Patch "selinux: fix setting of security labels on NFS" has been added to the 4.0-stable tree

This is a note to let you know that I've just added the patch titled

selinux: fix setting of security labels on NFS

to the 4.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
selinux-fix-setting-of-security-labels-on-nfs.patch
and it can be found in the queue-4.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "J. Bruce Fields" <[email protected]>
Date: Thu, 4 Jun 2015 15:57:25 -0400
Subject: selinux: fix setting of security labels on NFS

From: "J. Bruce Fields" <[email protected]>

commit 9fc2b4b436cff7d8403034676014f1be9d534942 upstream.

Before calling into the filesystem, vfs_setxattr calls security_inode_setxattr, which ends up calling selinux_inode_setxattr in our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set. SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it only if selinux_is_sblabel_mnt returns true.

The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do all flags twiddling in one place", which didn't take into the account the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs with eb9ae686507b "SELinux: Add new labeling type native labels".

This caused setxattr's of security labels over NFSv4.2 to fail.

---
 security/selinux/hooks.c |    1 +
 1 file changed, 1 insertion(+)

@@ -404,6 +404,7 @@ static int selinux_is_sblabel_mnt(struct
 	return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 		sbsec->behavior == SECURITY_FS_USE_TRANS ||
 		sbsec->behavior == SECURITY_FS_USE_TASK ||
+		sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 		/* Special handling. Genfs but also in-core setxattr handler */
 		!strcmp(sb->s_type->name, "sysfs") ||
 		!strcmp(sb->s_type->name, "pstore") ||

Patches currently in stable-queue which might be from [email protected] are

queue-4.0/selinux-fix-setting-of-security-labels-on-nfs.patch