[PATCH] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

[PATCH] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

[Stephen Smalley]

When an NFSv4 filesystem exported with security_label is mounted a
second time, sget_fc() returns the existing superblock and
nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
early exit without setting SECURITY_LSM_NATIVE_LABELS in
*set_kern_flags. nfs_get_root() then sees kflags without
SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
the shared nfs_server, silently disabling per-file labeling for both
the new and the original mount.

Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
on reused superblock") fixed the same problem in
selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
second mount now goes through sb_set_mnt_opts rather than
sb_clone_mnt_opts, so it needs the same treatment: on both
SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
*set_kern_flags when the superblock was already using
SECURITY_FS_USE_NATVE.

Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/hooks.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3f4a6ddee322..30776b0107f2 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -690,8 +690,12 @@ static int selinux_set_mnt_opts(struct super_block *sb,
 	 * will be used for both mounts)
 	 */
 	if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
-	    && !opts)
+		&& !opts) {
+		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) &&
+		    sbsec->behavior == SECURITY_FS_USE_NATIVE)
+			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 		goto out;
+	}
 
 	root_isec = backing_inode_security_novalidate(root);
 
@@ -735,6 +739,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
 		/* previously mounted with options, but not on this attempt? */
 		if ((sbsec->flags & SE_MNTMASK) && !opts)
 			goto out_double_mount;
+		if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) &&
+		    sbsec->behavior == SECURITY_FS_USE_NATIVE)
+			*set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 		rc = 0;
 		goto out;
 	}
-- 
2.55.0

Re: [PATCH] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

[sashiko-bot]

> When an NFSv4 filesystem exported with security_label is mounted a
> second time, sget_fc() returns the existing superblock and
> nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
> superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
> early exit without setting SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags. nfs_get_root() then sees kflags without
> SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
> the shared nfs_server, silently disabling per-file labeling for both
> the new and the original mount.
> 
> Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
> on reused superblock") fixed the same problem in
> selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
> second mount now goes through sb_set_mnt_opts rather than
> sb_clone_mnt_opts, so it needs the same treatment: on both
> SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags when the superblock was already using
> SECURITY_FS_USE_NATVE.
> 
> Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
> Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928141917.17577-1-stephen.smalley.work@gmail.com?part=1

Re: [PATCH] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

[Stephen Smalley]

On Mon, Sep 28, 2026 at 10:19 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> When an NFSv4 filesystem exported with security_label is mounted a
> second time, sget_fc() returns the existing superblock and
> nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
> superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
> early exit without setting SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags. nfs_get_root() then sees kflags without
> SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
> the shared nfs_server, silently disabling per-file labeling for both
> the new and the original mount.
>
> Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
> on reused superblock") fixed the same problem in
> selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
> second mount now goes through sb_set_mnt_opts rather than
> sb_clone_mnt_opts, so it needs the same treatment: on both
> SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags when the superblock was already using
> SECURITY_FS_USE_NATVE.
>
> Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
> Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92

As it turns out, this also fixes the other longstanding NFS bug we
have open, so you can also add:
Closes: https://github.com/SELinuxProject/selinux-kernel/issues/70
Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/91
and seemingly this goes all the way back to:
Fixes: eb9ae686507b ("SELinux: Add a new labeling type native labels")

Re: [PATCH] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

[Paul Moore]

On Sep 28, 2026 Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
> 
> When an NFSv4 filesystem exported with security_label is mounted a
> second time, sget_fc() returns the existing superblock and
> nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
> superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
> early exit without setting SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags. nfs_get_root() then sees kflags without
> SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
> the shared nfs_server, silently disabling per-file labeling for both
> the new and the original mount.
> 
> Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
> on reused superblock") fixed the same problem in
> selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
> second mount now goes through sb_set_mnt_opts rather than
> sb_clone_mnt_opts, so it needs the same treatment: on both
> SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags when the superblock was already using
> SECURITY_FS_USE_NATVE.
> 
> Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
> Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> Closes: https://github.com/SELinuxProject/selinux-kernel/issues/70
> Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/91
> Fixes: eb9ae686507b ("SELinux: Add a new labeling type native labels")
> ---
>  security/selinux/hooks.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

Nice catch, thanks Stephen!  I'm going to mark this for stable and merge
it into selinux/stable-7.3.

--
paul-moore.com