From: "J. Bruce Fields" <[email protected]> This patch has been added to the 3.18 stable tree. If you have any objections, please let us know.
=============== [ Upstream commit 9fc2b4b436cff7d8403034676014f1be9d534942 ] Before calling into the filesystem, vfs_setxattr calls security_inode_setxattr, which ends up calling selinux_inode_setxattr in our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set. SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it only if selinux_is_sblabel_mnt returns true. The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do all flags twiddling in one place", which didn't take into the account the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs with eb9ae686507b "SELinux: Add new labeling type native labels". This caused setxattr's of security labels over NFSv4.2 to fail. Cc: [email protected] # 3.13 Cc: Eric Paris <[email protected]> Cc: David Quigley <[email protected]> Reported-by: Richard Chan <[email protected]> Signed-off-by: J. Bruce Fields <[email protected]> Acked-by: Stephen Smalley <[email protected]> [PM: added the stable dependency] Signed-off-by: Paul Moore <[email protected]> Signed-off-by: Sasha Levin <[email protected]> --- security/selinux/hooks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c603b20..b1e455b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -405,7 +405,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) if (sbsec->behavior == SECURITY_FS_USE_XATTR || sbsec->behavior == SECURITY_FS_USE_TRANS || - sbsec->behavior == SECURITY_FS_USE_TASK) + sbsec->behavior == SECURITY_FS_USE_TASK || + sbsec->behavior == SECURITY_FS_USE_NATIVE) return 1; /* Special handling for sysfs. Is genfs but also has setxattr handler*/ -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
