From patchwork Mon May 17 13:42:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 12262023 X-Patchwork-Delegate: paul@paul-moore.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48E08C433B4 for ; Mon, 17 May 2021 13:42:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2A2D660FD8 for ; Mon, 17 May 2021 13:42:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237458AbhEQNn2 (ORCPT ); Mon, 17 May 2021 09:43:28 -0400 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:31278 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237449AbhEQNn0 (ORCPT ); Mon, 17 May 2021 09:43:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1621258929; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=twfsLPEKFgNum8AA5vaaUbq3d4tpMWc4MmkXXQv+4Yw=; b=LKwwxGmoTzaXybjjLiHDX+1OQFFJOseNrK+3Zdm5or54kYb53gcGxIxPT5FQ4HFe7RpiUr Y53MyhkUbbq8OCGUKZ28J/5ptHJhjnUTK86IUssPHPHzarI0FuA93XjXFDbQLXnBESl4Nw QPvLf0L6nb4kySGxCQ2PwRzBXL3reG8= Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-347-8cnA8PtIPbG7vXaMCIf1AQ-1; Mon, 17 May 2021 09:42:08 -0400 X-MC-Unique: 8cnA8PtIPbG7vXaMCIf1AQ-1 Received: by mail-ed1-f72.google.com with SMTP id r19-20020a05640251d3b02903888eb31cafso3940852edd.13 for ; Mon, 17 May 2021 06:42:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=twfsLPEKFgNum8AA5vaaUbq3d4tpMWc4MmkXXQv+4Yw=; b=DG2XPd0+SeUwl8JZuUuA3omL/8DgY5D4NPEsSH/KiWFpSit4h83P5/Gg+c88fKYcj/ VMisp1UiBK096xtMI6qwCJbzjWlVUTI7GydzSjOZYzFO6mQKP4uJ3t+29UxnIysm7JMq tq/FAz3xhnyMUCOu22BrAkcvi9B9AtXbqK6GXz9JIEgl1zGcaEnTOGaUQabQWXxAFlXL SVndkyIk7EoBLtUJ2G1xb9vQElMhv/lVmV4dM/KSbtjYPCGeQPBUa1+Jfe/DYum+/vtd Sw+nq2EGabHYX98cqhvxdcn+JJ7Zm+ED8qx0BIkk0cbJqkMfqFNw6Hyz3pfBeNcc3Yin yCGg== X-Gm-Message-State: AOAM531JSDpAjgpG7iOqHyRwM7D3Vd81R6C60+hS7ORZESSn2R3GnjM+ 4Za9FfKePCzbm6m1746wZ/RXnZYr/VhvU7IjYBm5UqrxUelwiFTXvIgC7ehQfzb+dQyQWtbFhSM UytjADio5Krm2vupi7g== X-Received: by 2002:a17:906:f42:: with SMTP id h2mr64182377ejj.317.1621258926503; Mon, 17 May 2021 06:42:06 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw/TXNfS7hrsXTejWGwZFUb7ADqFT+NBbJ8RGm5mhZDhJwKqzjaRjEb0LxdQjAcP74Co5oq5g== X-Received: by 2002:a17:906:f42:: with SMTP id h2mr64182351ejj.317.1621258926237; Mon, 17 May 2021 06:42:06 -0700 (PDT) Received: from localhost.localdomain ([2a02:8308:b105:dd00:277b:6436:24db:9466]) by smtp.gmail.com with ESMTPSA id f7sm11302466edd.5.2021.05.17.06.42.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 May 2021 06:42:05 -0700 (PDT) From: Ondrej Mosnacek To: linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-btrfs@vger.kernel.org, Paul Moore , Olga Kornievskaia , Al Viro , David Howells , Stephen Smalley , Richard Haines Subject: [PATCH v2 1/2] vfs,LSM: introduce the FS_HANDLES_LSM_OPTS flag Date: Mon, 17 May 2021 15:42:00 +0200 Message-Id: <20210517134201.29271-2-omosnace@redhat.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210517134201.29271-1-omosnace@redhat.com> References: <20210517134201.29271-1-omosnace@redhat.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Add a new FS_HANDLES_LSM_OPTS filesystem flag to singal to VFS that the filesystem does LSM option setting for the given mount on its own, so the security_sb_set_mnt_opts() call in vfs_get_tree() can be skipped. This allows the following simplifications: 1. Removal of explicit LSM option handling from BTRFS. This exists only because of the double-layer mount that BTRFS is doing for its subvolume support. Setting FS_HANDLES_LSM_OPTS on the inner layer (btrfs_root_fs_type) and unsetting FS_BINARY_MOUNTDATA from both layers allows us to leave the LSM option handling entirely on VFS as part of the outer vfs_get_tree() call. 2. Removal of FS_BINARY_MOUNTDATA flags from BTRFS's fs_types. After applying (1.), we can let VFS eat away LSM opts at the outer mount layer and then do selinux_set_mnt_opts() with these opts, so setting the flag is no longer needed neither for preserving the LSM opts, nor for the SELinux double-set_mnt_opts exception. 3. Removal of the ugly FS_BINARY_MOUNTDATA special case from selinux_set_mnt_opts(). Applying (1.) and also setting FS_HANDLES_LSM_OPTS on NFS fs_types (which needs to unavoidably do the LSM options handling on its own due to the SECURITY_LSM_NATIVE_LABELS flag usage) gets us to the state where there is an exactly one security_sb_set_mnt_opts() or security_sb_clone_mnt_opts() call for each superblock, so the rather hacky FS_BINARY_MOUNTDATA special case can be finally removed from security_sb_set_mnt_opts(). The only other filesystem that sets FS_BINARY_MOUNTDATA is coda, which is also the only one that has binary mount data && doesn't do its own LSM options handling. So for coda we leave FS_HANDLES_LSM_OPTS unset and the behavior remains unchanged - with fsconfig(2) it (probably) won't even mount and with mount(2) it still won't support LSM options (and the security_sb_set_mnt_opts() will be always performed with empty LSM options as before). AFAICT, this shouldn't negatively affect the other LSMs. In fact, I think AppArmor will now gain the ability to do its DFA matching on BTRFS mount options, which was prevented before due to FS_BINARY_MOUNTDATA being set on both its fs_types. Signed-off-by: Ondrej Mosnacek Tested-by: Olga Kornievskaia (both patches). --- fs/btrfs/super.c | 34 +++++----------------------------- fs/nfs/fs_context.c | 6 ++++-- fs/super.c | 10 ++++++---- include/linux/fs.h | 3 ++- security/selinux/hooks.c | 15 --------------- 5 files changed, 17 insertions(+), 51 deletions(-) diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c index 4a396c1147f1..80716ead1cde 100644 --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -1666,19 +1666,12 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, struct btrfs_device *device = NULL; struct btrfs_fs_devices *fs_devices = NULL; struct btrfs_fs_info *fs_info = NULL; - void *new_sec_opts = NULL; fmode_t mode = FMODE_READ; int error = 0; if (!(flags & SB_RDONLY)) mode |= FMODE_WRITE; - if (data) { - error = security_sb_eat_lsm_opts(data, &new_sec_opts); - if (error) - return ERR_PTR(error); - } - /* * Setup a dummy root and fs_info for test/set super. This is because * we don't actually fill this stuff out until open_ctree, but we need @@ -1688,10 +1681,9 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, * superblock with our given fs_devices later on at sget() time. */ fs_info = kvzalloc(sizeof(struct btrfs_fs_info), GFP_KERNEL); - if (!fs_info) { - error = -ENOMEM; - goto error_sec_opts; - } + if (!fs_info) + return ERR_PTR(-ENOMEM); + btrfs_init_fs_info(fs_info); fs_info->super_copy = kzalloc(BTRFS_SUPER_INFO_SIZE, GFP_KERNEL); @@ -1748,9 +1740,6 @@ static struct dentry *btrfs_mount_root(struct file_system_type *fs_type, set_bit(BTRFS_FS_CSUM_IMPL_FAST, &fs_info->flags); error = btrfs_fill_super(s, fs_devices, data); } - if (!error) - error = security_sb_set_mnt_opts(s, new_sec_opts, 0, NULL); - security_free_mnt_opts(&new_sec_opts); if (error) { deactivate_locked_super(s); return ERR_PTR(error); @@ -1762,8 +1751,6 @@ error_close_devices: btrfs_close_devices(fs_devices); error_fs_info: btrfs_free_fs_info(fs_info); -error_sec_opts: - security_free_mnt_opts(&new_sec_opts); return ERR_PTR(error); } @@ -1925,17 +1912,6 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) sync_filesystem(sb); set_bit(BTRFS_FS_STATE_REMOUNTING, &fs_info->fs_state); - if (data) { - void *new_sec_opts = NULL; - - ret = security_sb_eat_lsm_opts(data, &new_sec_opts); - if (!ret) - ret = security_sb_remount(sb, new_sec_opts); - security_free_mnt_opts(&new_sec_opts); - if (ret) - goto restore; - } - ret = btrfs_parse_options(fs_info, data, *flags); if (ret) goto restore; @@ -2385,7 +2361,7 @@ static struct file_system_type btrfs_fs_type = { .name = "btrfs", .mount = btrfs_mount, .kill_sb = btrfs_kill_super, - .fs_flags = FS_REQUIRES_DEV | FS_BINARY_MOUNTDATA, + .fs_flags = FS_REQUIRES_DEV, }; static struct file_system_type btrfs_root_fs_type = { @@ -2393,7 +2369,7 @@ static struct file_system_type btrfs_root_fs_type = { .name = "btrfs", .mount = btrfs_mount_root, .kill_sb = btrfs_kill_super, - .fs_flags = FS_REQUIRES_DEV | FS_BINARY_MOUNTDATA, + .fs_flags = FS_REQUIRES_DEV | FS_HANDLES_LSM_OPTS, }; MODULE_ALIAS_FS("btrfs"); diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c index d95c9a39bc70..b5db4160e89b 100644 --- a/fs/nfs/fs_context.c +++ b/fs/nfs/fs_context.c @@ -1557,7 +1557,8 @@ struct file_system_type nfs_fs_type = { .init_fs_context = nfs_init_fs_context, .parameters = nfs_fs_parameters, .kill_sb = nfs_kill_super, - .fs_flags = FS_RENAME_DOES_D_MOVE|FS_BINARY_MOUNTDATA, + .fs_flags = FS_RENAME_DOES_D_MOVE|FS_BINARY_MOUNTDATA| + FS_HANDLES_LSM_OPTS, }; MODULE_ALIAS_FS("nfs"); EXPORT_SYMBOL_GPL(nfs_fs_type); @@ -1569,7 +1570,8 @@ struct file_system_type nfs4_fs_type = { .init_fs_context = nfs_init_fs_context, .parameters = nfs_fs_parameters, .kill_sb = nfs_kill_super, - .fs_flags = FS_RENAME_DOES_D_MOVE|FS_BINARY_MOUNTDATA, + .fs_flags = FS_RENAME_DOES_D_MOVE|FS_BINARY_MOUNTDATA| + FS_HANDLES_LSM_OPTS, }; MODULE_ALIAS_FS("nfs4"); MODULE_ALIAS("nfs4"); diff --git a/fs/super.c b/fs/super.c index 11b7e7213fd1..918c77b8c161 100644 --- a/fs/super.c +++ b/fs/super.c @@ -1520,10 +1520,12 @@ int vfs_get_tree(struct fs_context *fc) smp_wmb(); sb->s_flags |= SB_BORN; - error = security_sb_set_mnt_opts(sb, fc->security, 0, NULL); - if (unlikely(error)) { - fc_drop_locked(fc); - return error; + if (!(fc->fs_type->fs_flags & FS_HANDLES_LSM_OPTS)) { + error = security_sb_set_mnt_opts(sb, fc->security, 0, NULL); + if (unlikely(error)) { + fc_drop_locked(fc); + return error; + } } /* diff --git a/include/linux/fs.h b/include/linux/fs.h index c3c88fdb9b2a..36f9cd37bc83 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2469,7 +2469,8 @@ struct file_system_type { #define FS_HAS_SUBTYPE 4 #define FS_USERNS_MOUNT 8 /* Can be mounted by userns root */ #define FS_DISALLOW_NOTIFY_PERM 16 /* Disable fanotify permission events */ -#define FS_ALLOW_IDMAP 32 /* FS has been updated to handle vfs idmappings. */ +#define FS_ALLOW_IDMAP 32 /* FS has been updated to handle vfs idmappings. */ +#define FS_HANDLES_LSM_OPTS 64 /* FS handles LSM opts on its own - skip it in VFS */ #define FS_THP_SUPPORT 8192 /* Remove once all fs converted */ #define FS_RENAME_DOES_D_MOVE 32768 /* FS will handle d_move() during rename() internally. */ int (*init_fs_context)(struct fs_context *); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index eaea837d89d1..041529cbf214 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -684,21 +684,6 @@ static int selinux_set_mnt_opts(struct super_block *sb, goto out; } - /* - * Binary mount data FS will come through this function twice. Once - * from an explicit call and once from the generic calls from the vfs. - * Since the generic VFS calls will not contain any security mount data - * we need to skip the double mount verification. - * - * This does open a hole in which we will not notice if the first - * mount using this sb set explict options and a second mount using - * this sb does not set any security options. (The first options - * will be used for both mounts) - */ - if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) - && !opts) - goto out; - root_isec = backing_inode_security_novalidate(root); /* From patchwork Mon May 17 13:42:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 12262025 X-Patchwork-Delegate: paul@paul-moore.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72380C433ED for ; Mon, 17 May 2021 13:42:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5CBA761209 for ; Mon, 17 May 2021 13:42:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237463AbhEQNn3 (ORCPT ); Mon, 17 May 2021 09:43:29 -0400 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:30866 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237455AbhEQNn1 (ORCPT ); Mon, 17 May 2021 09:43:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1621258931; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=H/7ogBL+LNdJ2jZ956/DJsdJPCwqblJZYhGffkhc86o=; b=E93Ut9rxS7hRrpbtZbR9+G5dZcagoCW8JOrbCvbAMYmuz5mRUzJFGjKoJQkBiqiZMkXPl3 ht/uNGqxt2uxs1thJ2EjEpO9YkzlAUYvFM3OeBEvLHWcvif/tsXb90LBt9xKqIevtVjFDU Ay2icUL1nwxiJuGMem9+xaQMNjyiRts= Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-517-C_xdYRSKM96k6adrlapwiw-1; Mon, 17 May 2021 09:42:09 -0400 X-MC-Unique: C_xdYRSKM96k6adrlapwiw-1 Received: by mail-ed1-f72.google.com with SMTP id x3-20020a50ba830000b029038caed0dd2eso3944748ede.7 for ; Mon, 17 May 2021 06:42:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=H/7ogBL+LNdJ2jZ956/DJsdJPCwqblJZYhGffkhc86o=; b=PCDDaQkTkLqrjzJLb84if3/XbhdxzKgggW/vIKg6fzBBnksU7mauUmU/qmnL+eFLt2 rveuYWdGP3E+zoe8W3lfgtwqHeP/+9vYj6kz3oN8G4RB7eSpYFrJNf1qnsniQ6M0G41D ME1ddyLeQ1qZpXvTj9DTVOY0RIfxTHBnzpZYrAPeTt3IpQ/AT+BMLmaKTFUaGHiJMP6r 8qsfNbIKF4ZxfpNT922ndJMHryplYAI+bgHe8+fkTbNhhLz0j3tR+rvCaJjBesWep7yV piTvWrDGUdBn3Ip+nIbbKnjohBvqqWit7qBO8E+OAX6FffDe3PyGpFLEyQ/frIjM3MI6 ZkkQ== X-Gm-Message-State: AOAM533Wo9C00d95IrHDkIb6hZtQuJuDbwZuTjIK8A/pIke9jJ35kV+o 0bo32RqHhBpTDByLqkVgNwt8oC1PcBvWtIxyRv3xilXqdYdD1lZRDSjJdFuTmBG5awUFlNqdP9s YejdUzJKRJ7qcXiMiSQ== X-Received: by 2002:a17:906:d1ce:: with SMTP id bs14mr63552958ejb.183.1621258927779; Mon, 17 May 2021 06:42:07 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzwmY87sB+RI/eYOHiE4Q0GrYf2Jge+7AHgcZqApEDJVyA57Z96Ks3gQhOvtduuLmn2qVC3iQ== X-Received: by 2002:a17:906:d1ce:: with SMTP id bs14mr63552938ejb.183.1621258927634; Mon, 17 May 2021 06:42:07 -0700 (PDT) Received: from localhost.localdomain ([2a02:8308:b105:dd00:277b:6436:24db:9466]) by smtp.gmail.com with ESMTPSA id f7sm11302466edd.5.2021.05.17.06.42.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 May 2021 06:42:06 -0700 (PDT) From: Ondrej Mosnacek To: linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-btrfs@vger.kernel.org, Paul Moore , Olga Kornievskaia , Al Viro , David Howells , Stephen Smalley , Richard Haines Subject: [PATCH v2 2/2] selinux: fix SECURITY_LSM_NATIVE_LABELS flag handling on double mount Date: Mon, 17 May 2021 15:42:01 +0200 Message-Id: <20210517134201.29271-3-omosnace@redhat.com> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210517134201.29271-1-omosnace@redhat.com> References: <20210517134201.29271-1-omosnace@redhat.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org When mounting an NFS export that is a mountpoint on the host, doing the same mount a second time leads to a security_sb_set_mnt_opts() call on an already intialized superblock, which leaves the SECURITY_LSM_NATIVE_LABELS flag unset even if it's provided by the FS. NFS then obediently clears NFS_CAP_SECURITY_LABEL from its server capability set, leading to any newly created inodes for this superblock to end up without labels. To fix this, make sure to return the SECURITY_LSM_NATIVE_LABELS flag when security_sb_set_mnt_opts() is called on an already initialized superblock with matching security options. While there, also do a sanity check to ensure that SECURITY_LSM_NATIVE_LABELS is set in kflags if and only if sbsec->behavior == SECURITY_FS_USE_NATIVE. Minimal reproducer: # systemctl start nfs-server # exportfs -o rw,no_root_squash,security_label localhost:/ # mount -t nfs -o "nfsvers=4.2" localhost:/etc /mnt # mount -t nfs -o "nfsvers=4.2" localhost:/etc /mnt # ls -lZ /mnt [all labels are system_u:object_r:unlabeled_t:s0] Signed-off-by: Ondrej Mosnacek --- security/selinux/hooks.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 041529cbf214..367e7739cb18 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -734,7 +734,24 @@ static int selinux_set_mnt_opts(struct super_block *sb, /* previously mounted with options, but not on this attempt? */ if ((sbsec->flags & SE_MNTMASK) && !opts) goto out_double_mount; + + /* + * If we are checking an already initialized mount and the + * options match, make sure to return back the + * SECURITY_LSM_NATIVE_LABELS flag if applicable. If the + * superblock has the NATIVE behavior set and the FS is not + * signaling its support (or vice versa), then it is a + * programmer error, so emit a WARNING and return -EINVAL. + */ rc = 0; + if (sbsec->behavior == SECURITY_FS_USE_NATIVE) { + if (WARN_ON(!(kern_flags & SECURITY_LSM_NATIVE_LABELS))) + rc = -EINVAL; + else + *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; + } else if (WARN_ON(kern_flags & SECURITY_LSM_NATIVE_LABELS)) { + rc = -EINVAL; + } goto out; }