Re: [PATCH v2] selinux: bpf: check SBLABEL_MNT before isec init
| Newsgroups | org.kernel.vger.bpf,org.kernel.vger.selinux |
|---|---|
| Message-ID | <[email protected]> |
> selinux_inode_init_security() marks the isec as initialized before
> checking if mount labeling is supported (SBLABEL_MNT). This was fine
> until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"),
> where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
> xattrs) and yet leave the isec->initialized. This breaks subsequent
> calls to inode_doinit_with_dentry().
>
> Do the SBLABEL_MNT check before the inode security is initialized.
>
> Cc: [email protected]
> Closes: https://lore.kernel.org/all/[email protected]/
> Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs")
> Acked-by: Stephen Smalley <[email protected]>
> Signed-off-by: Carlos Llamas <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1