]>
Commit | Line | Data |
---|---|---|
56c71b2c GKH |
1 | From 9fc2b4b436cff7d8403034676014f1be9d534942 Mon Sep 17 00:00:00 2001 |
2 | From: "J. Bruce Fields" <bfields@redhat.com> | |
3 | Date: Thu, 4 Jun 2015 15:57:25 -0400 | |
4 | Subject: selinux: fix setting of security labels on NFS | |
5 | ||
6 | From: "J. Bruce Fields" <bfields@redhat.com> | |
7 | ||
8 | commit 9fc2b4b436cff7d8403034676014f1be9d534942 upstream. | |
9 | ||
10 | Before calling into the filesystem, vfs_setxattr calls | |
11 | security_inode_setxattr, which ends up calling selinux_inode_setxattr in | |
12 | our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set. | |
13 | SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it | |
14 | only if selinux_is_sblabel_mnt returns true. | |
15 | ||
16 | The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do | |
17 | all flags twiddling in one place", which didn't take into the account | |
18 | the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs | |
19 | with eb9ae686507b "SELinux: Add new labeling type native labels". | |
20 | ||
21 | This caused setxattr's of security labels over NFSv4.2 to fail. | |
22 | ||
23 | Cc: Eric Paris <eparis@redhat.com> | |
24 | Cc: David Quigley <dpquigl@davequigley.com> | |
25 | Reported-by: Richard Chan <rc556677@outlook.com> | |
26 | Signed-off-by: J. Bruce Fields <bfields@redhat.com> | |
27 | Acked-by: Stephen Smalley <sds@tycho.nsa.gov> | |
28 | [PM: added the stable dependency] | |
29 | Signed-off-by: Paul Moore <pmoore@redhat.com> | |
30 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
31 | ||
32 | --- | |
33 | security/selinux/hooks.c | 1 + | |
34 | 1 file changed, 1 insertion(+) | |
35 | ||
36 | --- a/security/selinux/hooks.c | |
37 | +++ b/security/selinux/hooks.c | |
38 | @@ -404,6 +404,7 @@ static int selinux_is_sblabel_mnt(struct | |
39 | return sbsec->behavior == SECURITY_FS_USE_XATTR || | |
40 | sbsec->behavior == SECURITY_FS_USE_TRANS || | |
41 | sbsec->behavior == SECURITY_FS_USE_TASK || | |
42 | + sbsec->behavior == SECURITY_FS_USE_NATIVE || | |
43 | /* Special handling. Genfs but also in-core setxattr handler */ | |
44 | !strcmp(sb->s_type->name, "sysfs") || | |
45 | !strcmp(sb->s_type->name, "pstore") || |