3 files changed, 19 insertions, 5 deletions

diff --git a/security/capability.c b/security/capability.c
index 71f9682bfb54..d32e16e3c6ae 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -91,7 +91,10 @@ static int cap_sb_pivotroot(struct path *old_path, struct path *new_path)
 }
 
 static int cap_sb_set_mnt_opts(struct super_block *sb,
-                               struct security_mnt_opts *opts)
+                               struct security_mnt_opts *opts,
+                               unsigned long kern_flags,
+                               unsigned long *set_kern_flags)
+
 {
         if (unlikely(opts->num_mnt_opts))
                 return -EOPNOTSUPP;
diff --git a/security/security.c b/security/security.c
index c3ceb754e705..8d0b9a79611a 100644
--- a/security/security.c
+++ b/security/security.c
@@ -294,9 +294,12 @@ int security_sb_pivotroot(struct path *old_path, struct path *new_path)
 }
 
 int security_sb_set_mnt_opts(struct super_block *sb,
-                                struct security_mnt_opts *opts)
+                                struct security_mnt_opts *opts,
+                                unsigned long kern_flags,
+                                unsigned long *set_kern_flags)
 {
-        return security_ops->sb_set_mnt_opts(sb, opts);
+        return security_ops->sb_set_mnt_opts(sb, opts, kern_flags,
+                                                set_kern_flags);
 }
 EXPORT_SYMBOL(security_sb_set_mnt_opts);
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index bbf219a494d0..f3b54466a037 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -552,7 +552,9 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
  * labeling information.
  */
 static int selinux_set_mnt_opts(struct super_block *sb,
-                                struct security_mnt_opts *opts)
+                                struct security_mnt_opts *opts,
+                                unsigned long kern_flags,
+                                unsigned long *set_kern_flags)
 {
         const struct cred *cred = current_cred();
         int rc = 0, i;
@@ -580,6 +582,12 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                         "before the security server is initialized\n");
                 goto out;
         }
+        if (kern_flags && !set_kern_flags) {
+                /* Specifying internal flags without providing a place to
+                 * place the results is not allowed */
+                rc = -EINVAL;
+                goto out;
+        }
 
         /*
          * Binary mount data FS will come through this function twice.  Once
@@ -980,7 +988,7 @@ static int superblock_doinit(struct super_block *sb, void *data)
                 goto out_err;
 
 out:
-        rc = selinux_set_mnt_opts(sb, &opts);
+        rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
 
 out_err:
         security_free_mnt_opts(&opts);