security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock

In the case when we're reusing a superblock, selinux_sb_clone_mnt_opts()
fails to set set_kern_flags, with the result that
nfs_clone_sb_security() incorrectly clears NFS_CAP_SECURITY_LABEL.

The result is that if you mount the same NFS filesystem twice, NFS
security labels are turned off, even if they would work fine if you
mounted the filesystem only once.

("fixes" may be not exactly the right tag, it may be more like
"fixed-other-cases-but-missed-this-one".)

Cc: Scott Mayhew <[email protected]>
Cc: [email protected]
Fixes: 0b4d3452b8b4 "security/selinux: allow security_sb_clone_mnt_opts..."
Signed-off-by: J. Bruce Fields <[email protected]>
Acked-by: Stephen Smalley <[email protected]>
Signed-off-by: Paul Moore <[email protected]>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3745922c713298d1f786eb65bd69e7955714a979..0fe5ed8c33a0ade2df5e1adb25b2b7bafa792bd0 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -981,8 +981,11 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
        BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 
        /* if fs is reusing a sb, make sure that the contexts match */
-       if (newsbsec->flags & SE_SBINITIALIZED)
+       if (newsbsec->flags & SE_SBINITIALIZED) {
+               if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
+                       *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
                return selinux_cmp_sb_context(oldsb, newsb);
+       }
 
        mutex_lock(&newsbsec->lock);