Re: [PATCH] security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock

[Paul Moore <paul@paul-moore.com>]

On Tue, Mar 5, 2019 at 4:18 PM J. Bruce Fields <bfields@fieldses.org> wrote:
> From: "J. Bruce Fields" <bfields@redhat.com>
>
> In the case when we're reusing a superblock, selinux_sb_clone_mnt_opts()
> fails to set set_kern_flags, with the result that
> nfs_clone_sb_security() incorrectly clears NFS_CAP_SECURITY_LABEL.
>
> The result is that if you mount the same NFS filesystem twice, NFS
> security labels are turned off, even if they would work fine if you
> mounted the filesystem only once.
>
> ("fixes" may be not exactly the right tag, it may be more like
> "fixed-other-cases-but-missed-this-one".)
>
> Cc: Scott Mayhew <smayhew@redhat.com>
> Cc: stable@vger.kernel.org
> Fixes: 0b4d3452b8b4 "security/selinux: allow security_sb_clone_mnt_opts..."
> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
> ---
>  security/selinux/hooks.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Thanks for the fix.  I just merged this into selinux/stable-5.1 and
I'll send this up to Linus tomorrow.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index f0e36c3492ba..5e9304567233 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -959,8 +959,11 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
>         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
>
>         /* if fs is reusing a sb, make sure that the contexts match */
> -       if (newsbsec->flags & SE_SBINITIALIZED)
> +       if (newsbsec->flags & SE_SBINITIALIZED) {
> +               if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
> +                       *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
>                 return selinux_cmp_sb_context(oldsb, newsb);
> +       }
>
>         mutex_lock(&newsbsec->lock);
>
> --
> 2.20.1

-- 
paul moore
www.paul-moore.com