@@ -282,6 +282,10 @@ static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
break;
}
+ ret = security_fs_context_init(fc, reference);
+ if (ret < 0)
+ goto err_fc;
+
/* TODO: Make all filesystems support this unconditionally */
init_fs_context = fc->fs_type->init_fs_context;
if (!init_fs_context)
@@ -54,6 +54,7 @@ LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, struct file *f
LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm)
LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, struct linux_binprm *bprm)
LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm)
+LSM_HOOK(int, 0, fs_context_init, struct fs_context *fc, struct dentry *reference)
LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc,
struct fs_context *src_sc)
LSM_HOOK(int, -ENOPARAM, fs_context_parse_param, struct fs_context *fc,
@@ -87,8 +87,12 @@
* Security hooks for mount using fs_context.
* [See also Documentation/filesystems/mount_api.rst]
*
+ * @fs_context_init:
+ * Initialises a new security context.
+ * @fc indicates the new filesystem context.
+ * @reference points to a reference dentry for a submount (or is NULL).
* @fs_context_dup:
- * Allocate and attach a security structure to sc->security. This pointer
+ * Allocate and attach a security structure to fc->security. This pointer
* is initialised to NULL by the caller.
* @fc indicates the new filesystem context.
* @src_fc indicates the original filesystem context.
@@ -289,6 +289,7 @@ int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file);
int security_bprm_check(struct linux_binprm *bprm);
void security_bprm_committing_creds(struct linux_binprm *bprm);
void security_bprm_committed_creds(struct linux_binprm *bprm);
+int security_fs_context_init(struct fs_context *fc, struct dentry *reference);
int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);
int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);
int security_sb_alloc(struct super_block *sb);
@@ -618,11 +619,18 @@ static inline void security_bprm_committed_creds(struct linux_binprm *bprm)
{
}
+static inline int security_fs_context_init(struct fs_context *fc,
+ struct dentry *reference)
+{
+ return 0;
+}
+
static inline int security_fs_context_dup(struct fs_context *fc,
struct fs_context *src_fc)
{
return 0;
}
+
static inline int security_fs_context_parse_param(struct fs_context *fc,
struct fs_parameter *param)
{
@@ -879,6 +879,11 @@ void security_bprm_committed_creds(struct linux_binprm *bprm)
call_void_hook(bprm_committed_creds, bprm);
}
+int security_fs_context_init(struct fs_context *fc, struct dentry *reference)
+{
+ return call_int_hook(fs_context_init, 0, fc, reference);
+}
+
int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
{
return call_int_hook(fs_context_dup, 0, fc, src_fc);
@@ -354,7 +354,7 @@ static void inode_free_security(struct inode *inode)
}
struct selinux_mnt_opts {
- const char *fscontext, *context, *rootcontext, *defcontext;
+ char *fscontext, *context, *rootcontext, *defcontext;
};
static void selinux_free_mnt_opts(void *mnt_opts)
@@ -980,7 +980,7 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
return rc;
}
-static int selinux_add_opt(int token, const char *s, void **mnt_opts)
+static int selinux_add_opt(int token, char *s, void **mnt_opts)
{
struct selinux_mnt_opts *opts = *mnt_opts;
@@ -2800,6 +2800,58 @@ static int selinux_umount(struct vfsmount *mnt, int flags)
FILESYSTEM__UNMOUNT, NULL);
}
+static int selinux_fs_context_init(struct fs_context *fc,
+ struct dentry *reference)
+{
+ const struct superblock_security_struct *ref_sbsec;
+ struct inode_security_struct *ref_isec;
+ struct selinux_mnt_opts *opts;
+ u32 len;
+ int ret;
+
+ if (fc->purpose != FS_CONTEXT_FOR_SUBMOUNT)
+ return 0;
+
+ ref_sbsec = selinux_superblock(reference->d_sb);
+ if (!ref_sbsec)
+ return 0;
+
+ opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
+ if (!opts)
+ return -ENOMEM;
+
+ fc->security = opts;
+
+ if (ref_sbsec->flags & FSCONTEXT_MNT) {
+ ret = security_sid_to_context(&selinux_state, ref_sbsec->sid,
+ &opts->fscontext, &len);
+ if (ret < 0)
+ return ret;
+ }
+ if (ref_sbsec->flags & CONTEXT_MNT) {
+ ret = security_sid_to_context(&selinux_state, ref_sbsec->mntpoint_sid,
+ &opts->context, &len);
+ if (ret < 0)
+ return ret;
+ }
+ if (ref_sbsec->flags & DEFCONTEXT_MNT) {
+ ret = security_sid_to_context(&selinux_state, ref_sbsec->def_sid,
+ &opts->defcontext, &len);
+ if (ret < 0)
+ return ret;
+ }
+
+ /* Should we use the mountpoint context or the root inode context? */
+ if (ref_sbsec->flags & ROOTCONTEXT_MNT) {
+ ref_isec = backing_inode_security(reference);
+ ret = security_sid_to_context(&selinux_state, ref_isec->sid,
+ &opts->rootcontext, &len);
+ if (ret < 0)
+ return ret;
+ }
+ return 0;
+}
+
static int selinux_fs_context_dup(struct fs_context *fc,
struct fs_context *src_fc)
{
@@ -7267,6 +7319,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
/*
* PUT "ALLOCATING" HOOKS HERE
*/
+ LSM_HOOK_INIT(fs_context_init, selinux_fs_context_init),
LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
LSM_HOOK_INIT(msg_queue_alloc_security,
selinux_msg_queue_alloc_security),
Provide a security hook through which an LSM can initialise its bit of the fs_context struct set up during mount. This provides a way to fix the problem of an NFS automount not getting to share superblocks because the security label from its parent doesn't propagate to the automount request. Implement this hook for SELinux so that it copies the security labels from the reference dentry (the mountpoint) into the fs_context LSM parameter block. Note that this may also be required for Smack. Without this, fscache may fail to correctly bind the cache to the superblock because it sees multiple superblocks with the same key when it should only see one. I think this behaviour is caused by the patch that added the sb_mnt_opts_compat hook as this checks to see if the parameters match. Fixes: 69c4a42d72eb ("lsm,selinux: add new hook to compare new mount to an existing mount") Signed-off-by: David Howells <dhowells@redhat.com> cc: Olga Kornievskaia <kolga@netapp.com> cc: Anna Schumaker <Anna.Schumaker@Netapp.com> cc: Paul Moore <paul@paul-moore.com> cc: Casey Schaufler <casey@schaufler-ca.com> cc: Alexander Viro <viro@zeniv.linux.org.uk> cc: selinux@vger.kernel.org cc: linux-security-module@vger.kernel.org cc: linux-nfs@vger.kernel.org cc: linux-cachefs@redhat.com --- fs/fs_context.c | 4 +++ include/linux/lsm_hook_defs.h | 1 + include/linux/lsm_hooks.h | 6 ++++ include/linux/security.h | 8 ++++++ security/security.c | 5 ++++ security/selinux/hooks.c | 57 ++++++++++++++++++++++++++++++++++++++++- 6 files changed, 78 insertions(+), 3 deletions(-)