From: Olga Kornievskaia okorniev@redhat.com
[ Upstream commit 243fea134633ba3d64aceb4c16129c59541ea2c6 ]
Currently, when NFS is queried for all the labels present on the file via a command example "getfattr -d -m . /mnt/testfile", it does not return the security label. Yet when asked specifically for the label (getfattr -n security.selinux) it will be returned. Include the security label when all attributes are queried.
Signed-off-by: Olga Kornievskaia okorniev@redhat.com Signed-off-by: Anna Schumaker anna.schumaker@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org ---
**YES** This commit should be backported to stable kernel trees. Here's my extensive analysis: ## Bug Analysis The commit fixes a clear functional bug in NFSv4.2's `listxattr` implementation in `fs/nfs/nfs4proc.c:10853`. When users run `getfattr -d` to list all extended attributes, the security label (like SELinux context) is missing from the output, even though it's correctly returned when specifically requested with `getfattr -n security.selinux`. ## Code Change Analysis The fix is minimal and well-contained: 1. **Variable addition**: Adds `error4` to track the security label listing result 2. **Function call**: Adds `error4 = security_inode_listsecurity(d_inode(dentry), list, left)` 3. **Pointer management**: Updates `list` and `left` after `error3` processing (missing in original) 4. **Total calculation**: Changes `error += error2 + error3` to `error += error2 + error3 + error4` ## Why This Qualifies for Backport **1. Clear User-Facing Bug**: The inconsistency between `getfattr -d` and `getfattr -n security.selinux` affects real-world usage and user expectations. **2. Minimal Risk**: The change is architecturally simple - it just adds another xattr source to the listing function, following the exact same pattern as existing `error2` and `error3` handling. **3. Follows Existing Patterns**: The commit uses the same error handling, pointer arithmetic, and function call pattern established by `nfs4_listxattr_nfs4_label()` and `nfs4_listxattr_nfs4_user()`. **4. No Feature Addition**: This fixes existing functionality rather than adding new features. **5. Critical Subsystem**: Extended attributes and security labels are fundamental for SELinux environments, making this fix important for security-conscious deployments. **6. Similar Historical Precedent**: All 5 provided reference commits with "Backport Status: YES" are NFSv4 security label fixes with similar characteristics - small, contained bugfixes in the same subsystem. **7. Contained Scope**: The change is isolated to one function (`nfs4_listxattr`) in one file, with no cross-subsystem implications. The fix correctly implements the missing piece: while `nfs4_listxattr_nfs4_label()` calls `security_inode_listsecurity()` when `CONFIG_NFS_V4_SECURITY_LABEL` is enabled, the main `nfs4_listxattr()` function wasn't calling it directly for the general xattr listing case, creating the inconsistent behavior reported.
fs/nfs/nfs4proc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 1b94a55215e7d..97a009e007f95 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -10625,7 +10625,7 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = {
static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) { - ssize_t error, error2, error3; + ssize_t error, error2, error3, error4; size_t left = size;
error = generic_listxattr(dentry, list, left); @@ -10648,8 +10648,16 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left); if (error3 < 0) return error3; + if (list) { + list += error3; + left -= error3; + } + + error4 = security_inode_listsecurity(d_inode(dentry), list, left); + if (error4 < 0) + return error4;
- error += error2 + error3; + error += error2 + error3 + error4; if (size && error > size) return -ERANGE; return error;