summaryrefslogtreecommitdiff
path: root/fs/nfs/fs_context.c
diff options
context:
space:
mode:
authorOlga Kornievskaia <kolga@netapp.com>2021-02-20 01:22:33 +0300
committerPaul Moore <paul@paul-moore.com>2021-03-22 22:01:45 +0300
commitec1ade6a0448e3bfb07bb905aca1bc18836220c7 (patch)
tree306efdd474c9289e61e13483a35c5dc868c74232 /fs/nfs/fs_context.c
parent8c6d76a3144154773339be5e29c8bf42586dc3d1 (diff)
downloadlinux-ec1ade6a0448e3bfb07bb905aca1bc18836220c7.tar.xz
nfs: account for selinux security context when deciding to share superblock
Keep track of whether or not there were LSM security context options passed during mount (ie creation of the superblock). Then, while deciding if the superblock can be shared for the new mount, check if the newly passed in LSM security context options are compatible with the existing superblock's ones by calling security_sb_mnt_opts_compat(). Previously, with selinux enabled, NFS wasn't able to do the following 2mounts: mount -o vers=4.2,sec=sys,context=system_u:object_r:root_t:s0 <serverip>:/ /mnt mount -o vers=4.2,sec=sys,context=system_u:object_r:swapfile_t:s0 <serverip>:/scratch /scratch 2nd mount would fail with "mount.nfs: an incorrect mount option was specified" and var log messages would have: "SElinux: mount invalid. Same superblock, different security settings for.." Signed-off-by: Olga Kornievskaia <kolga@netapp.com> [PM: tweak subject line] Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'fs/nfs/fs_context.c')
-rw-r--r--fs/nfs/fs_context.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c
index 971a9251c1d9..a06d213d7689 100644
--- a/fs/nfs/fs_context.c
+++ b/fs/nfs/fs_context.c
@@ -463,6 +463,9 @@ static int nfs_fs_context_parse_param(struct fs_context *fc,
if (opt < 0)
return ctx->sloppy ? 1 : opt;
+ if (fc->security)
+ ctx->has_sec_mnt_opts = 1;
+
switch (opt) {
case Opt_source:
if (fc->source)