| From 9fc2b4b436cff7d8403034676014f1be9d534942 Mon Sep 17 00:00:00 2001 |
| From: "J. Bruce Fields" <bfields@redhat.com> |
| Date: Thu, 4 Jun 2015 15:57:25 -0400 |
| Subject: selinux: fix setting of security labels on NFS |
| |
| From: "J. Bruce Fields" <bfields@redhat.com> |
| |
| commit 9fc2b4b436cff7d8403034676014f1be9d534942 upstream. |
| |
| Before calling into the filesystem, vfs_setxattr calls |
| security_inode_setxattr, which ends up calling selinux_inode_setxattr in |
| our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set. |
| SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it |
| only if selinux_is_sblabel_mnt returns true. |
| |
| The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do |
| all flags twiddling in one place", which didn't take into the account |
| the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs |
| with eb9ae686507b "SELinux: Add new labeling type native labels". |
| |
| This caused setxattr's of security labels over NFSv4.2 to fail. |
| |
| Cc: Eric Paris <eparis@redhat.com> |
| Cc: David Quigley <dpquigl@davequigley.com> |
| Reported-by: Richard Chan <rc556677@outlook.com> |
| Signed-off-by: J. Bruce Fields <bfields@redhat.com> |
| Acked-by: Stephen Smalley <sds@tycho.nsa.gov> |
| [PM: added the stable dependency] |
| Signed-off-by: Paul Moore <pmoore@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| security/selinux/hooks.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/security/selinux/hooks.c |
| +++ b/security/selinux/hooks.c |
| @@ -403,6 +403,7 @@ static int selinux_is_sblabel_mnt(struct |
| return sbsec->behavior == SECURITY_FS_USE_XATTR || |
| sbsec->behavior == SECURITY_FS_USE_TRANS || |
| sbsec->behavior == SECURITY_FS_USE_TASK || |
| + sbsec->behavior == SECURITY_FS_USE_NATIVE || |
| /* Special handling. Genfs but also in-core setxattr handler */ |
| !strcmp(sb->s_type->name, "sysfs") || |
| !strcmp(sb->s_type->name, "pstore") || |
