1 files changed, 26 insertions, 9 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f3b54466a037..6149633ff715 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -81,6 +81,7 @@
 #include <linux/syslog.h>
 #include <linux/user_namespace.h>
 #include <linux/export.h>
+#include <linux/security.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
 
@@ -284,13 +285,14 @@ static void superblock_free_security(struct super_block *sb)
 
 /* The file system's label must be initialized prior to use. */
 
-static const char *labeling_behaviors[6] = {
+static const char *labeling_behaviors[7] = {
         "uses xattr",
         "uses transition SIDs",
         "uses task SIDs",
         "uses genfs_contexts",
         "not configured for labeling",
         "uses mountpoint labeling",
+        "uses native labeling",
 };
 
 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
@@ -678,14 +680,21 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         if (strcmp(sb->s_type->name, "proc") == 0)
                 sbsec->flags |= SE_SBPROC;
 
-        /* Determine the labeling behavior to use for this filesystem type. */
-        rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
-        if (rc) {
-                printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
-                       __func__, sb->s_type->name, rc);
-                goto out;
+        if (!sbsec->behavior) {
+                /*
+                 * Determine the labeling behavior to use for this
+                 * filesystem type.
+                 */
+                rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
+                                        "proc" : sb->s_type->name,
+                                        &sbsec->behavior, &sbsec->sid);
+                if (rc) {
+                        printk(KERN_WARNING
+                                "%s: security_fs_use(%s) returned %d\n",
+                                        __func__, sb->s_type->name, rc);
+                        goto out;
+                }
         }
-
         /* sets the context of the superblock for the fs being mounted. */
         if (fscontext_sid) {
                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
@@ -700,6 +709,11 @@ static int selinux_set_mnt_opts(struct super_block *sb,
          * sets the label used on all file below the mountpoint, and will set
          * the superblock context if not already set.
          */
+        if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
+                sbsec->behavior = SECURITY_FS_USE_NATIVE;
+                *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
+        }
+
         if (context_sid) {
                 if (!fscontext_sid) {
                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
@@ -731,7 +745,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         }
 
         if (defcontext_sid) {
-                if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
+                if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
+                        sbsec->behavior != SECURITY_FS_USE_NATIVE) {
                         rc = -EINVAL;
                         printk(KERN_WARNING "SELinux: defcontext option is "
                                "invalid for this filesystem type\n");
@@ -1230,6 +1245,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
         }
 
         switch (sbsec->behavior) {
+        case SECURITY_FS_USE_NATIVE:
+                break;
         case SECURITY_FS_USE_XATTR:
                 if (!inode->i_op->getxattr) {
                         isec->sid = sbsec->def_sid;