diff options
| author |   Olga Kornievskaia <kolga@netapp.com> | 2021-02-19 17:22:33 -0500 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2021-03-22 15:01:45 -0400 |
| commit | ec1ade6a0448e3bfb07bb905aca1bc18836220c7 (patch) | |
| tree | 306efdd474c9289e61e13483a35c5dc868c74232 /fs/nfs/super.c | |
| parent | nfs: remove unneeded null check in nfs_fill_super() (diff) | |
| download | linux-dev-ec1ade6a0448e3bfb07bb905aca1bc18836220c7.tar.xz linux-dev-ec1ade6a0448e3bfb07bb905aca1bc18836220c7.zip | |
nfs: account for selinux security context when deciding to share superblock
Keep track of whether or not there were LSM security context
options passed during mount (ie creation of the superblock).
Then, while deciding if the superblock can be shared for the new
mount, check if the newly passed in LSM security context options
are compatible with the existing superblock's ones by calling
security_sb_mnt_opts_compat().
Previously, with selinux enabled, NFS wasn't able to do the
following 2mounts:
mount -o vers=4.2,sec=sys,context=system_u:object_r:root_t:s0
<serverip>:/ /mnt
mount -o vers=4.2,sec=sys,context=system_u:object_r:swapfile_t:s0
<serverip>:/scratch /scratch
2nd mount would fail with "mount.nfs: an incorrect mount option was
specified" and var log messages would have:
"SElinux: mount invalid. Same superblock, different security
settings for.."
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
[PM: tweak subject line]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to '')
| -rw-r--r-- | fs/nfs/super.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/nfs/super.c b/fs/nfs/super.c index de83c61a6733..4aaa1f5dd381 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -1077,6 +1077,7 @@ static void nfs_fill_super(struct super_block *sb, struct nfs_fs_context *ctx) &sb->s_blocksize_bits); nfs_super_set_maxbytes(sb, server->maxfilesize); + server->has_sec_mnt_opts = ctx->has_sec_mnt_opts; } static int nfs_compare_mount_options(const struct super_block *s, const struct nfs_server *b, @@ -1193,6 +1194,9 @@ static int nfs_compare_super(struct super_block *sb, struct fs_context *fc) return 0; if (!nfs_compare_userns(old, server)) return 0; + if ((old->has_sec_mnt_opts || fc->security) && + security_sb_mnt_opts_compat(sb, fc->security)) + return 0; return nfs_compare_mount_options(sb, server, fc); } |