linux-kernel - lgetxattr()/getxattr() return different values on a file labelled with selinux disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Mar 2013 11:54:38 +0100
From:	Thomas COUDRAY <amanone@...il.com>
To:	jmorris@...ei.org, sds@...ho.nsa.gov,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: lgetxattr()/getxattr() return different values on a file labelled
 with selinux disabled

Hi,
I encounter trouble that I can't explain when labelling my files.
Here are steps to reproduce (on both 3.2.37 and 3.7.3, with selinux, on
an ext4 fs):
0 - have a regular file "f", with a "before_t" security.selinux attribute
1 - reboot with selinux=0
2 - change the label to "after_t" (setfattr or chcon)
3 - both "ls -Z" (who calls lgetxattr(2)) and "getfattr -n
security.selinux" (who calls getxattr(2)) show "after_t"
4 - reboot with selinux enabled
5 - now ls prints "before_t", and getfattr "after_t".

I ran a small test that calls both syscalls (lgetxattr/getxattr), I
get "before_t" as expected
If I touch /.autorelabel, both ls/getfattr give "before_t".

--
Thomas Coudray
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/