Re: [PATCH v2] selinux: bpf: check SBLABEL_MNT before isec init

On Jul 30, 2026 Carlos Llamas <[email protected]> wrote:
> 
> selinux_inode_init_security() marks the isec as initialized before
> checking if mount labeling is supported (SBLABEL_MNT). This was fine
> until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"),
> where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
> xattrs) and yet leave the isec->initialized. This breaks subsequent
> calls to inode_doinit_with_dentry().
> 
> Do the SBLABEL_MNT check before the inode security is initialized.
> 
> Cc: [email protected]
> Closes: https://lore.kernel.org/all/[email protected]/
> Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs")
> Acked-by: Stephen Smalley <[email protected]>
> Signed-off-by: Carlos Llamas <[email protected]>
> ---
> v2:
>   - Move the check further at the top per Paul's feedback.
>   - Collect Stephen's Ack.
> 
> v1:
>   https://lore.kernel.org/all/[email protected]/
> 
>  security/selinux/hooks.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)

Merged into selinux/stable-7.2, thanks!

--
paul-moore.com