Merge 4.14-rc4 into staging-next

We want the staging/iio fixes in here as well to handle merge issues.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 30 insertions, 0 deletions

diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 3382518b87fa..db80221891c6 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -21,6 +21,7 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/match.h"
+#include "include/net.h"
 #include "include/path.h"
 #include "include/policy.h"
 #include "include/label.h"
@@ -566,6 +567,32 @@ static int __file_path_perm(const char *op, struct aa_label *label,
         return error;
 }
 
+static int __file_sock_perm(const char *op, struct aa_label *label,
+                            struct aa_label *flabel, struct file *file,
+                            u32 request, u32 denied)
+{
+        struct socket *sock = (struct socket *) file->private_data;
+        int error;
+
+        AA_BUG(!sock);
+
+        /* revalidation due to label out of date. No revocation at this time */
+        if (!denied && aa_label_is_subset(flabel, label))
+                return 0;
+
+        /* TODO: improve to skip profiles cached in flabel */
+        error = aa_sock_file_perm(label, op, request, sock);
+        if (denied) {
+                /* TODO: improve to skip profiles checked above */
+                /* check every profile in file label to is cached */
+                last_error(error, aa_sock_file_perm(flabel, op, request, sock));
+        }
+        if (!error)
+                update_file_ctx(file_ctx(file), label, request);
+
+        return error;
+}
+
 /**
  * aa_file_perm - do permission revalidation check & audit for @file
  * @op: operation being checked
@@ -610,6 +637,9 @@ int aa_file_perm(const char *op, struct aa_label *label, struct file *file,
                 error = __file_path_perm(op, label, flabel, file, request,
                                          denied);
 
+        else if (S_ISSOCK(file_inode(file)->i_mode))
+                error = __file_sock_perm(op, label, flabel, file, request,
+                                         denied);
 done:
         rcu_read_unlock();