fields" <[email protected]>
Before calling into the filesystem,
vfs_setxattrcallssecurity_inode_setxattr, which ends up callingselinux_inode_setxattrin our case. That returns-EOPNOTSUPPwheneverSBLABEL_MNTis not set.SBLABEL_MNTwas supposed to be set bysb_finish_set_opts, which sets it only ifselinux_is_sblabel_mntreturns true.The
selinux_is_sblabel_mntlogic was broken byeadcabc697e9"SELinux: do all flags twiddling in one place", which didn't take into the account theSECURITY_FS_USE_NATIVEbehavior that had been introduced for nfs witheb9ae686507b"SELinux: Add new labeling type native labels".
Quoted 7 lines
This caused setxattr's of security labels over NFSv4.2 to fail.
Cc Eric Paris <[email protected]>Cc David Quigley <[email protected]>Reported-by Richard Chan <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>
Quoted 17 lines
--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)security/selinux/hooks.c +1
-0@@ -403,6 +403,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)return sbsec->behavior ==SECURITY_FS_USE_XATTR || sbsec->behavior ==SECURITY_FS_USE_TRANS || sbsec->behavior ==SECURITY_FS_USE_TASK || + sbsec->behavior ==SECURITY_FS_USE_NATIVE ||/* Special handling. Genfs but also in-core setxattr handler */ !strcmp (sb->s_type->name,"sysfs" ) || !strcmp(sb->s_type->name, "pstore") ||
Quoted 15 lines · J. Bruce Fields
From: "J. Bruce Fields" <[email protected]>
Before calling into the filesystem,
vfs_setxattrcallssecurity_inode_setxattr, which ends up callingselinux_inode_setxattrin our case. That returns-EOPNOTSUPPwheneverSBLABEL_MNTis not set.SBLABEL_MNTwas supposed to be set bysb_finish_set_opts, which sets it only ifselinux_is_sblabel_mntreturns true.The
selinux_is_sblabel_mntlogic was broken byeadcabc697e9"SELinux: do all flags twiddling in one place", which didn't take into the account theSECURITY_FS_USE_NATIVEbehavior that had been introduced for nfs witheb9ae686507b"SELinux: Add new labeling type native labels".This caused setxattr's of security labels over NFSv4.2 to fail.
Quoted 8 lines
Cc Eric Paris <[email protected]>Cc David Quigley <[email protected]>Reported-by Richard Chan <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)
Applied, thanks. In the future, you don't have to worry about marking it for stable, I'll take care of that when I merge it into the tree.
Quoted 12 lines
security/selinux/hooks.c +1
-0@@ -403,6 +403,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) return sbsec->behavior == SECURITY_FS_USE_XATTR || sbsec->behavior ==SECURITY_FS_USE_TRANS || sbsec->behavior ==SECURITY_FS_USE_TASK || + sbsec->behavior ==SECURITY_FS_USE_NATIVE ||/* Special handling. Genfs but also in-core setxattr handler */ !strcmp (sb->s_type->name,"sysfs" ) || !strcmp(sb->s_type->name, "pstore") ||
Signature · 2 lines
paul moore www.paul-moore.com
Quoted 25 lines · Paul Moore
Quoted 15 lines · J. Bruce Fields
From: "J. Bruce Fields" <[email protected]>
Before calling into the filesystem,
vfs_setxattrcallssecurity_inode_setxattr, which ends up callingselinux_inode_setxattrin our case. That returns-EOPNOTSUPPwheneverSBLABEL_MNTis not set.SBLABEL_MNTwas supposed to be set bysb_finish_set_opts, which sets it only ifselinux_is_sblabel_mntreturns true.The
selinux_is_sblabel_mntlogic was broken byeadcabc697e9"SELinux: do all flags twiddling in one place", which didn't take into the account theSECURITY_FS_USE_NATIVEbehavior that had been introduced for nfs witheb9ae686507b"SELinux: Add new labeling type native labels".This caused setxattr's of security labels over NFSv4.2 to fail.
Quoted 8 lines
Cc Eric Paris <[email protected]>Cc David Quigley <[email protected]>Reported-by Richard Chan <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)
Quoted 1 line
Applied, thanks.
Thanks!
Quoted 2 lines
In the future, you don't have to worry about marking it for stable, I'll take care of that when I merge it into the tree.
OK. With roles reversed, I usually appreciate the stable tag from submitters, just as a statement of their opinion as to whether it's stable-worthy, which can always be overridden.
(I mean, this one seems obvious enough--one-liner, fixes a user-visible regression--but in more complicated cases their opinion might be useful.)
By the way, I suspect this requires (obvious) fixups to apply to some older kernels, let me know if help's needed there.
--b.
Quoted 17 lines
Quoted 13 lines
security/selinux/hooks.c +1
-0@@ -403,6 +403,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) return sbsec->behavior == SECURITY_FS_USE_XATTR || sbsec->behavior ==SECURITY_FS_USE_TRANS || sbsec->behavior ==SECURITY_FS_USE_TASK || + sbsec->behavior ==SECURITY_FS_USE_NATIVE ||/* Special handling. Genfs but also in-core setxattr handler */ !strcmp (sb->s_type->name,"sysfs" ) || !strcmp(sb->s_type->name, "pstore") ||Signature · 2 lines
paul moore www.paul-moore.com
Paul Moore
maintainerQuoted 28 lines · J. Bruce Fields
Quoted 25 lines · Paul Moore
Quoted 15 lines · J. Bruce Fields
From: "J. Bruce Fields" <[email protected]>
Before calling into the filesystem,
vfs_setxattrcallssecurity_inode_setxattr, which ends up callingselinux_inode_setxattrin our case. That returns-EOPNOTSUPPwheneverSBLABEL_MNTis not set.SBLABEL_MNTwas supposed to be set bysb_finish_set_opts, which sets it only ifselinux_is_sblabel_mntreturns true.The
selinux_is_sblabel_mntlogic was broken byeadcabc697e9"SELinux: do all flags twiddling in one place", which didn't take into the account theSECURITY_FS_USE_NATIVEbehavior that had been introduced for nfs witheb9ae686507b"SELinux: Add new labeling type native labels".This caused setxattr's of security labels over NFSv4.2 to fail.
Quoted 8 lines
Cc Eric Paris <[email protected]>Cc David Quigley <[email protected]>Reported-by Richard Chan <[email protected]>Signed-off-by J. Bruce Fields <[email protected]>--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)Quoted 1 line
Applied, thanks.
Quoted 8 lines
Thanks!
Quoted 2 lines
In the future, you don't have to worry about marking it for stable, I'll take care of that when I merge it into the tree.
OK. With roles reversed, I usually appreciate the stable tag from submitters, just as a statement of their opinion as to whether it's stable-worthy, which can always be overridden.
Every subsystem is different, but in general I haven't found it too difficult to determine if a given patch is stable worthy; on the rare occasion that I'm uncertain I'll ask the submitter for their opinion. I wouldn't say I discourage people from adding a stable tag, it is just that I don't require people to add one to make it into my stable queue, and I don't automatically add it to the queue if the poster does tag it so (although that said, I don't recall ever removing a stable CC).
Quoted 3 lines
(I mean, this one seems obvious enough--one-liner, fixes a user-visible regression--but in more complicated cases their opinion might be useful.)
This patch is definitely a stable no-brainer.
Quoted 2 lines
By the way, I suspect this requires (obvious) fixups to apply to some older kernels, let me know if help's needed there.
It may, I generally wait until the stable devs pick it up and if they hit a merge conflict I fix it up, however, since you offered I may kick it your way ;)
Signature · 2 lines
paul moore www.paul-moore.com