Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux...

[linux-2.6-block.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index da934342a39f59432bde76a4755f85d5082f7ea1..ec30880c4b98cfc15ef77d0cdcc916c346b57a8e 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -830,6 +830,28 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                        goto out;
                }
        }
+
+       /*
+        * If this is a user namespace mount, no contexts are allowed
+        * on the command line and security labels must be ignored.
+        */
+       if (sb->s_user_ns != &init_user_ns) {
+               if (context_sid || fscontext_sid || rootcontext_sid ||
+                   defcontext_sid) {
+                       rc = -EACCES;
+                       goto out;
+               }
+               if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
+                       sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
+                       rc = security_transition_sid(current_sid(), current_sid(),
+                                                    SECCLASS_FILE, NULL,
+                                                    &sbsec->mntpoint_sid);
+                       if (rc)
+                               goto out;
+               }
+               goto out_set_opts;
+       }
+
        /* sets the context of the superblock for the fs being mounted. */
        if (fscontext_sid) {
                rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
@@ -898,6 +920,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                sbsec->def_sid = defcontext_sid;
        }
 
+out_set_opts:
        rc = sb_finish_set_opts(sb);
 out:
        mutex_unlock(&sbsec->lock);
@@ -2259,7 +2282,7 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
                            const struct task_security_struct *new_tsec)
 {
        int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
-       int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
+       int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
        int rc;
 
        if (!nnp && !nosuid)