From patchwork Thu Jul 16 01:00:30 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 496128 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 8197C1401E7; Thu, 16 Jul 2015 11:05:45 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1ZFXcL-0005BW-Bt; Thu, 16 Jul 2015 01:05:41 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1ZFXXN-0002K1-Tt for kernel-team@lists.ubuntu.com; Thu, 16 Jul 2015 01:00:33 +0000 Received: from 1.general.kamal.us.vpn ([10.172.68.52] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1ZFXXM-0005zN-Uq; Thu, 16 Jul 2015 01:00:33 +0000 Received: from kamal by fourier with local (Exim 4.82) (envelope-from ) id 1ZFXXK-0000DH-Nz; Wed, 15 Jul 2015 18:00:30 -0700 From: Kamal Mostafa To: "J. Bruce Fields" Subject: [3.19.y-ckt stable] Patch "selinux: fix setting of security labels on NFS" has been added to staging queue Date: Wed, 15 Jul 2015 18:00:30 -0700 Message-Id: <1437008430-789-1-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 X-Extended-Stable: 3.19 Cc: David Quigley , Eric Paris , Paul Moore , Richard Chan , kernel-team@lists.ubuntu.com, Stephen Smalley , Kamal Mostafa X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled selinux: fix setting of security labels on NFS to the linux-3.19.y-queue branch of the 3.19.y-ckt extended stable tree which can be found at: http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.19.y-queue This patch is scheduled to be released in version 3.19.y-ckt4. If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.19.y-ckt tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Kamal ------ From fece7b76c41a7558a596587185c408361e075487 Mon Sep 17 00:00:00 2001 From: "J. Bruce Fields" Date: Thu, 4 Jun 2015 15:57:25 -0400 Subject: selinux: fix setting of security labels on NFS commit 9fc2b4b436cff7d8403034676014f1be9d534942 upstream. Before calling into the filesystem, vfs_setxattr calls security_inode_setxattr, which ends up calling selinux_inode_setxattr in our case. That returns -EOPNOTSUPP whenever SBLABEL_MNT is not set. SBLABEL_MNT was supposed to be set by sb_finish_set_opts, which sets it only if selinux_is_sblabel_mnt returns true. The selinux_is_sblabel_mnt logic was broken by eadcabc697e9 "SELinux: do all flags twiddling in one place", which didn't take into the account the SECURITY_FS_USE_NATIVE behavior that had been introduced for nfs with eb9ae686507b "SELinux: Add new labeling type native labels". This caused setxattr's of security labels over NFSv4.2 to fail. Cc: Eric Paris Cc: David Quigley Reported-by: Richard Chan Signed-off-by: J. Bruce Fields Acked-by: Stephen Smalley [PM: added the stable dependency] Signed-off-by: Paul Moore [ kamal: backport to 3.19-stable: context ] Signed-off-by: Kamal Mostafa --- security/selinux/hooks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 1.9.1 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 6da7532..7634300 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -403,7 +403,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) if (sbsec->behavior == SECURITY_FS_USE_XATTR || sbsec->behavior == SECURITY_FS_USE_TRANS || - sbsec->behavior == SECURITY_FS_USE_TASK) + sbsec->behavior == SECURITY_FS_USE_TASK || + sbsec->behavior == SECURITY_FS_USE_NATIVE) return 1; /* Special handling for sysfs. Is genfs but also has setxattr handler*/