Commit e52e1ece authored Mar 11, 2021 by Amir Goldstein Committed by Cheng Jian Mar 11, 2021

ovl: skip getxattr of security labels



stable inclusion
from linux-4.19.177
commit 45f86fe44ef2d4e85c0ea795ec438e9761e04ad9

--------------------------------

[ Upstream commit 03fedf93 ]

When inode has no listxattr op of its own (e.g. squashfs) vfs_listxattr
calls the LSM inode_listsecurity hooks to list the xattrs that LSMs will
intercept in inode_getxattr hooks.

When selinux LSM is installed but not initialized, it will list the
security.selinux xattr in inode_listsecurity, but will not intercept it
in inode_getxattr.  This results in -ENODATA for a getxattr call for an
xattr returned by listxattr.

This situation was manifested as overlayfs failure to copy up lower
files from squashfs when selinux is built-in but not initialized,
because ovl_copy_xattr() iterates the lower inode xattrs by
vfs_listxattr() and vfs_getxattr().

ovl_copy_xattr() skips copy up of security labels that are indentified by
inode_copy_up_xattr LSM hooks, but it does that after vfs_getxattr().
Since we are not going to copy them, skip vfs_getxattr() of the security
labels.

Reported-by: Michael Labriola <michael.d.labriola@gmail.com>
Tested-by: Michael Labriola <michael.d.labriola@gmail.com>
Link: https://lore.kernel.org/linux-unionfs/2nv9d47zt7.fsf@aldarion.sourceruckus.org/


Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Cheng Jian <cj.chengjian@huawei.com>

parent 773ab678

fs/overlayfs/copy_up.c

+8 −7

Original line number	Diff line number	Diff line
		@@ -79,6 +79,14 @@ int ovl_copy_xattr(struct dentry old, struct dentry new)

		if (ovl_is_private_xattr(name))
		continue;

		error = security_inode_copy_up_xattr(name);
		if (error < 0 && error != -EOPNOTSUPP)
		break;
		if (error == 1) {
		error = 0;
		continue; /* Discard */
		}
		retry:
		size = vfs_getxattr(old, name, value, value_size);
		if (size == -ERANGE)
		@@ -102,13 +110,6 @@ int ovl_copy_xattr(struct dentry old, struct dentry new)
		goto retry;
		}

		error = security_inode_copy_up_xattr(name);
		if (error < 0 && error != -EOPNOTSUPP)
		break;
		if (error == 1) {
		error = 0;
		continue; /* Discard */
		}
		error = vfs_setxattr(new, name, value, size, 0);
		if (error)
		break;