Bug 1915825

Summary: Allow falling back to genfscon labeling when the FS doesn't support xattrs and there is a fs_use_xattr rule for it
Product: Red Hat Enterprise Linux 8 Reporter: Ondrej Mosnacek <omosnace>
Component: kernelAssignee: Ondrej Mosnacek <omosnace>
kernel sub component: SELinux QA Contact: Milos Malik <mmalik>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: high CC: brdeoliv, vgoyal
Version: 8.3Keywords: AutoVerified, Reproducer, Triaged
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: kernel-4.18.0-308.el8 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-09 19:01:22 UTC Type: Enhancement
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: Red Hat1934093    
Bug Blocks: 1899703    

Description Ondrej Mosnacek 2021-01-13 13:49:16 UTC
Description of problem:

In order for the fix for BZ 1899703 to not break virtiofs mounts where the underlying filesystem (and thus the virtiofs mount itself) doesn't support xattrs, an additional kernel patch is needed that makes SELinux to fall back to a genfscon rule (if any) when there is an fs_use_xattr rule, but the superblock doesn't have xattr support.

The patch is currently posted at:

The patch's log message contains a simple reproducer that can be used to verify that the fallback works.

Comment 14 errata-xmlrpc 2021-11-09 19:01:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.