[PATCH] selinux: bpf: check SBLABEL_MNT before isec init
Carlos Llamas <[email protected]>
| Newsgroups | org.kernel.vger.linux-fsdevel,org.kernel.vger.bpf,org.kernel.vger.linux-kernel,org.kernel.vger.selinux,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
selinux_inode_init_security() marks the isec as initialized before
checking if mount labeling is supported (SBLABEL_MNT). This was fine
until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"),
where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
xattrs) and yet leave the isec->initialized. This breaks subsequent
calls to inode_doinit_with_dentry().
Do the SBLABEL_MNT check before the inode security is initialized.
Cc: [email protected]
Closes: https://lore.kernel.org/all/[email protected]/
Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs")
Signed-off-by: Carlos Llamas <[email protected]>
---
security/selinux/hooks.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8d6945edae7a..09a12eb8652c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2980,6 +2980,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
if (rc)
return rc;
+ if (!selinux_initialized() ||
+ !(sbsec->flags & SBLABEL_MNT))
+ return -EOPNOTSUPP;
+
/* Possibly defer initialization to selinux_complete_init. */
if (sbsec->flags & SE_SBINITIALIZED) {
struct inode_security_struct *isec = selinux_inode(inode);
@@ -2988,10 +2992,6 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
isec->initialized = LABEL_INITIALIZED;
}
- if (!selinux_initialized() ||
- !(sbsec->flags & SBLABEL_MNT))
- return -EOPNOTSUPP;
-
xattr = lsm_get_xattr_slot(xattrs, xattr_count);
if (xattr) {
rc = security_sid_to_context_force(newsid,
--
2.55.0.508.g3f0d502094-goog