Commit d80a8f1b authored by David Howells's avatar David Howells Committed by Christian Brauner
Browse files

vfs, security: Fix automount superblock LSM init problem, preventing NFS sb sharing 



When NFS superblocks are created by automounting, their LSM parameters
aren't set in the fs_context struct prior to sget_fc() being called,
leading to failure to match existing superblocks.

This bug leads to messages like the following appearing in dmesg when
fscache is enabled:

    NFS: Cache volume key already in use (nfs,4.2,2,108,106a8c0,1,,,,100000,100000,2ee,3a98,1d4c,3a98,1)

Fix this by adding a new LSM hook to load fc->security for submount
creation.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarJeff Layton <jlayton@kernel.org>
Link: https://lore.kernel.org/r/165962680944.3334508.6610023900349142034.stgit@warthog.procyon.org.uk/ # v1
Link: https://lore.kernel.org/r/165962729225.3357250.14350728846471527137.stgit@warthog.procyon.org.uk/ # v2
Link: https://lore.kernel.org/r/165970659095.2812394.6868894171102318796.stgit@warthog.procyon.org.uk/ # v3
Link: https://lore.kernel.org/r/166133579016.3678898.6283195019480567275.stgit@warthog.procyon.org.uk/ # v4
Link: https://lore.kernel.org/r/217595.1662033775@warthog.procyon.org.uk/

 # v5
Fixes: 9bc61ab1 ("vfs: Introduce fs_context, switch vfs_kern_mount() to it.")
Fixes: 779df6a5 ("NFS: Ensure security label is set for root inode")
Tested-by: default avatarJeff Layton <jlayton@kernel.org>
Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Acked-by: default avatar"Christian Brauner (Microsoft)" <brauner@kernel.org>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Message-Id: <20230808-master-v9-1-e0ecde888221@kernel.org>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 4352b8cd

fs/fs_context.c

+22 −1
Original line number Diff line number Diff line
@@ -315,10 +315,31 @@ struct fs_context *fs_context_for_reconfigure(struct dentry *dentry, 
}

EXPORT_SYMBOL(fs_context_for_reconfigure);



/**

 * fs_context_for_submount: allocate a new fs_context for a submount

 * @type: file_system_type of the new context

 * @reference: reference dentry from which to copy relevant info

 *

 * Allocate a new fs_context suitable for a submount. This also ensures that

 * the fc->security object is inherited from @reference (if needed).

 */

struct fs_context *fs_context_for_submount(struct file_system_type *type,

					   struct dentry *reference)

{

	return alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT);

	struct fs_context *fc;

	int ret;



	fc = alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT);

	if (IS_ERR(fc))

		return fc;



	ret = security_fs_context_submount(fc, reference->d_sb);

	if (ret) {

		put_fs_context(fc);

		return ERR_PTR(ret);

	}



	return fc;

}

EXPORT_SYMBOL(fs_context_for_submount);

include/linux/lsm_hook_defs.h

+1 −0
Original line number Diff line number Diff line
@@ -54,6 +54,7 @@ LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, struct file *f 
LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm)

LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, struct linux_binprm *bprm)

LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, struct linux_binprm *bprm)

LSM_HOOK(int, 0, fs_context_submount, struct fs_context *fc, struct super_block *reference)

LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc,

	 struct fs_context *src_sc)

LSM_HOOK(int, -ENOPARAM, fs_context_parse_param, struct fs_context *fc,

include/linux/security.h

+6 −0
Original line number Diff line number Diff line
@@ -293,6 +293,7 @@ int security_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file); 
int security_bprm_check(struct linux_binprm *bprm);

void security_bprm_committing_creds(struct linux_binprm *bprm);

void security_bprm_committed_creds(struct linux_binprm *bprm);

int security_fs_context_submount(struct fs_context *fc, struct super_block *reference);

int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc);

int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param);

int security_sb_alloc(struct super_block *sb);
@@ -629,6 +630,11 @@ static inline void security_bprm_committed_creds(struct linux_binprm *bprm) 
{

}



static inline int security_fs_context_submount(struct fs_context *fc,

					   struct super_block *reference)

{

	return 0;

}

static inline int security_fs_context_dup(struct fs_context *fc,

					  struct fs_context *src_fc)

{

security/security.c

+14 −0
Original line number Diff line number Diff line
@@ -1138,6 +1138,20 @@ void security_bprm_committed_creds(struct linux_binprm *bprm) 
	call_void_hook(bprm_committed_creds, bprm);

}



/**

 * security_fs_context_submount() - Initialise fc->security

 * @fc: new filesystem context

 * @reference: dentry reference for submount/remount

 *

 * Fill out the ->security field for a new fs_context.

 *

 * Return: Returns 0 on success or negative error code on failure.

 */

int security_fs_context_submount(struct fs_context *fc, struct super_block *reference)

{

	return call_int_hook(fs_context_submount, 0, fc, reference);

}



/**

 * security_fs_context_dup() - Duplicate a fs_context LSM blob

 * @fc: destination filesystem context

security/selinux/hooks.c

+22 −0
Original line number Diff line number Diff line
@@ -2745,6 +2745,27 @@ static int selinux_umount(struct vfsmount *mnt, int flags) 
				   FILESYSTEM__UNMOUNT, NULL);

}



static int selinux_fs_context_submount(struct fs_context *fc,

				   struct super_block *reference)

{

	const struct superblock_security_struct *sbsec;

	struct selinux_mnt_opts *opts;



	opts = kzalloc(sizeof(*opts), GFP_KERNEL);

	if (!opts)

		return -ENOMEM;



	sbsec = selinux_superblock(reference);

	if (sbsec->flags & FSCONTEXT_MNT)

		opts->fscontext_sid = sbsec->sid;

	if (sbsec->flags & CONTEXT_MNT)

		opts->context_sid = sbsec->mntpoint_sid;

	if (sbsec->flags & DEFCONTEXT_MNT)

		opts->defcontext_sid = sbsec->def_sid;

	fc->security = opts;

	return 0;

}



static int selinux_fs_context_dup(struct fs_context *fc,

				  struct fs_context *src_fc)

{
@@ -7182,6 +7203,7 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { 
	/*

	 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE

	 */

	LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount),

	LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),

	LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),

	LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),