mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 06:33:07 +00:00
ovl: skip getxattr of security labels
[ Upstream commit 03fedf9359
]
When inode has no listxattr op of its own (e.g. squashfs) vfs_listxattr
calls the LSM inode_listsecurity hooks to list the xattrs that LSMs will
intercept in inode_getxattr hooks.
When selinux LSM is installed but not initialized, it will list the
security.selinux xattr in inode_listsecurity, but will not intercept it
in inode_getxattr. This results in -ENODATA for a getxattr call for an
xattr returned by listxattr.
This situation was manifested as overlayfs failure to copy up lower
files from squashfs when selinux is built-in but not initialized,
because ovl_copy_xattr() iterates the lower inode xattrs by
vfs_listxattr() and vfs_getxattr().
ovl_copy_xattr() skips copy up of security labels that are indentified by
inode_copy_up_xattr LSM hooks, but it does that after vfs_getxattr().
Since we are not going to copy them, skip vfs_getxattr() of the security
labels.
Reported-by: Michael Labriola <michael.d.labriola@gmail.com>
Tested-by: Michael Labriola <michael.d.labriola@gmail.com>
Link: https://lore.kernel.org/linux-unionfs/2nv9d47zt7.fsf@aldarion.sourceruckus.org/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
83515cf735
commit
4dfce60487
1 changed files with 8 additions and 7 deletions
|
@ -95,6 +95,14 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
|
||||||
|
|
||||||
if (ovl_is_private_xattr(name))
|
if (ovl_is_private_xattr(name))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
error = security_inode_copy_up_xattr(name);
|
||||||
|
if (error < 0 && error != -EOPNOTSUPP)
|
||||||
|
break;
|
||||||
|
if (error == 1) {
|
||||||
|
error = 0;
|
||||||
|
continue; /* Discard */
|
||||||
|
}
|
||||||
retry:
|
retry:
|
||||||
size = vfs_getxattr(old, name, value, value_size);
|
size = vfs_getxattr(old, name, value, value_size);
|
||||||
if (size == -ERANGE)
|
if (size == -ERANGE)
|
||||||
|
@ -118,13 +126,6 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
|
||||||
goto retry;
|
goto retry;
|
||||||
}
|
}
|
||||||
|
|
||||||
error = security_inode_copy_up_xattr(name);
|
|
||||||
if (error < 0 && error != -EOPNOTSUPP)
|
|
||||||
break;
|
|
||||||
if (error == 1) {
|
|
||||||
error = 0;
|
|
||||||
continue; /* Discard */
|
|
||||||
}
|
|
||||||
error = vfs_setxattr(new, name, value, size, 0);
|
error = vfs_setxattr(new, name, value, size, 0);
|
||||||
if (error)
|
if (error)
|
||||||
break;
|
break;
|
||||||
|
|
Loading…
Reference in a new issue