[BUG] cannot mount subvolume with selinux context

[Eryu Guan <guaneryu@gmail.com>]

Hi,

Description of the problem:

mount btrfs with selinux context, then create a subvolume, the new
subvolume cannot be mounted, even with the same context.

mkfs -t btrfs /dev/sda5
mount -o context=system_u:object_r:nfs_t:s0 /dev/sda5 /mnt/btrfs
btrfs subvolume create /mnt/btrfs/subvol
mount -o subvol=subvol,context=system_u:object_r:nfs_t:s0 /dev/sda5 /mnt/test

The last mount fails, and dmesg shows:
SELinux: mount invalid.  Same superblock, different security settings for (dev sda5, type btrfs)

But in fact, the security settings are the same.

from fs/super.c

struct dentry *
mount_fs(struct file_system_type *type, int flags, const char *name, void *data)
{
        struct dentry *root;
        struct super_block *sb;
        char *secdata = NULL;
        int error = -ENOMEM;

        if (data && !(type->fs_flags & FS_BINARY_MOUNTDATA)) {
                secdata = alloc_secdata();
                if (!secdata)
                        goto out;

                error = security_sb_copy_data(data, secdata);
                if (error)
                        goto out_free_secdata;
        }

        root = type->mount(type, flags, name, data);

The security_sb_copy_data() takes out selinux context data to
"secdata", then mount_subvol() calls mount_fs() (via vfs_kern_mount())
again without selinux context, so mount_subvol() fails, which fails
the whole mount.

Not sure what's the proper fix. Zach suggestted that the fix will
probably be to rework the vfs functions a bit as he said in rh
bugzilla[1].

Thanks,
Eryu

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1130860