selinux: bpf: check SBLABEL_MNT before isec init

selinux_inode_init_security() marks the isec as initialized before
checking if mount labeling is supported (SBLABEL_MNT). This was fine
until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"),
where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
xattrs) and yet leave the isec->initialized. This breaks subsequent
calls to inode_doinit_with_dentry().

Do the SBLABEL_MNT check before the inode security is initialized.

Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@google.com/
Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs")
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8d6945edae7aacf34fd48a1876469305160c1a93..18dd28b2bb13d2f885404bf81767255462f7546e 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2974,6 +2974,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
 
        sbsec = selinux_superblock(dir->i_sb);
 
+       if (!selinux_initialized() ||
+           !(sbsec->flags & SBLABEL_MNT))
+               return -EOPNOTSUPP;
+
        newsid = crsec->create_sid;
        newsclass = inode_mode_to_security_class(inode->i_mode);
        rc = selinux_determine_inode_label(crsec, dir, qstr, newsclass, &newsid);
@@ -2988,10 +2992,6 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
                isec->initialized = LABEL_INITIALIZED;
        }
 
-       if (!selinux_initialized() ||
-           !(sbsec->flags & SBLABEL_MNT))
-               return -EOPNOTSUPP;
-
        xattr = lsm_get_xattr_slot(xattrs, xattr_count);
        if (xattr) {
                rc = security_sid_to_context_force(newsid,