Re: [PATCH] selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

[Paul Moore <paul@paul-moore.com>]

On Sep 28, 2026 Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
> 
> When an NFSv4 filesystem exported with security_label is mounted a
> second time, sget_fc() returns the existing superblock and
> nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the
> superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an
> early exit without setting SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags. nfs_get_root() then sees kflags without
> SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on
> the shared nfs_server, silently disabling per-file labeling for both
> the new and the original mount.
> 
> Commit 3815a245b501 ("security/selinux: fix SECURITY_LSM_NATIVE_LABELS
> on reused superblock") fixed the same problem in
> selinux_sb_clone_mnt_opts().  The reused-superblock path for a plain
> second mount now goes through sb_set_mnt_opts rather than
> sb_clone_mnt_opts, so it needs the same treatment: on both
> SE_SBINITIALIZED early exits, set SECURITY_LSM_NATIVE_LABELS in
> *set_kern_flags when the superblock was already using
> SECURITY_FS_USE_NATVE.
> 
> Closes: https://github.com/SELinuxProject/selinux-kernel/issues/69
> Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/92
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> Closes: https://github.com/SELinuxProject/selinux-kernel/issues/70
> Closes: https://github.com/SELinuxProject/selinux-testsuite/issues/91
> Fixes: eb9ae686507b ("SELinux: Add a new labeling type native labels")
> ---
>  security/selinux/hooks.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)

Nice catch, thanks Stephen!  I'm going to mark this for stable and merge
it into selinux/stable-7.3.

--
paul-moore.com