linux-kernel - Re: [PATCH v6] vfs, security: Fix automount superblock LSM init problem, preventing NFS sb sharing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 04 Aug 2023 16:22:27 +0100
From:   David Howells <dhowells@...hat.com>
To:     Paul Moore <paul@...l-moore.com>
Cc:     dhowells@...hat.com, Jeff Layton <jlayton@...nel.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Christian Brauner <brauner@...nel.org>,
        Trond Myklebust <trond.myklebust@...merspace.com>,
        Anna Schumaker <anna@...nel.org>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        Stephen Smalley <stephen.smalley.work@...il.com>,
        Eric Paris <eparis@...isplace.org>,
        Casey Schaufler <casey@...aufler-ca.com>,
        Scott Mayhew <smayhew@...hat.com>,
        Stephen Smalley <sds@...ho.nsa.gov>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-nfs@...r.kernel.org, linux-security-module@...r.kernel.org,
        selinux@...r.kernel.org
Subject: Re: [PATCH v6] vfs, security: Fix automount superblock LSM init problem, preventing NFS sb sharing

David Howells <dhowells@...hat.com> wrote:

> IIRC, the issue is when you make a mount with an explicit context= setting and
> make another mount from some way down the export tree that doesn't have an
> explicit setting, e.g.:
> 
> 	mount carina:/ /mnt -o context=system_u:object_r:root_t:s0
> 	mount carina:/nfs/scratch /mnt2
> 
> and then cause an automount to walk from one to the other:
> 
> 	stat /mnt/nfs/scratch/foo

Actually, the order there isn't quite right.  The problem is with this order:

	# mount carina:/ /mnt -o context=system_u:object_r:root_t:s0
	# stat /mnt/nfs/scratch/bus
	  File: /mnt/nfs/scratch/bus
	  Size: 124160          Blocks: 248        IO Block: 1048576 regular file
	Device: 0,55    Inode: 131         Links: 1
	...
	# mount carina:/nfs/scratch /mnt2
	mount.nfs: /mnt2 is busy or already mounted or sharecache fail

with the error:

	SELinux: mount invalid.  Same superblock, different security settings for (dev 0:52, type nfs4)

David