]> git.baikalelectronics.ru Git - kernel.git/commit
nfs: update has_sec_mnt_opts after cloning lsm options from parent
authorScott Mayhew <smayhew@redhat.com>
Tue, 22 Jun 2021 12:11:59 +0000 (08:11 -0400)
committerTrond Myklebust <trond.myklebust@hammerspace.com>
Mon, 28 Jun 2021 13:34:39 +0000 (09:34 -0400)
commitf7a58089e61ec4c3a0218416f23b84bc6fa0fbb9
tree0477b418a7f0c9da6565a5d73528a9ab376b46ec
parent5cd864b8850342ced57e208ae0b8f3851f31cd79
nfs: update has_sec_mnt_opts after cloning lsm options from parent

After calling security_sb_clone_mnt_opts() in nfs_get_root(), it's
necessary to copy the value of has_sec_mnt_opts from the cloned
super_block's nfs_server.  Otherwise, calls to nfs_compare_super()
using this super_block may not return the correct result, leading to
mount failures.

For example, mounting an nfs server with the following in /etc/exports:
/export *(rw,insecure,crossmnt,no_root_squash,security_label)
and having /export/scratch on a separate block device.

mount -o v4.2,context=system_u:object_r:root_t:s0 server:/export/test /mnt/test
mount -o v4.2,context=system_u:object_r:swapfile_t:s0 server:/export/scratch /mnt/scratch

The second mount would fail with "mount.nfs: /mnt/scratch is busy or
already mounted or sharecache fail" and "SELinux: mount invalid.  Same
superblock, different security settings for..." would appear in the
syslog.

Also while we're in there, replace several instances of "NFS_SB(s)"
with "server", which was already declared at the top of the
nfs_get_root().

Fixes: 9a335b4d21a5 ("nfs: account for selinux security context when deciding to share superblock")
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
fs/nfs/getroot.c