SELinux: Add new labeling type native labels

There currently doesn't exist a labeling type that is adequate for use with
labeled NFS. Since NFS doesn't really support xattrs we can't use the use xattr
labeling behavior. For this we developed a new labeling type. The native
labeling type is used solely by NFS to ensure NFS inodes are labeled at runtime
by the NFS code instead of relying on the SELinux security server on the client
end.

Acked-by: Eric Paris <eparis@redhat.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com>
Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg>
Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg>
Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

1 files changed, 26 insertions, 9 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f3b54466a037..6149633ff715 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -81,6 +81,7 @@
 #include <linux/syslog.h>
 #include <linux/user_namespace.h>
 #include <linux/export.h>
+#include <linux/security.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
 
@@ -284,13 +285,14 @@ static void superblock_free_security(struct super_block *sb)
 
 /* The file system's label must be initialized prior to use. */
 
-static const char *labeling_behaviors[6] = {
+static const char *labeling_behaviors[7] = {
         "uses xattr",
         "uses transition SIDs",
         "uses task SIDs",
         "uses genfs_contexts",
         "not configured for labeling",
         "uses mountpoint labeling",
+        "uses native labeling",
 };
 
 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
@@ -678,14 +680,21 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         if (strcmp(sb->s_type->name, "proc") == 0)
                 sbsec->flags |= SE_SBPROC;
 
-        /* Determine the labeling behavior to use for this filesystem type. */
-        rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
-        if (rc) {
-                printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
-                       __func__, sb->s_type->name, rc);
-                goto out;
+        if (!sbsec->behavior) {
+                /*
+                 * Determine the labeling behavior to use for this
+                 * filesystem type.
+                 */
+                rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
+                                        "proc" : sb->s_type->name,
+                                        &sbsec->behavior, &sbsec->sid);
+                if (rc) {
+                        printk(KERN_WARNING
+                                "%s: security_fs_use(%s) returned %d\n",
+                                        __func__, sb->s_type->name, rc);
+                        goto out;
+                }
         }
-
         /* sets the context of the superblock for the fs being mounted. */
         if (fscontext_sid) {
                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
@@ -700,6 +709,11 @@ static int selinux_set_mnt_opts(struct super_block *sb,
          * sets the label used on all file below the mountpoint, and will set
          * the superblock context if not already set.
          */
+        if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
+                sbsec->behavior = SECURITY_FS_USE_NATIVE;
+                *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
+        }
+
         if (context_sid) {
                 if (!fscontext_sid) {
                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
@@ -731,7 +745,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         }
 
         if (defcontext_sid) {
-                if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
+                if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
+                        sbsec->behavior != SECURITY_FS_USE_NATIVE) {
                         rc = -EINVAL;
                         printk(KERN_WARNING "SELinux: defcontext option is "
                                "invalid for this filesystem type\n");
@@ -1230,6 +1245,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
         }
 
         switch (sbsec->behavior) {
+        case SECURITY_FS_USE_NATIVE:
+                break;
         case SECURITY_FS_USE_XATTR:
                 if (!inode->i_op->getxattr) {
                         isec->sid = sbsec->def_sid;