Commit 46c8ac74 authored by Eric Paris's avatar Eric Paris Committed by Trond Myklebust

nfs/lsm: make NFSv4 set LSM mount options

NFSv3 get_sb operations call into the LSM layer to set security options passed
from userspace.  NFSv4 hooks were not originally added since it was reasonably
late in the merge window and NFSv3 was the only thing that had regressed (v4
has never supported any LSM options)

This patch makes NFSv4 call into the LSM to set security options rather than
just blindly dropping them with no notice to the user as happens today.  This
patch was tested in a simple NFSv4 environment with the context= option and
appeared to work as expected.
Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: default avatarJames Morris <jmorris@namei.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 3a6258e1
...@@ -2015,6 +2015,10 @@ static int nfs4_get_sb(struct file_system_type *fs_type, ...@@ -2015,6 +2015,10 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
goto error_splat_super; goto error_splat_super;
} }
error = security_sb_set_mnt_opts(s, &data.lsm_opts);
if (error)
goto error_splat_root;
s->s_flags |= MS_ACTIVE; s->s_flags |= MS_ACTIVE;
mnt->mnt_sb = s; mnt->mnt_sb = s;
mnt->mnt_root = mntroot; mnt->mnt_root = mntroot;
...@@ -2031,6 +2035,8 @@ static int nfs4_get_sb(struct file_system_type *fs_type, ...@@ -2031,6 +2035,8 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
nfs_free_server(server); nfs_free_server(server);
goto out; goto out;
error_splat_root:
dput(mntroot);
error_splat_super: error_splat_super:
up_write(&s->s_umount); up_write(&s->s_umount);
deactivate_super(s); deactivate_super(s);
...@@ -2114,6 +2120,8 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags, ...@@ -2114,6 +2120,8 @@ static int nfs4_xdev_get_sb(struct file_system_type *fs_type, int flags,
mnt->mnt_sb = s; mnt->mnt_sb = s;
mnt->mnt_root = mntroot; mnt->mnt_root = mntroot;
security_sb_clone_mnt_opts(data->sb, s);
dprintk("<-- nfs4_xdev_get_sb() = 0\n"); dprintk("<-- nfs4_xdev_get_sb() = 0\n");
return 0; return 0;
...@@ -2197,6 +2205,8 @@ static int nfs4_referral_get_sb(struct file_system_type *fs_type, int flags, ...@@ -2197,6 +2205,8 @@ static int nfs4_referral_get_sb(struct file_system_type *fs_type, int flags,
mnt->mnt_sb = s; mnt->mnt_sb = s;
mnt->mnt_root = mntroot; mnt->mnt_root = mntroot;
security_sb_clone_mnt_opts(data->sb, s);
dprintk("<-- nfs4_referral_get_sb() = 0\n"); dprintk("<-- nfs4_referral_get_sb() = 0\n");
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment