diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-09-15 12:38:44 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-09-15 12:38:44 -0700 |
| commit | 02e768c9fe47618056d876b5137424763486d886 (patch) | |
| tree | 1c69206f0386b675a4fcc056b64a9e3b7f61fb8c | |
| parent | 82210979f3dd210d019ebec2a59af0ae8be596b7 (diff) | |
| parent | ccf1dab96be4caed7c5235b1cfdb606ac161b996 (diff) | |
| download | lwn-02e768c9fe47618056d876b5137424763486d886.tar.gz lwn-02e768c9fe47618056d876b5137424763486d886.zip | |
Merge tag 'selinux-pr-20230914' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux fix from Paul Moore:
"A relatively small SELinux patch to fix an issue with a
vfs/LSM/SELinux patch that went upstream during the recent merge
window.
The short version is that the original patch changed how we
initialized mount options to resolve a NFS issue and we inadvertently
broke a use case due to the changed behavior.
The fix restores this behavior for the cases that require it while
keeping the original NFS fix in place"
* tag 'selinux-pr-20230914' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: fix handling of empty opts in selinux_fs_context_submount()
| -rw-r--r-- | security/selinux/hooks.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 10350534de6d..2aa0e219d721 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2775,14 +2775,20 @@ static int selinux_umount(struct vfsmount *mnt, int flags) static int selinux_fs_context_submount(struct fs_context *fc, struct super_block *reference) { - const struct superblock_security_struct *sbsec; + const struct superblock_security_struct *sbsec = selinux_superblock(reference); struct selinux_mnt_opts *opts; + /* + * Ensure that fc->security remains NULL when no options are set + * as expected by selinux_set_mnt_opts(). + */ + if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT))) + return 0; + opts = kzalloc(sizeof(*opts), GFP_KERNEL); if (!opts) return -ENOMEM; - sbsec = selinux_superblock(reference); if (sbsec->flags & FSCONTEXT_MNT) opts->fscontext_sid = sbsec->sid; if (sbsec->flags & CONTEXT_MNT) |