Re: [PATCH v2] selinux: bpf: check SBLABEL_MNT before isec init
Paul Moore <[email protected]>
| Newsgroups | org.kernel.vger.bpf,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel,org.kernel.vger.selinux,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Jul 30, 2026 Carlos Llamas <[email protected]> wrote: > > selinux_inode_init_security() marks the isec as initialized before > checking if mount labeling is supported (SBLABEL_MNT). This was fine > until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"), > where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no > xattrs) and yet leave the isec->initialized. This breaks subsequent > calls to inode_doinit_with_dentry(). > > Do the SBLABEL_MNT check before the inode security is initialized. > > Cc: [email protected] > Closes: https://lore.kernel.org/all/[email protected]/ > Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs") > Acked-by: Stephen Smalley <[email protected]> > Signed-off-by: Carlos Llamas <[email protected]> > --- > v2: > - Move the check further at the top per Paul's feedback. > - Collect Stephen's Ack. > > v1: > https://lore.kernel.org/all/[email protected]/ > > security/selinux/hooks.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) Merged into selinux/stable-7.2, thanks! -- paul-moore.com