From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E4ADB449B34 for ; Thu, 30 Jul 2026 18:10:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785435018; cv=none; b=PJWCihsOQ1eckXO73uh5iff1F3EcSh3BvYBiPRjP3RvsGHFXVsi4RPC2EJUprsAJGVpIQD4KwPETiiFiO6FAOXiJAEiZUd80pHLA2DRJKuQw04W0xR7NeHm28OHwY7ZSCB6OU5ZEtNiQiJcYvyI1KzXOo/IoNN8987jPsuW+xzk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785435018; c=relaxed/simple; bh=j4uG85a/lUOWlekw+/37SW+8lcXDbeUugVTGhEIFrNI=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=QbOSj1JSQiP7tZTZyeoO9PDJ2oqiql3BqzneB5dswSih7S0nDL4ZfVaxQxwsKNppA5WoB4p4pEDCsQz5SREbc9XP1ZxNpQxltXLOJGMVR1nlD5rBQycBOnU0hpEiHkiPK+2fKtWX8sRl9vRxjJsc7hqvnim4nziC7ft22CzfF3c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=TSsF5K32; arc=none smtp.client-ip=209.85.216.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="TSsF5K32" Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-38e7621655eso229201a91.0 for ; Thu, 30 Jul 2026 11:10:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1785435012; x=1786039812; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=/J+SX8dpZwKLLQ+HLHdBpKmApVdFrMwrn1102lcbc08=; b=TSsF5K32AejbDCJcn/YMBtVjqzkong6JGX2vhYbaLeOHfH9HkOtH4up5GFBy5+S6hj j0Ncik84ofrqHEJDw0TXEvrYl2YvwzWAg4FOoyPh9gTwVf7B5Ffen91Skpwa4Y8KXI/E Lxql/Rb73H6IUHxNYRFEbsJoKWKGZHtqhs8EQ0qfBQWe3NDYUOmd295fZDHNcsC8JVTT 2iTnq6LO3Eaz9WIuHtcbQA8JFJFiedfx0texYuMq+3HrUYUtOCiFGcgeWf0zvs7PUGfu Ps5SzA5e+eIKNYLamcBucKAB3J3LNZcT7G7KOlQMy+npBuSSYOCCXvHejM8a2z3wsclW qZQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785435012; x=1786039812; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/J+SX8dpZwKLLQ+HLHdBpKmApVdFrMwrn1102lcbc08=; b=U4mszCYIvtecK1yGJSiEKrl5U+T+UAIGoXQ5kcNBsIE73aU270tIXQwkMg7fP2lJhS z8Ykp1xs5JKpW03Y55IZ+qyklGR2Flb3Ht3+gEdwmUtlts8P+ymImh7UrDSMIk7WnZ2i fKz4TdTJ0HLWzBPA5e5SLtSKvsTwzTbO3CYWaeXekWdA/io5qC+l4tTt/DWoc4euuQ6y Tb827FvQWJx0ANXfX1p9wrzi50LeNBa33geUX9Z8on5NXdoNiLLvy9rxi/BkxzipqPA3 5RF74SkI4XlTph7NJIfab2sqnvXpJo8am0yn4BmVRQAJ462eESepph+mwRTyn59DkwSr 4GYg== X-Forwarded-Encrypted: i=1; AHgh+RoSa1OLpKOejmr1WvbBhSgGvm7DptjxQUOyTi4btSDerslU6fbWSCQQiIkCJqvjVVi7PG00mkPxC0N2XMQ=@vger.kernel.org X-Gm-Message-State: AOJu0Yw4QO6iDiPMzEVpsYihkqCe/6hgMfq2i2CED05YTdU3ZSi07yy/ 4sIjNeynSN6bxy5662/EYp3UU0TwScmDkUCk6cnyt073HaGHBJ2cDlxjUwCiDALAuFcN27VKVhL gAy35sR8oKAlU/Q== X-Received: from dybvk8.prod.google.com ([2002:a05:7301:53c8:b0:30f:45f6:de06]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:4c4b:b0:38f:c71:2342 with SMTP id 98e67ed59e1d1-38f9c00dfb9mr2757140a91.31.1785435012102; Thu, 30 Jul 2026 11:10:12 -0700 (PDT) Date: Thu, 30 Jul 2026 18:10:07 +0000 In-Reply-To: <01421d53-c379-4044-9da3-5990186303ef@iogearbox.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <01421d53-c379-4044-9da3-5990186303ef@iogearbox.net> X-Mailer: git-send-email 2.55.0.508.g3f0d502094-goog Message-ID: <20260730181008.3654413-1-cmllamas@google.com> Subject: [PATCH] selinux: bpf: check SBLABEL_MNT before isec init From: Carlos Llamas To: Paul Moore , Stephen Smalley , Ondrej Mosnacek , "Christian Brauner (Amutable)" , Daniel Borkmann Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Alexei Starovoitov , linux-fsdevel@vger.kernel.org, Carlos Llamas , stable@vger.kernel.org, "open list:SELINUX SECURITY MODULE" , "open list:BPF [MISC]:Keyword:(?:b|_)bpf(?:b|_)" Content-Type: text/plain; charset="UTF-8" selinux_inode_init_security() marks the isec as initialized before checking if mount labeling is supported (SBLABEL_MNT). This was fine until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"), where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no xattrs) and yet leave the isec->initialized. This breaks subsequent calls to inode_doinit_with_dentry(). Do the SBLABEL_MNT check before the inode security is initialized. Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@google.com/ Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs") Signed-off-by: Carlos Llamas --- security/selinux/hooks.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8d6945edae7a..09a12eb8652c 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2980,6 +2980,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, if (rc) return rc; + if (!selinux_initialized() || + !(sbsec->flags & SBLABEL_MNT)) + return -EOPNOTSUPP; + /* Possibly defer initialization to selinux_complete_init. */ if (sbsec->flags & SE_SBINITIALIZED) { struct inode_security_struct *isec = selinux_inode(inode); @@ -2988,10 +2992,6 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, isec->initialized = LABEL_INITIALIZED; } - if (!selinux_initialized() || - !(sbsec->flags & SBLABEL_MNT)) - return -EOPNOTSUPP; - xattr = lsm_get_xattr_slot(xattrs, xattr_count); if (xattr) { rc = security_sid_to_context_force(newsid, -- 2.55.0.508.g3f0d502094-goog