diff options
| author | Ondrej Mosnacek <omosnace@redhat.com> | 2023-05-29 16:05:27 +0200 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2023-05-30 23:44:34 +0200 |
| commit | cec5fe700799b3f863d25cf883f02e5735598ab5 (patch) | |
| tree | 263e3aed672035884d71957124e62ed1e9abbc9d /security/selinux/include | |
| parent | selinux: cleanup exit_sel_fs() declaration (diff) | |
| download | linux-cec5fe700799b3f863d25cf883f02e5735598ab5.tar.xz linux-cec5fe700799b3f863d25cf883f02e5735598ab5.zip | |
selinux: make labeled NFS work when mounted before policy load
Currently, when an NFS filesystem that supports passing LSM/SELinux
labels is mounted during early boot (before the SELinux policy is
loaded), it ends up mounted without the labeling support (i.e. with
Fedora policy all files get the generic NFS label
system_u:object_r:nfs_t:s0).
This is because the information that the NFS mount supports passing
labels (communicated to the LSM layer via the kern_flags argument of
security_set_mnt_opts()) gets lost and when the policy is loaded the
mount is initialized as if the passing is not supported.
Fix this by noting the "native labeling" in newsbsec->flags (using a new
SE_SBNATIVE flag) on the pre-policy-loaded call of
selinux_set_mnt_opts() and then making sure it is respected on the
second call from delayed_superblock_init().
Additionally, make inode_doinit_with_dentry() initialize the inode's
label from its extended attributes whenever it doesn't find it already
intitialized by the filesystem. This is needed to properly initialize
pre-existing inodes when delayed_superblock_init() is called. It should
not trigger in any other cases (and if it does, it's still better to
initialize the correct label instead of leaving the inode unlabeled).
Fixes: eb9ae686507b ("SELinux: Add new labeling type native labels")
Tested-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
[PM: fixed 'Fixes' tag format]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/include')
| -rw-r--r-- | security/selinux/include/security.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 815838ba7f2a..3b605f39e040 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -65,6 +65,7 @@ #define SE_SBPROC 0x0200 #define SE_SBGENFS 0x0400 #define SE_SBGENFS_XATTR 0x0800 +#define SE_SBNATIVE 0x1000 #define CONTEXT_STR "context" #define FSCONTEXT_STR "fscontext" |