kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/security/selinux
History
Stephen Smalley 28b7260548 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts 
When an NFSv4 filesystem exported with security_label is mounted a
second time, sget_fc() returns the existing superblock and
nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
early exit without setting SECURITY_LSM_NATIVE_LABELS in
*set_kern_flags. nfs_get_root() then sees kflags without
SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
the shared nfs_server, silently disabling per-file labeling for both
the new and the original mount.

Commit 3815a245b5 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
on reused superblock") fixed the same problem in
selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
second mount now goes through sb_set_mnt_opts rather than
sb_clone_mnt_opts, so it needs the same treatment: on both
SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
*set_kern_flags when the superblock was already using
SECURITY_FS_USE_NATVE.

Cc: stable@vger.kernel.org
Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
Closes: https://github.com/SELinuxProject/selinux-kernel/issues/70
Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/91
Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92
Fixes: eb9ae68650 ("SELinux: Add new labeling type native labels")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
History 2026-09-30 15:10:41 -04:00
..
include selinux: recheck intermediate backing files on mprotect() 2026-09-15 23:30:07 -04:00
ss selinux/stable-7.3 PR 20260814 2026-08-19 16:24:46 -07:00
.gitignore selinux: move genheaders to security/selinux/ 2024-10-03 16:07:51 -04:00
avc.c selinux: fix data race on AVC latest_notif 2026-09-25 15:00:01 -04:00
genheaders.c selinux: move genheaders to security/selinux/ 2024-10-03 16:07:51 -04:00
hooks.c selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts 2026-09-30 15:10:41 -04:00
ibpkey.c selinux: comment spelling fix in ibpkey.c 2026-05-27 20:10:48 -04:00
ima.c selinux: compute the IMA configuration settings string length once at boot 2026-07-15 21:42:01 -04:00
initcalls.c selinux: move initcalls to the LSM framework 2025-10-22 19:24:28 -04:00
Kconfig selinux: Introduce a new config to make avc cache slot size adjustable 2025-10-23 18:24:30 -04:00
Makefile selinux: move initcalls to the LSM framework 2025-10-22 19:24:28 -04:00
netif.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
netlabel.c lsm/stable-6.12 PR 20240911 2024-09-16 18:19:47 +02:00
netlink.c selinux: move initcalls to the LSM framework 2025-10-22 19:24:28 -04:00
netnode.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
netport.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
nlmsgtab.c xfrm: add XFRM_MSG_MIGRATE_STATE for single SA migration 2026-06-04 12:22:47 +02:00
selinuxfs.c selinux: clean up selinuxfs resources on init failure 2026-07-01 17:17:41 -04:00
status.c selinux: avoid implicit conversions regarding enforcing status 2023-07-18 18:29:50 -04:00
xfrm.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00