[RFC PATCH selinuxns 2/3] selinux: do not cache genfs xattr flag in superblock security blob

[Stephen Smalley <stephen.smalley.work@gmail.com>]

We should only try to fetch the xattr for cgroup or cgroup2 inodes if
the cgroup_seclabel policy capability is enabled in the policy.
Since this may differ in a child SELinux namespace, we need to check
it at inode labeling time rather than only on superblock initialization.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/hooks.c            | 12 ++++++++----
 security/selinux/include/security.h |  1 -
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 61171c45329f..5cfb7d8106fb 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -749,7 +749,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
 	if (!strcmp(sb->s_type->name, "sysfs") ||
 	    !strcmp(sb->s_type->name, "cgroup") ||
 	    !strcmp(sb->s_type->name, "cgroup2"))
-		sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
+		sbsec->flags |= SE_SBGENFS;
 
 	if (!sbsec->behavior) {
 		/*
@@ -1428,6 +1428,7 @@ static int inode_doinit_use_xattr(struct selinux_state *state,
 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 {
 	struct selinux_state *state = current_selinux_state;
+	struct super_block *sb = inode->i_sb;
 	struct superblock_security_struct *sbsec = NULL;
 	struct inode_security_struct *isec = selinux_inode(inode);
 	u32 task_sid, sid = 0;
@@ -1451,7 +1452,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 	while (state && !selinux_initialized(state))
 		state = state->parent;
 
-	sbsec = selinux_superblock(inode->i_sb);
+	sbsec = selinux_superblock(sb);
 	if (!state || !(sbsec->flags & SE_SBINITIALIZED)) {
 		/* Defer initialization until selinux_complete_init,
 		   after the initial policy is loaded and the security
@@ -1571,8 +1572,11 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 				goto out;
 			}
 
-			if ((sbsec->flags & SE_SBGENFS_XATTR) &&
-			    (inode->i_opflags & IOP_XATTR)) {
+			if ((inode->i_opflags & IOP_XATTR) &&
+			    (!strcmp(sb->s_type->name, "sysfs") ||
+			     (selinux_policycap_cgroupseclabel() &&
+			      (!strcmp(sb->s_type->name, "cgroup") ||
+			       !strcmp(sb->s_type->name, "cgroup2"))))) {
 				rc = inode_doinit_use_xattr(state, inode,
 							    dentry, sid,
 							    &sid);
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index c5df7a0b0069..8d39137c6ebc 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -67,7 +67,6 @@
 #define SE_SBINITIALIZED 0x0100
 #define SE_SBPROC	 0x0200
 #define SE_SBGENFS	 0x0400
-#define SE_SBGENFS_XATTR 0x0800
 #define SE_SBNATIVE	 0x1000
 
 #define CONTEXT_STR	"context"
-- 
2.51.1