selinux_inode_init_security() marks the isec as initialized before
checking if mount labeling is supported (SBLABEL_MNT). This was fine
until commit 9722955b54 ("bpf: Add simple xattr support to bpffs"),
where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
xattrs) and yet leave the isec->initialized. This breaks subsequent
calls to inode_doinit_with_dentry().
Do the SBLABEL_MNT check before the inode security is initialized.
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@google.com/
Fixes: 9722955b54 ("bpf: Add simple xattr support to bpffs")
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Bug: 529733987
(cherry picked from commit 28254722a459938d97150d3b0712b81e06d0645e
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git stable-7.2)
Change-Id: I291f198d144dda69f7ea0346b01d5fb48eb9abbe
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Carlos Llamas
8f0a5b31ae