bcachefs: initialize security xattrs on inode creation

[Komzpa]

Summary

• Run security_inode_init_security() from the bcachefs inode creation path so LSMs can provide initial security.* xattrs.
• Reuse the existing bcachefs xattr insert path for KEY_TYPE_XATTR_INDEX_SECURITY.
• Carry Reagan Bohan's security-callback patch from stale/conflicting Initial support for security callbacks. bcachefs#664 to the current bcachefs-tools source tree, preserving the original commit author on this branch.

Issue

koverstreet/bcachefs#642 reports that chcon fails on bcachefs with:

Operation not supported

The missing piece is that new bcachefs inodes do not run the security initialization callback that asks the active LSM for initial labels.

This still needs matching distro SELinux policy support for bcachefs as a labeled filesystem, as noted on koverstreet/bcachefs#664.

Provenance

The implementation comes from Reagan Bohan's koverstreet/bcachefs#664 payload commit. This branch was rebuilt at head 1cf1a9dcaa7213b86cbe980391deffc631bcc781 so the carried commit is authored by Reagan Bohan, with the current bcachefs-tools adaptation kept in that ported commit rather than presented as a new Komzpa-authored squash.

Tests

• tests/bcachefs: cover security.selinux xattrs ktest#65 adds focused coverage for setting and reading security.selinux.

Validation

• git diff --check origin/testing...HEAD
• BINDGEN=/home/kom/.cargo/bin/bindgen make -j32 fs/fs/xattr.o fs/vfs/fs.o bcachefs
• GitHub CI: all 17 visible checks passed for attribution-repaired head 1cf1a9dcaa7213b86cbe980391deffc631bcc781; merge state is CLEAN.

[koverstreet]

Merged to the testing branch — carried as vfs: initialize security xattrs on inode creation (809a76a), Reagan Bohan's authorship preserved, with rework on apply: minimal vfs-inode pre-init (the LSM only reads i_mode/uid/gid — no update_after_write or faked i_ino needed), NULL qstr for tmpfiles (ext4 parity), and the error path folded into the existing ?: chain. Followed by vfs: RAII for posix acls in __bch2_create (acaa983) cleaning up the surrounding error handling. Functionally verified in a Smack-enabled VM: every new inode gets security.SMACK64 at creation with no setxattr, labels persist across remount, fsck clean; manual security.* roundtrip also passes. Thanks Reagan for the original patch and Komzpa for carrying it forward!