Re: [PATCH v2] selinux: bpf: check SBLABEL_MNT before isec init

[Stephen Smalley]

On Thu, Jul 30, 2026 at 6:15 PM Carlos Llamas <cmllamas@xxxxxxxxxx> wrote:
>
> selinux_inode_init_security() marks the isec as initialized before
> checking if mount labeling is supported (SBLABEL_MNT). This was fine
> until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"),
> where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
> xattrs) and yet leave the isec->initialized. This breaks subsequent
> calls to inode_doinit_with_dentry().
>
> Do the SBLABEL_MNT check before the inode security is initialized.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@xxxxxxxxxx/
> Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs")
> Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
> Signed-off-by: Carlos Llamas <cmllamas@xxxxxxxxxx>

Just re-affirming my Ack since the patch did change slightly.

Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>

> ---
> v2:
>   - Move the check further at the top per Paul's feedback.
>   - Collect Stephen's Ack.
>
> v1:
>   https://lore.kernel.org/all/20260730181008.3654413-1-cmllamas@xxxxxxxxxx/
>
>  security/selinux/hooks.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 8d6945edae7a..18dd28b2bb13 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2974,6 +2974,10 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
>
>         sbsec = selinux_superblock(dir->i_sb);
>
> +       if (!selinux_initialized() ||
> +           !(sbsec->flags & SBLABEL_MNT))
> +               return -EOPNOTSUPP;
> +
>         newsid = crsec->create_sid;
>         newsclass = inode_mode_to_security_class(inode->i_mode);
>         rc = selinux_determine_inode_label(crsec, dir, qstr, newsclass, &newsid);
> @@ -2988,10 +2992,6 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
>                 isec->initialized = LABEL_INITIALIZED;
>         }
>
> -       if (!selinux_initialized() ||
> -           !(sbsec->flags & SBLABEL_MNT))
> -               return -EOPNOTSUPP;
> -
>         xattr = lsm_get_xattr_slot(xattrs, xattr_count);
>         if (xattr) {
>                 rc = security_sid_to_context_force(newsid,
> --
> 2.55.0.508.g3f0d502094-goog
>