Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <2678222.1691162178@warthog.procyon.org.uk>
References: <2678222.1691162178@warthog.procyon.org.uk> <bac543537058619345b363bbfc745927.paul@paul-moore.com> <20230802-master-v6-1-45d48299168b@kernel.org>
To:     Paul Moore <paul@paul-moore.com>
Cc:     dhowells@redhat.com, Jeff Layton <jlayton@kernel.org>,
        Alexander Viro <viro@zeniv.linux.org.uk>,
        Christian Brauner <brauner@kernel.org>,
        Trond Myklebust <trond.myklebust@hammerspace.com>,
        Anna Schumaker <anna@kernel.org>,
        James Morris <jmorris@namei.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Stephen Smalley <stephen.smalley.work@gmail.com>,
        Eric Paris <eparis@parisplace.org>,
        Casey Schaufler <casey@schaufler-ca.com>,
        Scott Mayhew <smayhew@redhat.com>,
        Stephen Smalley <sds@tycho.nsa.gov>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-nfs@vger.kernel.org, linux-security-module@vger.kernel.org,
        selinux@vger.kernel.org
Subject: Re: [PATCH v6] vfs, security: Fix automount superblock LSM init problem, preventing NFS sb sharing
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2680107.1691162547.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: quoted-printable
Date:   Fri, 04 Aug 2023 16:22:27 +0100
Message-ID: <2680108.1691162547@warthog.procyon.org.uk>
Precedence: bulk

David Howells <dhowells@redhat.com> wrote:

> IIRC, the issue is when you make a mount with an explicit context=3D set=
ting and
> make another mount from some way down the export tree that doesn't have =
an
> explicit setting, e.g.:
> =

> 	mount carina:/ /mnt -o context=3Dsystem_u:object_r:root_t:s0
> 	mount carina:/nfs/scratch /mnt2
> =

> and then cause an automount to walk from one to the other:
> =

> 	stat /mnt/nfs/scratch/foo

Actually, the order there isn't quite right.  The problem is with this ord=
er:

	# mount carina:/ /mnt -o context=3Dsystem_u:object_r:root_t:s0
	# stat /mnt/nfs/scratch/bus
	  File: /mnt/nfs/scratch/bus
	  Size: 124160          Blocks: 248        IO Block: 1048576 regular file
	Device: 0,55    Inode: 131         Links: 1
	...
	# mount carina:/nfs/scratch /mnt2
	mount.nfs: /mnt2 is busy or already mounted or sharecache fail

with the error:

	SELinux: mount invalid.  Same superblock, different security settings for=
 (dev 0:52, type nfs4)

David