Re: [PATCH] selinux: bpf: check SBLABEL_MNT before isec init
Stephen Smalley <[email protected]>
| Newsgroups | org.kernel.vger.linux-fsdevel,org.kernel.vger.bpf,org.kernel.vger.linux-kernel,org.kernel.vger.selinux,org.kernel.vger.stable |
|---|---|
| Message-ID | <CAEjxPJ47CTKXxx_DvSbuO5F28T-eNPnQQ+Gm_-qaAeb6R3wPfQ@mail.gmail.com> |
On Thu, Jul 30, 2026 at 2:10 PM Carlos Llamas <[email protected]> wrote: > > selinux_inode_init_security() marks the isec as initialized before > checking if mount labeling is supported (SBLABEL_MNT). This was fine > until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"), > where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no > xattrs) and yet leave the isec->initialized. This breaks subsequent > calls to inode_doinit_with_dentry(). > > Do the SBLABEL_MNT check before the inode security is initialized. > > Cc: [email protected] > Closes: https://lore.kernel.org/all/[email protected]/ > Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs") > Signed-off-by: Carlos Llamas <[email protected]> Acked-by: Stephen Smalley <[email protected]>