4.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Smalley sds@tycho.nsa.gov
commit 7bb185edb0306bb90029a5fa6b9cff900ffdbf4b upstream.
commit 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs") broke mounting of cgroup2 under older SELinux policies which lacked a genfscon rule for cgroup2. This prevents mounting of cgroup2 even when SELinux is permissive.
Change the handling when there is no genfscon rule in policy to just mark the inode unlabeled and not return an error to the caller. This permits mounting and access if allowed by policy, e.g. to unconfined domains.
I also considered changing the behavior of security_genfs_sid() to never return -ENOENT, but the current behavior is relied upon by other callers to perform caller-specific handling.
Fixes: 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs") CC: stable@vger.kernel.org Reported-by: Dmitry Vyukov dvyukov@google.com Reported-by: Waiman Long longman@redhat.com Signed-off-by: Stephen Smalley sds@tycho.nsa.gov Tested-by: Waiman Long longman@redhat.com Signed-off-by: Paul Moore paul@paul-moore.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- security/selinux/hooks.c | 5 +++++ 1 file changed, 5 insertions(+)
--- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1509,6 +1509,11 @@ static int selinux_genfs_get_sid(struct } rc = security_genfs_sid(&selinux_state, sb->s_type->name, path, tclass, sid); + if (rc == -ENOENT) { + /* No match in policy, mark as unlabeled. */ + *sid = SECINITSID_UNLABELED; + rc = 0; + } } free_page((unsigned long)buffer); return rc;