From 4f099d09400a190abc12ad3d8fd4e94ebeed57ca Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Wed, 3 Dec 2025 14:57:28 -0500 Subject: [PATCH] nfs: unify security_inode_listsecurity() calls commit 243fea134633 ("NFSv4.2: fix listxattr to return selinux security label") introduced a direct call to security_inode_listsecurity() in nfs4_listxattr(). However, nfs4_listxattr() already indirectly called security_inode_listsecurity() via nfs4_listxattr_nfs4_label() if CONFIG_NFS_V4_SECURITY_LABEL is enabled and the server has the NFS_CAP_SECURITY_LABEL capability enabled. This duplication was fixed by commit 9acb237deff7 ("NFSv4.2: another fix for listxattr") by making the second call conditional on NFS_CAP_SECURITY_LABEL not being set by the server. However, the combination of the two changes effectively makes one call to security_inode_listsecurity() in every case - which is the desired behavior since getxattr() always returns a security xattr even if it has to synthesize one. Further, the two different calls produce different xattr name ordering between security.* and user.* xattr names. Unify the two separate calls into a single call and get rid of nfs4_listxattr_nfs4_label() altogether. Link: https://lore.kernel.org/selinux/CAEjxPJ6e8z__=MP5NfdUxkOMQ=EnUFSjWFofP4YPwHqK=Ki5nw@mail.gmail.com/ Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore --- fs/nfs/nfs4proc.c | 38 +++----------------------------------- 1 file changed, 3 insertions(+), 35 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index ec1ce593dea2b..efc9dadd22819 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -8141,33 +8141,12 @@ static int nfs4_xattr_get_nfs4_label(const struct xattr_handler *handler, return -EOPNOTSUPP; } -static ssize_t -nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len) -{ - int len = 0; - - if (nfs_server_capable(inode, NFS_CAP_SECURITY_LABEL)) { - len = security_inode_listsecurity(inode, list, list_len); - if (len >= 0 && list_len && len > list_len) - return -ERANGE; - } - return len; -} - static const struct xattr_handler nfs4_xattr_nfs4_label_handler = { .prefix = XATTR_SECURITY_PREFIX, .get = nfs4_xattr_get_nfs4_label, .set = nfs4_xattr_set_nfs4_label, }; -#else - -static ssize_t -nfs4_listxattr_nfs4_label(struct inode *inode, char *list, size_t list_len) -{ - return 0; -} - #endif #ifdef CONFIG_NFS_V4_2 @@ -10964,7 +10943,7 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = { static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) { - ssize_t error, error2, error3, error4 = 0; + ssize_t error, error2, error3; size_t left = size; error = generic_listxattr(dentry, list, left); @@ -10975,10 +10954,9 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) left -= error; } - error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left); + error2 = security_inode_listsecurity(d_inode(dentry), list, left); if (error2 < 0) return error2; - if (list) { list += error2; left -= error2; @@ -10987,18 +10965,8 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left); if (error3 < 0) return error3; - if (list) { - list += error3; - left -= error3; - } - - if (!nfs_server_capable(d_inode(dentry), NFS_CAP_SECURITY_LABEL)) { - error4 = security_inode_listsecurity(d_inode(dentry), list, left); - if (error4 < 0) - return error4; - } - error += error2 + error3 + error4; + error += error2 + error3; if (size && error > size) return -ERANGE; return error; -- 2.47.3