Re: [PATCH v2] selinux: bpf: check SBLABEL_MNT before isec init

[Paul Moore]

On Jul 30, 2026 Carlos Llamas <cmllamas@xxxxxxxxxx> wrote:
> 
> selinux_inode_init_security() marks the isec as initialized before
> checking if mount labeling is supported (SBLABEL_MNT). This was fine
> until commit 9722955b5430 ("bpf: Add simple xattr support to bpffs"),
> where genfscon bpffs mounts fail the SBLABEL_MNT check as expected (no
> xattrs) and yet leave the isec->initialized. This breaks subsequent
> calls to inode_doinit_with_dentry().
> 
> Do the SBLABEL_MNT check before the inode security is initialized.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/all/akWdcp6P0FkNDzBk@xxxxxxxxxx/
> Fixes: 9722955b5430 ("bpf: Add simple xattr support to bpffs")
> Acked-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
> Signed-off-by: Carlos Llamas <cmllamas@xxxxxxxxxx>
> ---
> v2:
>   - Move the check further at the top per Paul's feedback.
>   - Collect Stephen's Ack.
> 
> v1:
>   https://lore.kernel.org/all/20260730181008.3654413-1-cmllamas@xxxxxxxxxx/
> 
>  security/selinux/hooks.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)

Merged into selinux/stable-7.2, thanks!

--
paul-moore.com