nfs: unify security_inode_listsecurity() calls

commit 243fea134633 ("NFSv4.2: fix listxattr to return selinux
security label") introduced a direct call to
security_inode_listsecurity() in nfs4_listxattr(). However,
nfs4_listxattr() already indirectly called
security_inode_listsecurity() via nfs4_listxattr_nfs4_label() if
CONFIG_NFS_V4_SECURITY_LABEL is enabled and the server has the
NFS_CAP_SECURITY_LABEL capability enabled. This duplication was fixed
by commit 9acb237deff7 ("NFSv4.2: another fix for listxattr") by
making the second call conditional on NFS_CAP_SECURITY_LABEL not being
set by the server. However, the combination of the two changes
effectively makes one call to security_inode_listsecurity() in every
case - which is the desired behavior since getxattr() always returns a
security xattr even if it has to synthesize one. Further, the two
different calls produce different xattr name ordering between
security.* and user.* xattr names. Unify the two separate calls into a
single call and get rid of nfs4_listxattr_nfs4_label() altogether.

Link: https://lore.kernel.org/selinux/CAEjxPJ6e8z__=MP5NfdUxkOMQ=EnUFSjWFofP4YPwHqK=Ki5nw@mail.gmail.com/
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index ec1ce593dea2bfc3b123bcd748d79404ce2d49ad..efc9dadd228199297079b60e4af27429eab88863 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -8141,33 +8141,12 @@ static int nfs4_xattr_get_nfs4_label(const struct xattr_handler *handler,
        return -EOPNOTSUPP;
 }
 
-static ssize_t
-nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len)
-{
-       int len = 0;
-
-       if (nfs_server_capable(inode, NFS_CAP_SECURITY_LABEL)) {
-               len = security_inode_listsecurity(inode, list, list_len);
-               if (len >= 0 && list_len && len > list_len)
-                       return -ERANGE;
-       }
-       return len;
-}
-
 static const struct xattr_handler nfs4_xattr_nfs4_label_handler = {
        .prefix = XATTR_SECURITY_PREFIX,
        .get    = nfs4_xattr_get_nfs4_label,
        .set    = nfs4_xattr_set_nfs4_label,
 };
 
-#else
-
-static ssize_t
-nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len)
-{
-       return 0;
-}
-
 #endif
 
 #ifdef CONFIG_NFS_V4_2
@@ -10964,7 +10943,7 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = {
 
 static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
 {
-       ssize_t error, error2, error3, error4 = 0;
+       ssize_t error, error2, error3;
        size_t left = size;
 
        error = generic_listxattr(dentry, list, left);
@@ -10975,10 +10954,9 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
                left -= error;
        }
 
-       error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left);
+       error2 = security_inode_listsecurity(d_inode(dentry), list, left);
        if (error2 < 0)
                return error2;
-
        if (list) {
                list += error2;
                left -= error2;
@@ -10987,18 +10965,8 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
        error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left);
        if (error3 < 0)
                return error3;
-       if (list) {
-               list += error3;
-               left -= error3;
-       }
-
-       if (!nfs_server_capable(d_inode(dentry), NFS_CAP_SECURITY_LABEL)) {
-               error4 = security_inode_listsecurity(d_inode(dentry), list, left);
-               if (error4 < 0)
-                       return error4;
-       }
 
-       error += error2 + error3 + error4;
+       error += error2 + error3;
        if (size && error > size)
                return -ERANGE;
        return error;