Merge branch 'labeled-nfs' into linux-next

* labeled-nfs:
  NFS: Apply v4.1 capabilities to v4.2
  NFS: Add in v4.2 callback operation
  NFS: Make callbacks minor version generic
  Kconfig: Add Kconfig entry for Labeled NFS V4 client
  NFS: Extend NFS xattr handlers to accept the security namespace
  NFS: Client implementation of Labeled-NFS
  NFS: Add label lifecycle management
  NFS:Add labels to client function prototypes
  NFSv4: Extend fattr bitmaps to support all 3 words
  NFSv4: Introduce new label structure
  NFSv4: Add label recommended attribute and NFSv4 flags
  NFSv4.2: Added NFS v4.2 support to the NFS client
  SELinux: Add new labeling type native labels
  LSM: Add flags field to security_sb_set_mnt_opts for in kernel mount data.
  Security: Add Hook to test if the particular xattr is part of a MAC model.
  Security: Add hook to calculate context based on a negative dentry.
  NFS: Add NFSv4.2 protocol constants

Conflicts:
	fs/nfs/nfs4proc.c

5 files changed, 123 insertions, 9 deletions

diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
index 7b8fc73810ad..e36dee52f224 100644
--- a/include/linux/nfs4.h
+++ b/include/linux/nfs4.h
@@ -32,6 +32,15 @@ struct nfs4_acl {
         struct nfs4_ace aces[0];
 };
 
+#define NFS4_MAXLABELLEN        2048
+
+struct nfs4_label {
+        uint32_t        lfs;
+        uint32_t        pi;
+        u32             len;
+        char    *label;
+};
+
 typedef struct { char data[NFS4_VERIFIER_SIZE]; } nfs4_verifier;
 
 struct nfs_stateid4 {
@@ -219,6 +228,14 @@ enum nfsstat4 {
         NFS4ERR_REJECT_DELEG    = 10085,        /* on callback */
         NFS4ERR_RETURNCONFLICT  = 10086,        /* outstanding layoutreturn */
         NFS4ERR_DELEG_REVOKED   = 10087,        /* deleg./layout revoked */
+
+        /* nfs42 */
+        NFS4ERR_PARTNER_NOTSUPP = 10088,
+        NFS4ERR_PARTNER_NO_AUTH = 10089,
+        NFS4ERR_METADATA_NOTSUPP = 10090,
+        NFS4ERR_OFFLOAD_DENIED = 10091,
+        NFS4ERR_WRONG_LFS = 10092,
+        NFS4ERR_BADLABEL = 10093,
 };
 
 static inline bool seqid_mutating_err(u32 err)
@@ -378,6 +395,7 @@ enum lock_type4 {
 #define FATTR4_WORD1_FS_LAYOUT_TYPES    (1UL << 30)
 #define FATTR4_WORD2_LAYOUT_BLKSIZE     (1UL << 1)
 #define FATTR4_WORD2_MDSTHRESHOLD       (1UL << 4)
+#define FATTR4_WORD2_SECURITY_LABEL     (1UL << 17)
 
 /* MDS threshold bitmap bits */
 #define THRESHOLD_RD                    (1UL << 0)
@@ -390,11 +408,15 @@ enum lock_type4 {
 #define NFS4_VERSION 4
 #define NFS4_MINOR_VERSION 0
 
+#if defined(CONFIG_NFS_V4_2)
+#define NFS4_MAX_MINOR_VERSION 2
+#else
 #if defined(CONFIG_NFS_V4_1)
 #define NFS4_MAX_MINOR_VERSION 1
 #else
 #define NFS4_MAX_MINOR_VERSION 0
 #endif /* CONFIG_NFS_V4_1 */
+#endif /* CONFIG_NFS_V4_2 */
 
 #define NFS4_DEBUG 1
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 1384ed92cad6..0b176297aaf6 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -207,6 +207,7 @@ struct nfs_inode {
 #define NFS_INO_INVALID_ACL     0x0010          /* cached acls are invalid */
 #define NFS_INO_REVAL_PAGECACHE 0x0020          /* must revalidate pagecache */
 #define NFS_INO_REVAL_FORCED    0x0040          /* force revalidation ignoring a delegation */
+#define NFS_INO_INVALID_LABEL   0x0080          /* cached label is invalid */
 
 /*
  * Bit offsets in flags field
@@ -336,7 +337,7 @@ extern void nfs_zap_mapping(struct inode *inode, struct address_space *mapping);
 extern void nfs_zap_caches(struct inode *);
 extern void nfs_invalidate_atime(struct inode *);
 extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
-                                struct nfs_fattr *);
+                                struct nfs_fattr *, struct nfs4_label *);
 extern int nfs_refresh_inode(struct inode *, struct nfs_fattr *);
 extern int nfs_post_op_update_inode(struct inode *inode, struct nfs_fattr *fattr);
 extern int nfs_post_op_update_inode_force_wcc(struct inode *inode, struct nfs_fattr *fattr);
@@ -352,6 +353,8 @@ extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
 extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
+extern void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
+                                struct nfs4_label *label);
 extern struct nfs_open_context *get_nfs_open_context(struct nfs_open_context *ctx);
 extern void put_nfs_open_context(struct nfs_open_context *ctx);
 extern struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_cred *cred, fmode_t mode);
@@ -469,7 +472,8 @@ extern const struct file_operations nfs_dir_operations;
 extern const struct dentry_operations nfs_dentry_operations;
 
 extern void nfs_force_lookup_revalidate(struct inode *dir);
-extern int nfs_instantiate(struct dentry *dentry, struct nfs_fh *fh, struct nfs_fattr *fattr);
+extern int nfs_instantiate(struct dentry *dentry, struct nfs_fh *fh,
+                        struct nfs_fattr *fattr, struct nfs4_label *label);
 extern int nfs_may_open(struct inode *inode, struct rpc_cred *cred, int openflags);
 extern void nfs_access_zap_cache(struct inode *inode);
 
@@ -498,6 +502,24 @@ extern int nfs_mountpoint_expiry_timeout;
 extern void nfs_release_automount_timer(void);
 
 /*
+ * linux/fs/nfs/nfs4proc.c
+ */
+#ifdef CONFIG_NFS_V4_SECURITY_LABEL
+extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
+static inline void nfs4_label_free(struct nfs4_label *label)
+{
+        if (label) {
+                kfree(label->label);
+                kfree(label);
+        }
+        return;
+}
+#else
+static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
+static inline void nfs4_label_free(void *label) {}
+#endif
+
+/*
  * linux/fs/nfs/unlink.c
  */
 extern void nfs_complete_unlink(struct dentry *dentry, struct inode *);
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 3b7fa2abecca..d2212432c456 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -146,7 +146,12 @@ struct nfs_server {
         u32                     attr_bitmask[3];/* V4 bitmask representing the set
                                                    of attributes supported on this
                                                    filesystem */
-        u32                     cache_consistency_bitmask[2];
+        u32                     attr_bitmask_nl[3];
+                                                /* V4 bitmask representing the
+                                                   set of attributes supported
+                                                   on this filesystem excluding
+                                                   the label support bit. */
+        u32                     cache_consistency_bitmask[3];
                                                 /* V4 bitmask representing the subset
                                                    of change attribute, size, ctime
                                                    and mtime attributes supported by
@@ -200,5 +205,6 @@ struct nfs_server {
 #define NFS_CAP_UIDGID_NOMAP    (1U << 15)
 #define NFS_CAP_STATEID_NFSV41  (1U << 16)
 #define NFS_CAP_ATOMIC_OPEN_V1  (1U << 17)
+#define NFS_CAP_SECURITY_LABEL  (1U << 18)
 
 #endif
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 32c95d64e3aa..8651574a305b 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -101,6 +101,7 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_MOUNTED_ON_FILEID (1U << 22)
 #define NFS_ATTR_FATTR_OWNER_NAME       (1U << 23)
 #define NFS_ATTR_FATTR_GROUP_NAME       (1U << 24)
+#define NFS_ATTR_FATTR_V4_SECURITY_LABEL (1U << 25)
 
 #define NFS_ATTR_FATTR (NFS_ATTR_FATTR_TYPE \
                 | NFS_ATTR_FATTR_MODE \
@@ -120,7 +121,8 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_V3 (NFS_ATTR_FATTR \
                 | NFS_ATTR_FATTR_SPACE_USED)
 #define NFS_ATTR_FATTR_V4 (NFS_ATTR_FATTR \
-                | NFS_ATTR_FATTR_SPACE_USED)
+                | NFS_ATTR_FATTR_SPACE_USED \
+                | NFS_ATTR_FATTR_V4_SECURITY_LABEL)
 
 /*
  * Info on the file system
@@ -348,6 +350,7 @@ struct nfs_openargs {
         const u32 *             open_bitmap;
         __u32                   claim;
         enum createmode4        createmode;
+        const struct nfs4_label *label;
 };
 
 struct nfs_openres {
@@ -357,6 +360,7 @@ struct nfs_openres {
         struct nfs4_change_info cinfo;
         __u32                   rflags;
         struct nfs_fattr *      f_attr;
+        struct nfs4_label       *f_label;
         struct nfs_seqid *      seqid;
         const struct nfs_server *server;
         fmode_t                 delegation_type;
@@ -599,6 +603,7 @@ struct nfs_entry {
         int                     eof;
         struct nfs_fh *         fh;
         struct nfs_fattr *      fattr;
+        struct nfs4_label  *label;
         unsigned char           d_type;
         struct nfs_server *     server;
 };
@@ -631,6 +636,7 @@ struct nfs_setattrargs {
         struct iattr *                  iap;
         const struct nfs_server *       server; /* Needed for name mapping */
         const u32 *                     bitmask;
+        const struct nfs4_label         *label;
 };
 
 struct nfs_setaclargs {
@@ -666,6 +672,7 @@ struct nfs_getaclres {
 struct nfs_setattrres {
         struct nfs4_sequence_res        seq_res;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
         const struct nfs_server *       server;
 };
 
@@ -863,6 +870,7 @@ struct nfs4_create_arg {
         const struct iattr *            attrs;
         const struct nfs_fh *           dir_fh;
         const u32 *                     bitmask;
+        const struct nfs4_label         *label;
 };
 
 struct nfs4_create_res {
@@ -870,6 +878,7 @@ struct nfs4_create_res {
         const struct nfs_server *       server;
         struct nfs_fh *                 fh;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
         struct nfs4_change_info         dir_cinfo;
 };
 
@@ -894,6 +903,7 @@ struct nfs4_getattr_res {
         struct nfs4_sequence_res        seq_res;
         const struct nfs_server *       server;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
 };
 
 struct nfs4_link_arg {
@@ -908,6 +918,7 @@ struct nfs4_link_res {
         struct nfs4_sequence_res        seq_res;
         const struct nfs_server *       server;
         struct nfs_fattr *              fattr;
+        struct nfs4_label               *label;
         struct nfs4_change_info         cinfo;
         struct nfs_fattr *              dir_attr;
 };
@@ -925,6 +936,7 @@ struct nfs4_lookup_res {
         const struct nfs_server *       server;
         struct nfs_fattr *              fattr;
         struct nfs_fh *                 fh;
+        struct nfs4_label               *label;
 };
 
 struct nfs4_lookup_root_arg {
@@ -1367,11 +1379,12 @@ struct nfs_rpc_ops {
         struct dentry *(*try_mount) (int, const char *, struct nfs_mount_info *,
                                      struct nfs_subversion *);
         int     (*getattr) (struct nfs_server *, struct nfs_fh *,
-                            struct nfs_fattr *);
+                            struct nfs_fattr *, struct nfs4_label *);
         int     (*setattr) (struct dentry *, struct nfs_fattr *,
                             struct iattr *);
         int     (*lookup)  (struct inode *, struct qstr *,
-                            struct nfs_fh *, struct nfs_fattr *);
+                            struct nfs_fh *, struct nfs_fattr *,
+                            struct nfs4_label *);
         int     (*access)  (struct inode *, struct nfs_access_entry *);
         int     (*readlink)(struct inode *, struct page *, unsigned int,
                             unsigned int);
diff --git a/include/linux/security.h b/include/linux/security.h
index 4686491852a7..a585a9085e46 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -26,6 +26,7 @@
 #include <linux/capability.h>
 #include <linux/slab.h>
 #include <linux/err.h>
+#include <linux/string.h>
 
 struct linux_binprm;
 struct cred;
@@ -60,6 +61,9 @@ struct mm_struct;
 #define SECURITY_CAP_NOAUDIT 0
 #define SECURITY_CAP_AUDIT 1
 
+/* LSM Agnostic defines for sb_set_mnt_opts */
+#define SECURITY_LSM_NATIVE_LABELS      1
+
 struct ctl_table;
 struct audit_krule;
 struct user_namespace;
@@ -306,6 +310,15 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      Parse a string of security data filling in the opts structure
  *      @options string containing all mount options known by the LSM
  *      @opts binary data structure usable by the LSM
+ * @dentry_init_security:
+ *      Compute a context for a dentry as the inode is not yet available
+ *      since NFSv4 has no label backed by an EA anyway.
+ *      @dentry dentry to use in calculating the context.
+ *      @mode mode used to determine resource type.
+ *      @name name of the last path component used to create file
+ *      @ctx pointer to place the pointer to the resulting context in.
+ *      @ctxlen point to place the length of the resulting context.
+ *
  *
  * Security hooks for inode operations.
  *
@@ -1313,6 +1326,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *      @pages contains the number of pages.
  *      Return 0 if permission is granted.
  *
+ * @ismaclabel:
+ *      Check if the extended attribute specified by @name
+ *      represents a MAC label. Returns 1 if name is a MAC
+ *      attribute otherwise returns 0.
+ *      @name full extended attribute name to check against
+ *      LSM as a MAC label.
+ *
  * @secid_to_secctx:
  *      Convert secid to security context.  If secdata is NULL the length of
  *      the result will be returned in seclen, but no secdata will be returned.
@@ -1439,10 +1459,16 @@ struct security_operations {
         int (*sb_pivotroot) (struct path *old_path,
                              struct path *new_path);
         int (*sb_set_mnt_opts) (struct super_block *sb,
-                                struct security_mnt_opts *opts);
+                                struct security_mnt_opts *opts,
+                                unsigned long kern_flags,
+                                unsigned long *set_kern_flags);
         int (*sb_clone_mnt_opts) (const struct super_block *oldsb,
                                    struct super_block *newsb);
         int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);
+        int (*dentry_init_security) (struct dentry *dentry, int mode,
+                                        struct qstr *name, void **ctx,
+                                        u32 *ctxlen);
+
 
 #ifdef CONFIG_SECURITY_PATH
         int (*path_unlink) (struct path *dir, struct dentry *dentry);
@@ -1590,6 +1616,7 @@ struct security_operations {
 
         int (*getprocattr) (struct task_struct *p, char *name, char **value);
         int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size);
+        int (*ismaclabel) (const char *name);
         int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen);
         int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid);
         void (*release_secctx) (char *secdata, u32 seclen);
@@ -1725,10 +1752,16 @@ int security_sb_mount(const char *dev_name, struct path *path,
                       const char *type, unsigned long flags, void *data);
 int security_sb_umount(struct vfsmount *mnt, int flags);
 int security_sb_pivotroot(struct path *old_path, struct path *new_path);
-int security_sb_set_mnt_opts(struct super_block *sb, struct security_mnt_opts *opts);
+int security_sb_set_mnt_opts(struct super_block *sb,
+                                struct security_mnt_opts *opts,
+                                unsigned long kern_flags,
+                                unsigned long *set_kern_flags);
 int security_sb_clone_mnt_opts(const struct super_block *oldsb,
                                 struct super_block *newsb);
 int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts);
+int security_dentry_init_security(struct dentry *dentry, int mode,
+                                        struct qstr *name, void **ctx,
+                                        u32 *ctxlen);
 
 int security_inode_alloc(struct inode *inode);
 void security_inode_free(struct inode *inode);
@@ -1840,6 +1873,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode);
 int security_getprocattr(struct task_struct *p, char *name, char **value);
 int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size);
 int security_netlink_send(struct sock *sk, struct sk_buff *skb);
+int security_ismaclabel(const char *name);
 int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
 int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
 void security_release_secctx(char *secdata, u32 seclen);
@@ -2011,7 +2045,9 @@ static inline int security_sb_pivotroot(struct path *old_path,
 }
 
 static inline int security_sb_set_mnt_opts(struct super_block *sb,
-                                           struct security_mnt_opts *opts)
+                                           struct security_mnt_opts *opts,
+                                           unsigned long kern_flags,
+                                           unsigned long *set_kern_flags)
 {
         return 0;
 }
@@ -2035,6 +2071,16 @@ static inline int security_inode_alloc(struct inode *inode)
 static inline void security_inode_free(struct inode *inode)
 { }
 
+static inline int security_dentry_init_security(struct dentry *dentry,
+                                                 int mode,
+                                                 struct qstr *name,
+                                                 void **ctx,
+                                                 u32 *ctxlen)
+{
+        return -EOPNOTSUPP;
+}
+
+
 static inline int security_inode_init_security(struct inode *inode,
                                                 struct inode *dir,
                                                 const struct qstr *qstr,
@@ -2520,6 +2566,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
         return cap_netlink_send(sk, skb);
 }
 
+static inline int security_ismaclabel(const char *name)
+{
+        return 0;
+}
+
 static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 {
         return -EOPNOTSUPP;