Sync to v4.15-rc3 for security subsystem developers to work against.

author: James Morris <james.l.morris@oracle.com> 2017-12-11 01:01:08 -0500
committer: James Morris <james.l.morris@oracle.com> 2017-12-11 01:01:08 -0500
commit: d21bd6898336a7892914d308d5e0868f0b863571 (patch)
tree: f5f756c25348b5a6c1ce9ddbaa7d1ecd1bef40b0 /security
parent: 34d8751fd4ffa34e85ee7e85d34168b3f3f62b42 (diff)
parent: 50c4c4e268a2d7a3e58ebb698ac74da0de40ae36 (diff)
103 files changed, 932 insertions, 1523 deletions
diff --git a/security/Makefile b/security/Makefile
index f2d71cdb8e19..4d2d3782ddef 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for the kernel security code
 #
diff --git a/security/apparmor/.gitignore b/security/apparmor/.gitignore
index d5b291e94264..9cdec70d72b8 100644
--- a/security/apparmor/.gitignore
+++ b/security/apparmor/.gitignore
@@ -1,6 +1,5 @@
 #
 # Generated include files
 #
-net_names.h
 capability_names.h
 rlim_names.h
diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
index dafdd387d42b..9a6b4033d52b 100644
--- a/security/apparmor/Makefile
+++ b/security/apparmor/Makefile
@@ -1,47 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0
 # Makefile for AppArmor Linux Security Module
 #
 obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
 apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
              path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
-              resource.o secid.o file.o policy_ns.o label.o mount.o net.o
+              resource.o secid.o file.o policy_ns.o label.o mount.o
 apparmor-$(CONFIG_SECURITY_APPARMOR_HASH) += crypto.o
-clean-files := capability_names.h rlim_names.h net_names.h
+clean-files := capability_names.h rlim_names.h
-# Build a lower case string table of address family names
-# Transform lines from
-#    #define AF_LOCAL           1       /* POSIX name for AF_UNIX       */
-#    #define AF_INET            2       /* Internet IP Protocol         */
-# to
-#    [1] = "local",
-#    [2] = "inet",
-#
-# and build the securityfs entries for the mapping.
-# Transforms lines from
-#    #define AF_INET            2       /* Internet IP Protocol         */
-# to
-#    #define AA_SFS_AF_MASK "local inet"
-quiet_cmd_make-af = GEN     $@
-cmd_make-af = echo "static const char *address_family_names[] = {" > $@ ;\
-        sed $< >>$@ -r -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "/AF_ROUTE/d" -e \
-         's/^\#define[ \t]+AF_([A-Z0-9_]+)[ \t]+([0-9]+)(.*)/[\2] = "\L\1",/p';\
-        echo "};" >> $@ ;\
-        printf '%s' '\#define AA_SFS_AF_MASK "' >> $@ ;\
-        sed -r -n -e "/AF_MAX/d" -e "/AF_LOCAL/d" -e "/AF_ROUTE/d" -e \
-         's/^\#define[ \t]+AF_([A-Z0-9_]+)[ \t]+([0-9]+)(.*)/\L\1/p'\
-         $< | tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
-# Build a lower case string table of sock type names
-# Transform lines from
-#    SOCK_STREAM        = 1,
-# to
-#    [1] = "stream",
-quiet_cmd_make-sock = GEN     $@
-cmd_make-sock = echo "static const char *sock_type_names[] = {" >> $@ ;\
-        sed $^ >>$@ -r -n \
-        -e 's/^\tSOCK_([A-Z0-9_]+)[\t]+=[ \t]+([0-9]+)(.*)/[\2] = "\L\1",/p';\
-        echo "};" >> $@
 # Build a lower case string table of capability names
 # Transforms lines from
@@ -94,7 +62,6 @@ cmd_make-rlim = echo "static const char *const rlim_names[RLIM_NLIMITS] = {" \
            tr '\n' ' ' | sed -e 's/ $$/"\n/' >> $@
 $(obj)/capability.o : $(obj)/capability_names.h
-$(obj)/net.o : $(obj)/net_names.h
 $(obj)/resource.o : $(obj)/rlim_names.h
 $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
                            $(src)/Makefile
@@ -102,8 +69,3 @@ $(obj)/capability_names.h : $(srctree)/include/uapi/linux/capability.h \
 $(obj)/rlim_names.h : $(srctree)/include/uapi/asm-generic/resource.h \
                      $(src)/Makefile
        $(call cmd,make-rlim)
-$(obj)/net_names.h : $(srctree)/include/linux/socket.h \
-                     $(srctree)/include/linux/net.h \
-                     $(src)/Makefile
-        $(call cmd,make-af)
-        $(call cmd,make-sock)
diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
index 518d5928661b..d4fa04d91439 100644
--- a/security/apparmor/apparmorfs.c
+++ b/security/apparmor/apparmorfs.c
@@ -533,7 +533,7 @@ static ssize_t ns_revision_read(struct file *file, char __user *buf,
        long last_read;
        int avail;
-        mutex_lock(&rev->ns->lock);
+        mutex_lock_nested(&rev->ns->lock, rev->ns->level);
        last_read = rev->last_read;
        if (last_read == rev->ns->revision) {
                mutex_unlock(&rev->ns->lock);
@@ -543,7 +543,7 @@ static ssize_t ns_revision_read(struct file *file, char __user *buf,
                                             last_read !=
                                             READ_ONCE(rev->ns->revision)))
                        return -ERESTARTSYS;
-                mutex_lock(&rev->ns->lock);
+                mutex_lock_nested(&rev->ns->lock, rev->ns->level);
        }
        avail = sprintf(buffer, "%ld\n", rev->ns->revision);
@@ -577,7 +577,7 @@ static unsigned int ns_revision_poll(struct file *file, poll_table *pt)
        unsigned int mask = 0;
        if (rev) {
-                mutex_lock(&rev->ns->lock);
+                mutex_lock_nested(&rev->ns->lock, rev->ns->level);
                poll_wait(file, &rev->ns->wait, pt);
                if (rev->last_read < rev->ns->revision)
                        mask |= POLLIN | POLLRDNORM;
@@ -1643,7 +1643,7 @@ static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode)
         */
        inode_unlock(dir);
        error = simple_pin_fs(&aafs_ops, &aafs_mnt, &aafs_count);
-        mutex_lock(&parent->lock);
+        mutex_lock_nested(&parent->lock, parent->level);
        inode_lock_nested(dir, I_MUTEX_PARENT);
        if (error)
                goto out;
@@ -1692,7 +1692,7 @@ static int ns_rmdir_op(struct inode *dir, struct dentry *dentry)
        inode_unlock(dir);
        inode_unlock(dentry->d_inode);
-        mutex_lock(&parent->lock);
+        mutex_lock_nested(&parent->lock, parent->level);
        ns = aa_get_ns(__aa_findn_ns(&parent->sub_ns, dentry->d_name.name,
                                     dentry->d_name.len));
        if (!ns) {
@@ -1747,7 +1747,7 @@ void __aafs_ns_rmdir(struct aa_ns *ns)
                __aafs_profile_rmdir(child);
        list_for_each_entry(sub, &ns->sub_ns, base.list) {
-                mutex_lock(&sub->lock);
+                mutex_lock_nested(&sub->lock, sub->level);
                __aafs_ns_rmdir(sub);
                mutex_unlock(&sub->lock);
        }
@@ -1877,7 +1877,7 @@ int __aafs_ns_mkdir(struct aa_ns *ns, struct dentry *parent, const char *name,
        /* subnamespaces */
        list_for_each_entry(sub, &ns->sub_ns, base.list) {
-                mutex_lock(&sub->lock);
+                mutex_lock_nested(&sub->lock, sub->level);
                error = __aafs_ns_mkdir(sub, ns_subns_dir(ns), NULL, NULL);
                mutex_unlock(&sub->lock);
                if (error)
@@ -1921,7 +1921,7 @@ static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
        /* is next namespace a child */
        if (!list_empty(&ns->sub_ns)) {
                next = list_first_entry(&ns->sub_ns, typeof(*ns), base.list);
-                mutex_lock(&next->lock);
+                mutex_lock_nested(&next->lock, next->level);
                return next;
        }
@@ -1931,7 +1931,7 @@ static struct aa_ns *__next_ns(struct aa_ns *root, struct aa_ns *ns)
                mutex_unlock(&ns->lock);
                next = list_next_entry(ns, base.list);
                if (!list_entry_is_head(next, &parent->sub_ns, base.list)) {
-                        mutex_lock(&next->lock);
+                        mutex_lock_nested(&next->lock, next->level);
                        return next;
                }
                ns = parent;
@@ -2039,7 +2039,7 @@ static void *p_start(struct seq_file *f, loff_t *pos)
        f->private = root;
        /* find the first profile */
-        mutex_lock(&root->lock);
+        mutex_lock_nested(&root->lock, root->level);
        profile = __first_profile(root, root);
        /* skip to position */
@@ -2202,7 +2202,6 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
        AA_SFS_DIR("policy",                    aa_sfs_entry_policy),
        AA_SFS_DIR("domain",                    aa_sfs_entry_domain),
        AA_SFS_DIR("file",                      aa_sfs_entry_file),
-        AA_SFS_DIR("network",                   aa_sfs_entry_network),
        AA_SFS_DIR("mount",                     aa_sfs_entry_mount),
        AA_SFS_DIR("namespaces",                aa_sfs_entry_ns),
        AA_SFS_FILE_U64("capability",           VFS_CAP_FLAGS_MASK),
@@ -2452,7 +2451,7 @@ static int __init aa_create_aafs(void)
        aafs_mnt = kern_mount(&aafs_ops);
        if (IS_ERR(aafs_mnt))
                panic("can't set apparmorfs up\n");
-        aafs_mnt->mnt_sb->s_flags &= ~MS_NOUSER;
+        aafs_mnt->mnt_sb->s_flags &= ~SB_NOUSER;
        /* Populate fs tree. */
        error = entry_create_dir(&aa_sfs_entry, NULL);
@@ -2492,7 +2491,7 @@ static int __init aa_create_aafs(void)
        ns_subrevision(root_ns) = dent;
        /* policy tree referenced by magic policy symlink */
-        mutex_lock(&root_ns->lock);
+        mutex_lock_nested(&root_ns->lock, root_ns->level);
        error = __aafs_ns_mkdir(root_ns, aafs_mnt->mnt_root, ".policy",
                                aafs_mnt->mnt_root);
        mutex_unlock(&root_ns->lock);
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index dd754b7850a8..04ba9d0718ea 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -305,6 +305,7 @@ static int change_profile_perms(struct aa_profile *profile,
 * __attach_match_ - find an attachment match
 * @name - to match against  (NOT NULL)
 * @head - profile list to walk  (NOT NULL)
+ * @info - info message if there was an error (NOT NULL)
 *
 * Do a linear search on the profiles in the list.  There is a matching
 * preference where an exact match is preferred over a name which uses
@@ -316,28 +317,46 @@ static int change_profile_perms(struct aa_profile *profile,
 * Returns: profile or NULL if no match found
 */
 static struct aa_profile *__attach_match(const char *name,
-                                         struct list_head *head)
+                                         struct list_head *head,
+                                         const char **info)
 {
        int len = 0;
+        bool conflict = false;
        struct aa_profile *profile, *candidate = NULL;
        list_for_each_entry_rcu(profile, head, base.list) {
-                if (profile->label.flags & FLAG_NULL)
+                if (profile->label.flags & FLAG_NULL &&
+                    &profile->label == ns_unconfined(profile->ns))
                        continue;
-                if (profile->xmatch && profile->xmatch_len > len) {
-                        unsigned int state = aa_dfa_match(profile->xmatch,
+                if (profile->xmatch) {
-                                                          DFA_START, name);
+                        if (profile->xmatch_len == len) {
-                        u32 perm = dfa_user_allow(profile->xmatch, state);
+                                conflict = true;
-                        /* any accepting state means a valid match. */
+                                continue;
-                        if (perm & MAY_EXEC) {
+                        } else if (profile->xmatch_len > len) {
-                                candidate = profile;
+                                unsigned int state;
-                                len = profile->xmatch_len;
+                                u32 perm;
+                                state = aa_dfa_match(profile->xmatch,
+                                                     DFA_START, name);
+                                perm = dfa_user_allow(profile->xmatch, state);
+                                /* any accepting state means a valid match. */
+                                if (perm & MAY_EXEC) {
+                                        candidate = profile;
+                                        len = profile->xmatch_len;
+                                        conflict = false;
+                                }
                        }
                } else if (!strcmp(profile->base.name, name))
                        /* exact non-re match, no more searching required */
                        return profile;
        }
+        if (conflict) {
+                *info = "conflicting profile attachments";
+                return NULL;
+        }
        return candidate;
 }
@@ -346,16 +365,17 @@ static struct aa_profile *__attach_match(const char *name,
 * @ns: the current namespace  (NOT NULL)
 * @list: list to search  (NOT NULL)
 * @name: the executable name to match against  (NOT NULL)
+ * @info: info message if there was an error
 *
 * Returns: label or NULL if no match found
 */
 static struct aa_label *find_attach(struct aa_ns *ns, struct list_head *list,
-                                    const char *name)
+                                    const char *name, const char **info)
 {
        struct aa_profile *profile;
        rcu_read_lock();
-        profile = aa_get_profile(__attach_match(name, list));
+        profile = aa_get_profile(__attach_match(name, list, info));
        rcu_read_unlock();
        return profile ? &profile->label : NULL;
@@ -448,11 +468,11 @@ static struct aa_label *x_to_label(struct aa_profile *profile,
                if (xindex & AA_X_CHILD)
                        /* released by caller */
                        new = find_attach(ns, &profile->base.profiles,
-                                                name);
+                                          name, info);
                else
                        /* released by caller */
                        new = find_attach(ns, &ns->base.profiles,
-                                                name);
+                                          name, info);
                *lookupname = name;
                break;
        }
@@ -516,7 +536,7 @@ static struct aa_label *profile_transition(struct aa_profile *profile,
        if (profile_unconfined(profile)) {
                new = find_attach(profile->ns, &profile->ns->base.profiles,
-                                  name);
+                                  name, &info);
                if (new) {
                        AA_DEBUG("unconfined attached to new label");
                        return new;
@@ -541,9 +561,21 @@ static struct aa_label *profile_transition(struct aa_profile *profile,
                }
        } else if (COMPLAIN_MODE(profile)) {
                /* no exec permission - learning mode */
-                struct aa_profile *new_profile = aa_new_null_profile(profile,
+                struct aa_profile *new_profile = NULL;
-                                                              false, name,
+                char *n = kstrdup(name, GFP_ATOMIC);
-                                                              GFP_ATOMIC);
+                if (n) {
+                        /* name is ptr into buffer */
+                        long pos = name - buffer;
+                        /* break per cpu buffer hold */
+                        put_buffers(buffer);
+                        new_profile = aa_new_null_profile(profile, false, n,
+                                                          GFP_KERNEL);
+                        get_buffers(buffer);
+                        name = buffer + pos;
+                        strcpy((char *)name, n);
+                        kfree(n);
+                }
                if (!new_profile) {
                        error = -ENOMEM;
                        info = "could not create null profile";
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index db80221891c6..e79bf44396a3 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -21,7 +21,6 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/match.h"
-#include "include/net.h"
 #include "include/path.h"
 #include "include/policy.h"
 #include "include/label.h"
@@ -227,18 +226,12 @@ static u32 map_old_perms(u32 old)
 struct aa_perms aa_compute_fperms(struct aa_dfa *dfa, unsigned int state,
                                  struct path_cond *cond)
 {
-        struct aa_perms perms;
        /* FIXME: change over to new dfa format
         * currently file perms are encoded in the dfa, new format
         * splits the permissions from the dfa.  This mapping can be
         * done at profile load
         */
-        perms.deny = 0;
+        struct aa_perms perms = { };
-        perms.kill = perms.stop = 0;
-        perms.complain = perms.cond = 0;
-        perms.hide = 0;
-        perms.prompt = 0;
        if (uid_eq(current_fsuid(), cond->uid)) {
                perms.allow = map_old_perms(dfa_user_allow(dfa, state));
@@ -567,32 +560,6 @@ static int __file_path_perm(const char *op, struct aa_label *label,
        return error;
 }
-static int __file_sock_perm(const char *op, struct aa_label *label,
-                            struct aa_label *flabel, struct file *file,
-                            u32 request, u32 denied)
-{
-        struct socket *sock = (struct socket *) file->private_data;
-        int error;
-        AA_BUG(!sock);
-        /* revalidation due to label out of date. No revocation at this time */
-        if (!denied && aa_label_is_subset(flabel, label))
-                return 0;
-        /* TODO: improve to skip profiles cached in flabel */
-        error = aa_sock_file_perm(label, op, request, sock);
-        if (denied) {
-                /* TODO: improve to skip profiles checked above */
-                /* check every profile in file label to is cached */
-                last_error(error, aa_sock_file_perm(flabel, op, request, sock));
-        }
-        if (!error)
-                update_file_ctx(file_ctx(file), label, request);
-        return error;
-}
 /**
 * aa_file_perm - do permission revalidation check & audit for @file
 * @op: operation being checked
@@ -637,9 +604,6 @@ int aa_file_perm(const char *op, struct aa_label *label, struct file *file,
                error = __file_path_perm(op, label, flabel, file, request,
                                         denied);
-        else if (S_ISSOCK(file_inode(file)->i_mode))
-                error = __file_sock_perm(op, label, flabel, file, request,
-                                         denied);
 done:
        rcu_read_unlock();
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index ff4316e1068d..4ac095118717 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -123,20 +123,10 @@ struct apparmor_audit_data {
                        struct aa_label *peer;
                        union {
                                struct {
-                                        kuid_t ouid;
                                        const char *target;
+                                        kuid_t ouid;
                                } fs;
-                                struct {
-                                        int type, protocol;
-                                        struct sock *peer_sk;
-                                        void *addr;
-                                        int addrlen;
-                                } net;
                                int signal;
-                                struct {
-                                        int rlim;
-                                        unsigned long max;
-                                } rlim;
                        };
                };
                struct {
@@ -145,6 +135,10 @@ struct apparmor_audit_data {
                        long pos;
                } iface;
                struct {
+                        int rlim;
+                        unsigned long max;
+                } rlim;
+                struct {
                        const char *src_name;
                        const char *type;
                        const char *trans;
diff --git a/security/apparmor/include/lib.h b/security/apparmor/include/lib.h
index 436b3a722357..6505e1ad9e23 100644
--- a/security/apparmor/include/lib.h
+++ b/security/apparmor/include/lib.h
@@ -19,17 +19,6 @@
 #include "match.h"
-/* Provide our own test for whether a write lock is held for asserts
- * this is because on none SMP systems write_can_lock will always
- * resolve to true, which is what you want for code making decisions
- * based on it, but wrong for asserts checking that the lock is held
- */
-#ifdef CONFIG_SMP
-#define write_is_locked(X) !write_can_lock(X)
-#else
-#define write_is_locked(X) (1)
-#endif /* CONFIG_SMP */
 /*
 * DEBUG remains global (no per profile flag) since it is mostly used in sysctl
 * which is not related to profile accesses.
@@ -97,7 +86,7 @@ static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa,
 static inline bool path_mediated_fs(struct dentry *dentry)
 {
-        return !(dentry->d_sb->s_flags & MS_NOUSER);
+        return !(dentry->d_sb->s_flags & SB_NOUSER);
 }
diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h
deleted file mode 100644
index 140c8efcf364..000000000000
--- a/security/apparmor/include/net.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * AppArmor security module
- *
- * This file contains AppArmor network mediation definitions.
- *
- * Copyright (C) 1998-2008 Novell/SUSE
- * Copyright 2009-2017 Canonical Ltd.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation, version 2 of the
- * License.
- */
-#ifndef __AA_NET_H
-#define __AA_NET_H
-#include <net/sock.h>
-#include <linux/path.h>
-#include "apparmorfs.h"
-#include "label.h"
-#include "perms.h"
-#include "policy.h"
-#define AA_MAY_SEND             AA_MAY_WRITE
-#define AA_MAY_RECEIVE          AA_MAY_READ
-#define AA_MAY_SHUTDOWN         AA_MAY_DELETE
-#define AA_MAY_CONNECT          AA_MAY_OPEN
-#define AA_MAY_ACCEPT           0x00100000
-#define AA_MAY_BIND             0x00200000
-#define AA_MAY_LISTEN           0x00400000
-#define AA_MAY_SETOPT           0x01000000
-#define AA_MAY_GETOPT           0x02000000
-#define NET_PERMS_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE |    \
-                        AA_MAY_SHUTDOWN | AA_MAY_BIND | AA_MAY_LISTEN |   \
-                        AA_MAY_CONNECT | AA_MAY_ACCEPT | AA_MAY_SETATTR | \
-                        AA_MAY_GETATTR | AA_MAY_SETOPT | AA_MAY_GETOPT)
-#define NET_FS_PERMS (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CREATE |    \
-                      AA_MAY_SHUTDOWN | AA_MAY_CONNECT | AA_MAY_RENAME |\
-                      AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_CHMOD |  \
-                      AA_MAY_CHOWN | AA_MAY_CHGRP | AA_MAY_LOCK |       \
-                      AA_MAY_MPROT)
-#define NET_PEER_MASK (AA_MAY_SEND | AA_MAY_RECEIVE | AA_MAY_CONNECT |  \
-                       AA_MAY_ACCEPT)
-struct aa_sk_ctx {
-        struct aa_label *label;
-        struct aa_label *peer;
-        struct path path;
-};
-#define SK_CTX(X) ((X)->sk_security)
-#define SOCK_ctx(X) SOCK_INODE(X)->i_security
-#define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P)                           \
-        struct lsm_network_audit NAME ## _net = { .sk = (SK),             \
-                                                  .family = (F)};         \
-        DEFINE_AUDIT_DATA(NAME,                                           \
-                          ((SK) && (F) != AF_UNIX) ? LSM_AUDIT_DATA_NET : \
-                                                     LSM_AUDIT_DATA_NONE, \
-                          OP);                                            \
-        NAME.u.net = &(NAME ## _net);                                     \
-        aad(&NAME)->net.type = (T);                                       \
-        aad(&NAME)->net.protocol = (P)
-#define DEFINE_AUDIT_SK(NAME, OP, SK)                                   \
-        DEFINE_AUDIT_NET(NAME, OP, SK, (SK)->sk_family, (SK)->sk_type,  \
-                         (SK)->sk_protocol)
-/* struct aa_net - network confinement data
- * @allow: basic network families permissions
- * @audit: which network permissions to force audit
- * @quiet: which network permissions to quiet rejects
- */
-struct aa_net {
-        u16 allow[AF_MAX];
-        u16 audit[AF_MAX];
-        u16 quiet[AF_MAX];
-};
-extern struct aa_sfs_entry aa_sfs_entry_network[];
-void audit_net_cb(struct audit_buffer *ab, void *va);
-int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
-                       u32 request, u16 family, int type);
-int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
-               int type, int protocol);
-static inline int aa_profile_af_sk_perm(struct aa_profile *profile,
-                                        struct common_audit_data *sa,
-                                        u32 request,
-                                        struct sock *sk)
-{
-        return aa_profile_af_perm(profile, sa, request, sk->sk_family,
-                                  sk->sk_type);
-}
-int aa_sk_perm(const char *op, u32 request, struct sock *sk);
-int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
-                      struct socket *sock);
-static inline void aa_free_net_rules(struct aa_net *new)
-{
-        /* NOP */
-}
-#endif /* __AA_NET_H */
diff --git a/security/apparmor/include/perms.h b/security/apparmor/include/perms.h
index af04d5a7d73d..2b27bb79aec4 100644
--- a/security/apparmor/include/perms.h
+++ b/security/apparmor/include/perms.h
@@ -135,10 +135,9 @@ extern struct aa_perms allperms;
 void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask);
-void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
+void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask);
-                         u32 mask);
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
-                        u32 chrsmask, const char * const *names, u32 namesmask);
+                        u32 chrsmask, const char **names, u32 namesmask);
 void aa_apply_modes_to_perms(struct aa_profile *profile,
                             struct aa_perms *perms);
 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
index 4364088a0b9e..17fe41a9cac3 100644
--- a/security/apparmor/include/policy.h
+++ b/security/apparmor/include/policy.h
@@ -30,7 +30,6 @@
 #include "file.h"
 #include "lib.h"
 #include "label.h"
-#include "net.h"
 #include "perms.h"
 #include "resource.h"
@@ -112,7 +111,6 @@ struct aa_data {
 * @policy: general match rules governing policy
 * @file: The set of rules governing basic file access and domain transitions
 * @caps: capabilities for the profile
- * @net: network controls for the profile
 * @rlimits: rlimits for the profile
 *
 * @dents: dentries for the profiles file entries in apparmorfs
@@ -150,7 +148,6 @@ struct aa_profile {
        struct aa_policydb policy;
        struct aa_file_rules file;
        struct aa_caps caps;
-        struct aa_net net;
        struct aa_rlimit rlimits;
        struct aa_loaddata *rawdata;
@@ -223,16 +220,6 @@ static inline unsigned int PROFILE_MEDIATES_SAFE(struct aa_profile *profile,
        return 0;
 }
-static inline unsigned int PROFILE_MEDIATES_AF(struct aa_profile *profile,
-                                               u16 AF) {
-        unsigned int state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
-        u16 be_af = cpu_to_be16(AF);
-        if (!state)
-                return 0;
-        return aa_dfa_match_len(profile->policy.dfa, state, (char *) &be_af, 2);
-}
 /**
 * aa_get_profile - increment refcount on profile @p
 * @p: profile  (MAYBE NULL)
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index 66fb9ede9447..7ca0032e7ba9 100644
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -128,7 +128,7 @@ static inline int map_signal_num(int sig)
                return SIGUNKNOWN;
        else if (sig >= SIGRTMIN)
                return sig - SIGRTMIN + 128;    /* rt sigs mapped to 128 */
-        else if (sig <= MAXMAPPED_SIG)
+        else if (sig < MAXMAPPED_SIG)
                return sig_map[sig];
        return SIGUNKNOWN;
 }
@@ -163,7 +163,7 @@ static void audit_signal_cb(struct audit_buffer *ab, void *va)
                        audit_signal_mask(ab, aad(sa)->denied);
                }
        }
-        if (aad(sa)->signal <= MAXMAPPED_SIG)
+        if (aad(sa)->signal < MAXMAPPED_SIG)
                audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]);
        else
                audit_log_format(ab, " signal=rtmin+%d",
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index c5b99b954580..324fe5c60f87 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -80,7 +80,7 @@ void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
        AA_BUG(!orig);
        AA_BUG(!new);
-        AA_BUG(!write_is_locked(&labels_set(orig)->lock));
+        lockdep_assert_held_exclusive(&labels_set(orig)->lock);
        tmp = rcu_dereference_protected(orig->proxy->label,
                                        &labels_ns(orig)->lock);
@@ -571,7 +571,7 @@ static bool __label_remove(struct aa_label *label, struct aa_label *new)
        AA_BUG(!ls);
        AA_BUG(!label);
-        AA_BUG(!write_is_locked(&ls->lock));
+        lockdep_assert_held_exclusive(&ls->lock);
        if (new)
                __aa_proxy_redirect(label, new);
@@ -608,7 +608,7 @@ static bool __label_replace(struct aa_label *old, struct aa_label *new)
        AA_BUG(!ls);
        AA_BUG(!old);
        AA_BUG(!new);
-        AA_BUG(!write_is_locked(&ls->lock));
+        lockdep_assert_held_exclusive(&ls->lock);
        AA_BUG(new->flags & FLAG_IN_TREE);
        if (!label_is_stale(old))
@@ -645,7 +645,7 @@ static struct aa_label *__label_insert(struct aa_labelset *ls,
        AA_BUG(!ls);
        AA_BUG(!label);
        AA_BUG(labels_set(label) != ls);
-        AA_BUG(!write_is_locked(&ls->lock));
+        lockdep_assert_held_exclusive(&ls->lock);
        AA_BUG(label->flags & FLAG_IN_TREE);
        /* Figure out where to put new node */
@@ -2115,7 +2115,7 @@ void __aa_labelset_update_subtree(struct aa_ns *ns)
        __labelset_update(ns);
        list_for_each_entry(child, &ns->sub_ns, base.list) {
-                mutex_lock(&child->lock);
+                mutex_lock_nested(&child->lock, child->level);
                __aa_labelset_update_subtree(child);
                mutex_unlock(&child->lock);
        }
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 8818621b5d95..4d5e98e49d5e 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -211,8 +211,7 @@ void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask)
        *str = '\0';
 }
-void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
+void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask)
-                         u32 mask)
 {
        const char *fmt = "%s";
        unsigned int i, perm = 1;
@@ -230,7 +229,7 @@ void aa_audit_perm_names(struct audit_buffer *ab, const char * const *names,
 }
 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs,
-                        u32 chrsmask, const char * const *names, u32 namesmask)
+                        u32 chrsmask, const char **names, u32 namesmask)
 {
        char str[33];
@@ -318,14 +317,11 @@ static u32 map_other(u32 x)
 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state,
                      struct aa_perms *perms)
 {
-        perms->deny = 0;
+        *perms = (struct aa_perms) {
-        perms->kill = perms->stop = 0;
+                .allow = dfa_user_allow(dfa, state),
-        perms->complain = perms->cond = 0;
+                .audit = dfa_user_audit(dfa, state),
-        perms->hide = 0;
+                .quiet = dfa_user_quiet(dfa, state),
-        perms->prompt = 0;
+        };
-        perms->allow = dfa_user_allow(dfa, state);
-        perms->audit = dfa_user_audit(dfa, state);
-        perms->quiet = dfa_user_quiet(dfa, state);
        /* for v5 perm mapping in the policydb, the other set is used
         * to extend the general perm set
@@ -427,7 +423,6 @@ int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
                   void (*cb)(struct audit_buffer *, void *))
 {
        int type, error;
-        bool stop = false;
        u32 denied = request & (~perms->allow | perms->deny);
        if (likely(!denied)) {
@@ -448,8 +443,6 @@ int aa_check_perms(struct aa_profile *profile, struct aa_perms *perms,
                else
                        type = AUDIT_APPARMOR_DENIED;
-                if (denied & perms->stop)
-                        stop = true;
                if (denied == (denied & perms->hide))
                        error = -ENOENT;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 72b915dfcaf7..9a65eeaf7dfa 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -33,7 +33,6 @@
 #include "include/context.h"
 #include "include/file.h"
 #include "include/ipc.h"
-#include "include/net.h"
 #include "include/path.h"
 #include "include/label.h"
 #include "include/policy.h"
@@ -737,368 +736,6 @@ static int apparmor_task_kill(struct task_struct *target, struct siginfo *info,
        return error;
 }
-/**
- * apparmor_sk_alloc_security - allocate and attach the sk_security field
- */
-static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags)
-{
-        struct aa_sk_ctx *ctx;
-        ctx = kzalloc(sizeof(*ctx), flags);
-        if (!ctx)
-                return -ENOMEM;
-        SK_CTX(sk) = ctx;
-        return 0;
-}
-/**
- * apparmor_sk_free_security - free the sk_security field
- */
-static void apparmor_sk_free_security(struct sock *sk)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-        SK_CTX(sk) = NULL;
-        aa_put_label(ctx->label);
-        aa_put_label(ctx->peer);
-        path_put(&ctx->path);
-        kfree(ctx);
-}
-/**
- * apparmor_clone_security - clone the sk_security field
- */
-static void apparmor_sk_clone_security(const struct sock *sk,
-                                       struct sock *newsk)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-        struct aa_sk_ctx *new = SK_CTX(newsk);
-        new->label = aa_get_label(ctx->label);
-        new->peer = aa_get_label(ctx->peer);
-        new->path = ctx->path;
-        path_get(&new->path);
-}
-static int aa_sock_create_perm(struct aa_label *label, int family, int type,
-                               int protocol)
-{
-        AA_BUG(!label);
-        AA_BUG(in_interrupt());
-        return aa_af_perm(label, OP_CREATE, AA_MAY_CREATE, family, type,
-                          protocol);
-}
-/**
- * apparmor_socket_create - check perms before creating a new socket
- */
-static int apparmor_socket_create(int family, int type, int protocol, int kern)
-{
-        struct aa_label *label;
-        int error = 0;
-        label = begin_current_label_crit_section();
-        if (!(kern || unconfined(label)))
-                error = aa_sock_create_perm(label, family, type, protocol);
-        end_current_label_crit_section(label);
-        return error;
-}
-/**
- * apparmor_socket_post_create - setup the per-socket security struct
- *
- * Note:
- * -   kernel sockets currently labeled unconfined but we may want to
- *     move to a special kernel label
- * -   socket may not have sk here if created with sock_create_lite or
- *     sock_alloc. These should be accept cases which will be handled in
- *     sock_graft.
- */
-static int apparmor_socket_post_create(struct socket *sock, int family,
-                                       int type, int protocol, int kern)
-{
-        struct aa_label *label;
-        if (kern) {
-                struct aa_ns *ns = aa_get_current_ns();
-                label = aa_get_label(ns_unconfined(ns));
-                aa_put_ns(ns);
-        } else
-                label = aa_get_current_label();
-        if (sock->sk) {
-                struct aa_sk_ctx *ctx = SK_CTX(sock->sk);
-                aa_put_label(ctx->label);
-                ctx->label = aa_get_label(label);
-        }
-        aa_put_label(label);
-        return 0;
-}
-/**
- * apparmor_socket_bind - check perms before bind addr to socket
- */
-static int apparmor_socket_bind(struct socket *sock,
-                                struct sockaddr *address, int addrlen)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!address);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(OP_BIND, AA_MAY_BIND, sock->sk);
-}
-/**
- * apparmor_socket_connect - check perms before connecting @sock to @address
- */
-static int apparmor_socket_connect(struct socket *sock,
-                                   struct sockaddr *address, int addrlen)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!address);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
-}
-/**
- * apparmor_socket_list - check perms before allowing listen
- */
-static int apparmor_socket_listen(struct socket *sock, int backlog)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(OP_LISTEN, AA_MAY_LISTEN, sock->sk);
-}
-/**
- * apparmor_socket_accept - check perms before accepting a new connection.
- *
- * Note: while @newsock is created and has some information, the accept
- *       has not been done.
- */
-static int apparmor_socket_accept(struct socket *sock, struct socket *newsock)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!newsock);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(OP_ACCEPT, AA_MAY_ACCEPT, sock->sk);
-}
-static int aa_sock_msg_perm(const char *op, u32 request, struct socket *sock,
-                            struct msghdr *msg, int size)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(!msg);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(op, request, sock->sk);
-}
-/**
- * apparmor_socket_sendmsg - check perms before sending msg to another socket
- */
-static int apparmor_socket_sendmsg(struct socket *sock,
-                                   struct msghdr *msg, int size)
-{
-        return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
-}
-/**
- * apparmor_socket_recvmsg - check perms before receiving a message
- */
-static int apparmor_socket_recvmsg(struct socket *sock,
-                                   struct msghdr *msg, int size, int flags)
-{
-        return aa_sock_msg_perm(OP_RECVMSG, AA_MAY_RECEIVE, sock, msg, size);
-}
-/* revaliation, get/set attr, shutdown */
-static int aa_sock_perm(const char *op, u32 request, struct socket *sock)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(op, request, sock->sk);
-}
-/**
- * apparmor_socket_getsockname - check perms before getting the local address
- */
-static int apparmor_socket_getsockname(struct socket *sock)
-{
-        return aa_sock_perm(OP_GETSOCKNAME, AA_MAY_GETATTR, sock);
-}
-/**
- * apparmor_socket_getpeername - check perms before getting remote address
- */
-static int apparmor_socket_getpeername(struct socket *sock)
-{
-        return aa_sock_perm(OP_GETPEERNAME, AA_MAY_GETATTR, sock);
-}
-/* revaliation, get/set attr, opt */
-static int aa_sock_opt_perm(const char *op, u32 request, struct socket *sock,
-                            int level, int optname)
-{
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        AA_BUG(in_interrupt());
-        return aa_sk_perm(op, request, sock->sk);
-}
-/**
- * apparmor_getsockopt - check perms before getting socket options
- */
-static int apparmor_socket_getsockopt(struct socket *sock, int level,
-                                      int optname)
-{
-        return aa_sock_opt_perm(OP_GETSOCKOPT, AA_MAY_GETOPT, sock,
-                                level, optname);
-}
-/**
- * apparmor_setsockopt - check perms before setting socket options
- */
-static int apparmor_socket_setsockopt(struct socket *sock, int level,
-                                      int optname)
-{
-        return aa_sock_opt_perm(OP_SETSOCKOPT, AA_MAY_SETOPT, sock,
-                                level, optname);
-}
-/**
- * apparmor_socket_shutdown - check perms before shutting down @sock conn
- */
-static int apparmor_socket_shutdown(struct socket *sock, int how)
-{
-        return aa_sock_perm(OP_SHUTDOWN, AA_MAY_SHUTDOWN, sock);
-}
-/**
- * apparmor_socket_sock_recv_skb - check perms before associating skb to sk
- *
- * Note: can not sleep may be called with locks held
- *
- * dont want protocol specific in __skb_recv_datagram()
- * to deny an incoming connection  socket_sock_rcv_skb()
- */
-static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
-{
-        return 0;
-}
-static struct aa_label *sk_peer_label(struct sock *sk)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-        if (ctx->peer)
-                return ctx->peer;
-        return ERR_PTR(-ENOPROTOOPT);
-}
-/**
- * apparmor_socket_getpeersec_stream - get security context of peer
- *
- * Note: for tcp only valid if using ipsec or cipso on lan
- */
-static int apparmor_socket_getpeersec_stream(struct socket *sock,
-                                             char __user *optval,
-                                             int __user *optlen,
-                                             unsigned int len)
-{
-        char *name;
-        int slen, error = 0;
-        struct aa_label *label;
-        struct aa_label *peer;
-        label = begin_current_label_crit_section();
-        peer = sk_peer_label(sock->sk);
-        if (IS_ERR(peer)) {
-                error = PTR_ERR(peer);
-                goto done;
-        }
-        slen = aa_label_asxprint(&name, labels_ns(label), peer,
-                                 FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
-                                 FLAG_HIDDEN_UNCONFINED, GFP_KERNEL);
-        /* don't include terminating \0 in slen, it breaks some apps */
-        if (slen < 0) {
-                error = -ENOMEM;
-        } else {
-                if (slen > len) {
-                        error = -ERANGE;
-                } else if (copy_to_user(optval, name, slen)) {
-                        error = -EFAULT;
-                        goto out;
-                }
-                if (put_user(slen, optlen))
-                        error = -EFAULT;
-out:
-                kfree(name);
-        }
-done:
-        end_current_label_crit_section(label);
-        return error;
-}
-/**
- * apparmor_socket_getpeersec_dgram - get security label of packet
- * @sock: the peer socket
- * @skb: packet data
- * @secid: pointer to where to put the secid of the packet
- *
- * Sets the netlabel socket state on sk from parent
- */
-static int apparmor_socket_getpeersec_dgram(struct socket *sock,
-                                            struct sk_buff *skb, u32 *secid)
-{
-        /* TODO: requires secid support */
-        return -ENOPROTOOPT;
-}
-/**
- * apparmor_sock_graft - Initialize newly created socket
- * @sk: child sock
- * @parent: parent socket
- *
- * Note: could set off of SOCK_CTX(parent) but need to track inode and we can
- *       just set sk security information off of current creating process label
- *       Labeling of sk for accept case - probably should be sock based
- *       instead of task, because of the case where an implicitly labeled
- *       socket is shared by different tasks.
- */
-static void apparmor_sock_graft(struct sock *sk, struct socket *parent)
-{
-        struct aa_sk_ctx *ctx = SK_CTX(sk);
-        if (!ctx->label)
-                ctx->label = aa_get_current_label();
-}
 static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
        LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
@@ -1133,30 +770,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
        LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
-        LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security),
-        LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security),
-        LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security),
-        LSM_HOOK_INIT(socket_create, apparmor_socket_create),
-        LSM_HOOK_INIT(socket_post_create, apparmor_socket_post_create),
-        LSM_HOOK_INIT(socket_bind, apparmor_socket_bind),
-        LSM_HOOK_INIT(socket_connect, apparmor_socket_connect),
-        LSM_HOOK_INIT(socket_listen, apparmor_socket_listen),
-        LSM_HOOK_INIT(socket_accept, apparmor_socket_accept),
-        LSM_HOOK_INIT(socket_sendmsg, apparmor_socket_sendmsg),
-        LSM_HOOK_INIT(socket_recvmsg, apparmor_socket_recvmsg),
-        LSM_HOOK_INIT(socket_getsockname, apparmor_socket_getsockname),
-        LSM_HOOK_INIT(socket_getpeername, apparmor_socket_getpeername),
-        LSM_HOOK_INIT(socket_getsockopt, apparmor_socket_getsockopt),
-        LSM_HOOK_INIT(socket_setsockopt, apparmor_socket_setsockopt),
-        LSM_HOOK_INIT(socket_shutdown, apparmor_socket_shutdown),
-        LSM_HOOK_INIT(socket_sock_rcv_skb, apparmor_socket_sock_rcv_skb),
-        LSM_HOOK_INIT(socket_getpeersec_stream,
-                      apparmor_socket_getpeersec_stream),
-        LSM_HOOK_INIT(socket_getpeersec_dgram,
-                      apparmor_socket_getpeersec_dgram),
-        LSM_HOOK_INIT(sock_graft, apparmor_sock_graft),
        LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
        LSM_HOOK_INIT(cred_free, apparmor_cred_free),
        LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
@@ -1200,11 +813,11 @@ static const struct kernel_param_ops param_ops_aalockpolicy = {
        .get = param_get_aalockpolicy
 };
-static int param_set_audit(const char *val, struct kernel_param *kp);
+static int param_set_audit(const char *val, const struct kernel_param *kp);
-static int param_get_audit(char *buffer, struct kernel_param *kp);
+static int param_get_audit(char *buffer, const struct kernel_param *kp);
-static int param_set_mode(const char *val, struct kernel_param *kp);
+static int param_set_mode(const char *val, const struct kernel_param *kp);
-static int param_get_mode(char *buffer, struct kernel_param *kp);
+static int param_get_mode(char *buffer, const struct kernel_param *kp);
 /* Flag values, also controllable via /sys/module/apparmor/parameters
 * We define special types as we want to do additional mediation.
@@ -1233,7 +846,7 @@ module_param_call(audit, param_set_audit, param_get_audit,
 /* Determines if audit header is included in audited messages.  This
 * provides more context if the audit daemon is not running
 */
-bool aa_g_audit_header = 1;
+bool aa_g_audit_header = true;
 module_param_named(audit_header, aa_g_audit_header, aabool,
                   S_IRUSR | S_IWUSR);
@@ -1258,7 +871,7 @@ module_param_named(path_max, aa_g_path_max, aauint, S_IRUSR);
 * DEPRECATED: read only as strict checking of load is always done now
 * that none root users (user namespaces) can load policy.
 */
-bool aa_g_paranoid_load = 1;
+bool aa_g_paranoid_load = true;
 module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
 /* Boot time disable flag */
@@ -1338,7 +951,7 @@ static int param_get_aauint(char *buffer, const struct kernel_param *kp)
        return param_get_uint(buffer, kp);
 }
-static int param_get_audit(char *buffer, struct kernel_param *kp)
+static int param_get_audit(char *buffer, const struct kernel_param *kp)
 {
        if (!apparmor_enabled)
                return -EINVAL;
@@ -1347,7 +960,7 @@ static int param_get_audit(char *buffer, struct kernel_param *kp)
        return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
 }
-static int param_set_audit(const char *val, struct kernel_param *kp)
+static int param_set_audit(const char *val, const struct kernel_param *kp)
 {
        int i;
@@ -1368,7 +981,7 @@ static int param_set_audit(const char *val, struct kernel_param *kp)
        return -EINVAL;
 }
-static int param_get_mode(char *buffer, struct kernel_param *kp)
+static int param_get_mode(char *buffer, const struct kernel_param *kp)
 {
        if (!apparmor_enabled)
                return -EINVAL;
@@ -1378,7 +991,7 @@ static int param_get_mode(char *buffer, struct kernel_param *kp)
        return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
 }
-static int param_set_mode(const char *val, struct kernel_param *kp)
+static int param_set_mode(const char *val, const struct kernel_param *kp)
 {
        int i;
@@ -1506,7 +1119,7 @@ static int __init apparmor_init(void)
        if (!apparmor_enabled || !security_module_enable("apparmor")) {
                aa_info_message("AppArmor disabled by boot time parameter");
-                apparmor_enabled = 0;
+                apparmor_enabled = false;
                return 0;
        }
@@ -1562,7 +1175,7 @@ alloc_out:
        aa_destroy_aafs();
        aa_teardown_dfa_engine();
-        apparmor_enabled = 0;
+        apparmor_enabled = false;
        return error;
 }
diff --git a/security/apparmor/mount.c b/security/apparmor/mount.c
index 82a64b58041d..ed9b4d0f9f7e 100644
--- a/security/apparmor/mount.c
+++ b/security/apparmor/mount.c
@@ -216,13 +216,12 @@ static unsigned int match_mnt_flags(struct aa_dfa *dfa, unsigned int state,
 static struct aa_perms compute_mnt_perms(struct aa_dfa *dfa,
                                           unsigned int state)
 {
-        struct aa_perms perms;
+        struct aa_perms perms = {
+                .allow = dfa_user_allow(dfa, state),
-        perms.kill = 0;
+                .audit = dfa_user_audit(dfa, state),
-        perms.allow = dfa_user_allow(dfa, state);
+                .quiet = dfa_user_quiet(dfa, state),
-        perms.audit = dfa_user_audit(dfa, state);
+                .xindex = dfa_user_xindex(dfa, state),
-        perms.quiet = dfa_user_quiet(dfa, state);
+        };
-        perms.xindex = dfa_user_xindex(dfa, state);
        return perms;
 }
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
deleted file mode 100644
index 33d54435f8d6..000000000000
--- a/security/apparmor/net.c
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * AppArmor security module
- *
- * This file contains AppArmor network mediation
- *
- * Copyright (C) 1998-2008 Novell/SUSE
- * Copyright 2009-2017 Canonical Ltd.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation, version 2 of the
- * License.
- */
-#include "include/apparmor.h"
-#include "include/audit.h"
-#include "include/context.h"
-#include "include/label.h"
-#include "include/net.h"
-#include "include/policy.h"
-#include "net_names.h"
-struct aa_sfs_entry aa_sfs_entry_network[] = {
-        AA_SFS_FILE_STRING("af_mask",   AA_SFS_AF_MASK),
-        { }
-};
-static const char * const net_mask_names[] = {
-        "unknown",
-        "send",
-        "receive",
-        "unknown",
-        "create",
-        "shutdown",
-        "connect",
-        "unknown",
-        "setattr",
-        "getattr",
-        "setcred",
-        "getcred",
-        "chmod",
-        "chown",
-        "chgrp",
-        "lock",
-        "mmap",
-        "mprot",
-        "unknown",
-        "unknown",
-        "accept",
-        "bind",
-        "listen",
-        "unknown",
-        "setopt",
-        "getopt",
-        "unknown",
-        "unknown",
-        "unknown",
-        "unknown",
-        "unknown",
-        "unknown",
-};
-/* audit callback for net specific fields */
-void audit_net_cb(struct audit_buffer *ab, void *va)
-{
-        struct common_audit_data *sa = va;
-        audit_log_format(ab, " family=");
-        if (address_family_names[sa->u.net->family])
-                audit_log_string(ab, address_family_names[sa->u.net->family]);
-        else
-                audit_log_format(ab, "\"unknown(%d)\"", sa->u.net->family);
-        audit_log_format(ab, " sock_type=");
-        if (sock_type_names[aad(sa)->net.type])
-                audit_log_string(ab, sock_type_names[aad(sa)->net.type]);
-        else
-                audit_log_format(ab, "\"unknown(%d)\"", aad(sa)->net.type);
-        audit_log_format(ab, " protocol=%d", aad(sa)->net.protocol);
-        if (aad(sa)->request & NET_PERMS_MASK) {
-                audit_log_format(ab, " requested_mask=");
-                aa_audit_perm_mask(ab, aad(sa)->request, NULL, 0,
-                                   net_mask_names, NET_PERMS_MASK);
-                if (aad(sa)->denied & NET_PERMS_MASK) {
-                        audit_log_format(ab, " denied_mask=");
-                        aa_audit_perm_mask(ab, aad(sa)->denied, NULL, 0,
-                                           net_mask_names, NET_PERMS_MASK);
-                }
-        }
-        if (aad(sa)->peer) {
-                audit_log_format(ab, " peer=");
-                aa_label_xaudit(ab, labels_ns(aad(sa)->label), aad(sa)->peer,
-                                FLAGS_NONE, GFP_ATOMIC);
-        }
-}
-/* Generic af perm */
-int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
-                       u32 request, u16 family, int type)
-{
-        struct aa_perms perms = { };
-        AA_BUG(family >= AF_MAX);
-        AA_BUG(type < 0 || type >= SOCK_MAX);
-        if (profile_unconfined(profile))
-                return 0;
-        perms.allow = (profile->net.allow[family] & (1 << type)) ?
-                ALL_PERMS_MASK : 0;
-        perms.audit = (profile->net.audit[family] & (1 << type)) ?
-                ALL_PERMS_MASK : 0;
-        perms.quiet = (profile->net.quiet[family] & (1 << type)) ?
-                ALL_PERMS_MASK : 0;
-        aa_apply_modes_to_perms(profile, &perms);
-        return aa_check_perms(profile, &perms, request, sa, audit_net_cb);
-}
-int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
-               int type, int protocol)
-{
-        struct aa_profile *profile;
-        DEFINE_AUDIT_NET(sa, op, NULL, family, type, protocol);
-        return fn_for_each_confined(label, profile,
-                        aa_profile_af_perm(profile, &sa, request, family,
-                                           type));
-}
-static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
-                            struct sock *sk)
-{
-        struct aa_profile *profile;
-        DEFINE_AUDIT_SK(sa, op, sk);
-        AA_BUG(!label);
-        AA_BUG(!sk);
-        if (unconfined(label))
-                return 0;
-        return fn_for_each_confined(label, profile,
-                        aa_profile_af_sk_perm(profile, &sa, request, sk));
-}
-int aa_sk_perm(const char *op, u32 request, struct sock *sk)
-{
-        struct aa_label *label;
-        int error;
-        AA_BUG(!sk);
-        AA_BUG(in_interrupt());
-        /* TODO: switch to begin_current_label ???? */
-        label = begin_current_label_crit_section();
-        error = aa_label_sk_perm(label, op, request, sk);
-        end_current_label_crit_section(label);
-        return error;
-}
-int aa_sock_file_perm(struct aa_label *label, const char *op, u32 request,
-                      struct socket *sock)
-{
-        AA_BUG(!label);
-        AA_BUG(!sock);
-        AA_BUG(!sock->sk);
-        return aa_label_sk_perm(label, op, request, sock->sk);
-}
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 4243b0c3f0e4..b0b58848c248 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -502,7 +502,7 @@ struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
 {
        struct aa_profile *p, *profile;
        const char *bname;
-        char *name;
+        char *name = NULL;
        AA_BUG(!parent);
@@ -545,7 +545,7 @@ name:
        profile->file.dfa = aa_get_dfa(nulldfa);
        profile->policy.dfa = aa_get_dfa(nulldfa);
-        mutex_lock(&profile->ns->lock);
+        mutex_lock_nested(&profile->ns->lock, profile->ns->level);
        p = __find_child(&parent->base.profiles, bname);
        if (p) {
                aa_free_profile(profile);
@@ -562,6 +562,7 @@ out:
        return profile;
 fail:
+        kfree(name);
        aa_free_profile(profile);
        return NULL;
 }
@@ -905,7 +906,7 @@ ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
        } else
                ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(label));
-        mutex_lock(&ns->lock);
+        mutex_lock_nested(&ns->lock, ns->level);
        /* check for duplicate rawdata blobs: space and file dedup */
        list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) {
                if (aa_rawdata_eq(rawdata_ent, udata)) {
@@ -1116,13 +1117,13 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
        if (!name) {
                /* remove namespace - can only happen if fqname[0] == ':' */
-                mutex_lock(&ns->parent->lock);
+                mutex_lock_nested(&ns->parent->lock, ns->level);
                __aa_remove_ns(ns);
                __aa_bump_ns_revision(ns);
                mutex_unlock(&ns->parent->lock);
        } else {
                /* remove profile */
-                mutex_lock(&ns->lock);
+                mutex_lock_nested(&ns->lock, ns->level);
                profile = aa_get_profile(__lookup_profile(&ns->base, name));
                if (!profile) {
                        error = -ENOENT;
diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c
index 62a3589c62ab..b1e629cba70b 100644
--- a/security/apparmor/policy_ns.c
+++ b/security/apparmor/policy_ns.c
@@ -256,7 +256,8 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name,
        ns = alloc_ns(parent->base.hname, name);
        if (!ns)
                return NULL;
-        mutex_lock(&ns->lock);
+        ns->level = parent->level + 1;
+        mutex_lock_nested(&ns->lock, ns->level);
        error = __aafs_ns_mkdir(ns, ns_subns_dir(parent), name, dir);
        if (error) {
                AA_ERROR("Failed to create interface for ns %s\n",
@@ -266,7 +267,6 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name,
                return ERR_PTR(error);
        }
        ns->parent = aa_get_ns(parent);
-        ns->level = parent->level + 1;
        list_add_rcu(&ns->base.list, &parent->sub_ns);
        /* add list ref */
        aa_get_ns(ns);
@@ -313,7 +313,7 @@ struct aa_ns *aa_prepare_ns(struct aa_ns *parent, const char *name)
 {
        struct aa_ns *ns;
-        mutex_lock(&parent->lock);
+        mutex_lock_nested(&parent->lock, parent->level);
        /* try and find the specified ns and if it doesn't exist create it */
        /* released by caller */
        ns = aa_get_ns(__aa_find_ns(&parent->sub_ns, name));
@@ -336,7 +336,7 @@ static void destroy_ns(struct aa_ns *ns)
        if (!ns)
                return;
-        mutex_lock(&ns->lock);
+        mutex_lock_nested(&ns->lock, ns->level);
        /* release all profiles in this namespace */
        __aa_profile_list_release(&ns->base.profiles);
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 5a2aec358322..59a1a25b7d43 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -157,7 +157,7 @@ static void do_loaddata_free(struct work_struct *work)
        struct aa_ns *ns = aa_get_ns(d->ns);
        if (ns) {
-                mutex_lock(&ns->lock);
+                mutex_lock_nested(&ns->lock, ns->level);
                __aa_fs_remove_rawdata(d);
                mutex_unlock(&ns->lock);
                aa_put_ns(ns);
@@ -275,19 +275,6 @@ fail:
        return 0;
 }
-static bool unpack_u16(struct aa_ext *e, u16 *data, const char *name)
-{
-        if (unpack_nameX(e, AA_U16, name)) {
-                if (!inbounds(e, sizeof(u16)))
-                        return 0;
-                if (data)
-                        *data = le16_to_cpu(get_unaligned((__le16 *) e->pos));
-                e->pos += sizeof(u16);
-                return 1;
-        }
-        return 0;
-}
 static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
 {
        if (unpack_nameX(e, AA_U32, name)) {
@@ -597,7 +584,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
        struct aa_profile *profile = NULL;
        const char *tmpname, *tmpns = NULL, *name = NULL;
        const char *info = "failed to unpack profile";
-        size_t size = 0, ns_len;
+        size_t ns_len;
        struct rhashtable_params params = { 0 };
        char *key = NULL;
        struct aa_data *data;
@@ -730,38 +717,6 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
                goto fail;
        }
-        size = unpack_array(e, "net_allowed_af");
-        if (size) {
-                for (i = 0; i < size; i++) {
-                        /* discard extraneous rules that this kernel will
-                         * never request
-                         */
-                        if (i >= AF_MAX) {
-                                u16 tmp;
-                                if (!unpack_u16(e, &tmp, NULL) ||
-                                    !unpack_u16(e, &tmp, NULL) ||
-                                    !unpack_u16(e, &tmp, NULL))
-                                        goto fail;
-                                continue;
-                        }
-                        if (!unpack_u16(e, &profile->net.allow[i], NULL))
-                                goto fail;
-                        if (!unpack_u16(e, &profile->net.audit[i], NULL))
-                                goto fail;
-                        if (!unpack_u16(e, &profile->net.quiet[i], NULL))
-                                goto fail;
-                }
-                if (!unpack_nameX(e, AA_ARRAYEND, NULL))
-                        goto fail;
-        }
-        if (VERSION_LT(e->version, v7)) {
-                /* pre v7 policy always allowed these */
-                profile->net.allow[AF_UNIX] = 0xffff;
-                profile->net.allow[AF_NETLINK] = 0xffff;
-        }
        if (unpack_nameX(e, AA_STRUCT, "policydb")) {
                /* generic policy dfa - optional and may be NULL */
                info = "failed to unpack policydb";
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
index d8bc842594ed..cf4d234febe9 100644
--- a/security/apparmor/resource.c
+++ b/security/apparmor/resource.c
@@ -47,7 +47,7 @@ static void audit_cb(struct audit_buffer *ab, void *va)
 /**
 * audit_resource - audit setting resource limit
 * @profile: profile being enforced  (NOT NULL)
- * @resoure: rlimit being auditing
+ * @resource: rlimit being auditing
 * @value: value being set
 * @error: error value
 *
@@ -128,7 +128,7 @@ int aa_task_setrlimit(struct aa_label *label, struct task_struct *task,
                error = fn_for_each(label, profile,
                                audit_resource(profile, resource,
                                               new_rlim->rlim_max, peer,
-                                               "cap_sys_resoure", -EACCES));
+                                               "cap_sys_resource", -EACCES));
        else
                error = fn_for_each_confined(label, profile,
                                profile_setrlimit(profile, resource, new_rlim));
diff --git a/security/commoncap.c b/security/commoncap.c
index 5fa839c7fb3f..4f8e09340956 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -585,13 +585,14 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
        struct vfs_ns_cap_data data, *nscaps = &data;
        struct vfs_cap_data *caps = (struct vfs_cap_data *) &data;
        kuid_t rootkuid;
-        struct user_namespace *fs_ns = inode->i_sb->s_user_ns;
+        struct user_namespace *fs_ns;
        memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
        if (!inode)
                return -ENODATA;
+        fs_ns = inode->i_sb->s_user_ns;
        size = __vfs_getxattr((struct dentry *)dentry, inode,
                              XATTR_NAME_CAPS, &data, XATTR_CAPS_SZ);
        if (size == -ENODATA || size == -EOPNOTSUPP)
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 03c1652c9a1f..c65b39bafdfe 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * device_cgroup.c - device cgroup subsystem
 *
@@ -14,15 +15,6 @@
 #include <linux/rcupdate.h>
 #include <linux/mutex.h>
-#define ACC_MKNOD 1
-#define ACC_READ  2
-#define ACC_WRITE 4
-#define ACC_MASK (ACC_MKNOD | ACC_READ | ACC_WRITE)
-#define DEV_BLOCK 1
-#define DEV_CHAR  2
-#define DEV_ALL   4  /* this represents all devices */
 static DEFINE_MUTEX(devcgroup_mutex);
 enum devcg_behavior {
@@ -245,21 +237,21 @@ static void set_access(char *acc, short access)
 {
        int idx = 0;
        memset(acc, 0, ACCLEN);
-        if (access & ACC_READ)
+        if (access & DEVCG_ACC_READ)
                acc[idx++] = 'r';
-        if (access & ACC_WRITE)
+        if (access & DEVCG_ACC_WRITE)
                acc[idx++] = 'w';
-        if (access & ACC_MKNOD)
+        if (access & DEVCG_ACC_MKNOD)
                acc[idx++] = 'm';
 }
 static char type_to_char(short type)
 {
-        if (type == DEV_ALL)
+        if (type == DEVCG_DEV_ALL)
                return 'a';
-        if (type == DEV_CHAR)
+        if (type == DEVCG_DEV_CHAR)
                return 'c';
-        if (type == DEV_BLOCK)
+        if (type == DEVCG_DEV_BLOCK)
                return 'b';
        return 'X';
 }
@@ -286,10 +278,10 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
         * This way, the file remains as a "whitelist of devices"
         */
        if (devcgroup->behavior == DEVCG_DEFAULT_ALLOW) {
-                set_access(acc, ACC_MASK);
+                set_access(acc, DEVCG_ACC_MASK);
                set_majmin(maj, ~0);
                set_majmin(min, ~0);
-                seq_printf(m, "%c %s:%s %s\n", type_to_char(DEV_ALL),
+                seq_printf(m, "%c %s:%s %s\n", type_to_char(DEVCG_DEV_ALL),
                           maj, min, acc);
        } else {
                list_for_each_entry_rcu(ex, &devcgroup->exceptions, list) {
@@ -308,10 +300,10 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
 /**
 * match_exception      - iterates the exception list trying to find a complete match
 * @exceptions: list of exceptions
- * @type: device type (DEV_BLOCK or DEV_CHAR)
+ * @type: device type (DEVCG_DEV_BLOCK or DEVCG_DEV_CHAR)
 * @major: device file major number, ~0 to match all
 * @minor: device file minor number, ~0 to match all
- * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
+ * @access: permission mask (DEVCG_ACC_READ, DEVCG_ACC_WRITE, DEVCG_ACC_MKNOD)
 *
 * It is considered a complete match if an exception is found that will
 * contain the entire range of provided parameters.
@@ -324,9 +316,9 @@ static bool match_exception(struct list_head *exceptions, short type,
        struct dev_exception_item *ex;
        list_for_each_entry_rcu(ex, exceptions, list) {
-                if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
+                if ((type & DEVCG_DEV_BLOCK) && !(ex->type & DEVCG_DEV_BLOCK))
                        continue;
-                if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
+                if ((type & DEVCG_DEV_CHAR) && !(ex->type & DEVCG_DEV_CHAR))
                        continue;
                if (ex->major != ~0 && ex->major != major)
                        continue;
@@ -343,10 +335,10 @@ static bool match_exception(struct list_head *exceptions, short type,
 /**
 * match_exception_partial - iterates the exception list trying to find a partial match
 * @exceptions: list of exceptions
- * @type: device type (DEV_BLOCK or DEV_CHAR)
+ * @type: device type (DEVCG_DEV_BLOCK or DEVCG_DEV_CHAR)
 * @major: device file major number, ~0 to match all
 * @minor: device file minor number, ~0 to match all
- * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
+ * @access: permission mask (DEVCG_ACC_READ, DEVCG_ACC_WRITE, DEVCG_ACC_MKNOD)
 *
 * It is considered a partial match if an exception's range is found to
 * contain *any* of the devices specified by provided parameters. This is
@@ -361,9 +353,9 @@ static bool match_exception_partial(struct list_head *exceptions, short type,
        struct dev_exception_item *ex;
        list_for_each_entry_rcu(ex, exceptions, list) {
-                if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
+                if ((type & DEVCG_DEV_BLOCK) && !(ex->type & DEVCG_DEV_BLOCK))
                        continue;
-                if ((type & DEV_CHAR) && !(ex->type & DEV_CHAR))
+                if ((type & DEVCG_DEV_CHAR) && !(ex->type & DEVCG_DEV_CHAR))
                        continue;
                /*
                 * We must be sure that both the exception and the provided
@@ -646,10 +638,10 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                }
                return 0;
        case 'b':
-                ex.type = DEV_BLOCK;
+                ex.type = DEVCG_DEV_BLOCK;
                break;
        case 'c':
-                ex.type = DEV_CHAR;
+                ex.type = DEVCG_DEV_CHAR;
                break;
        default:
                return -EINVAL;
@@ -702,13 +694,13 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
        for (b++, count = 0; count < 3; count++, b++) {
                switch (*b) {
                case 'r':
-                        ex.access |= ACC_READ;
+                        ex.access |= DEVCG_ACC_READ;
                        break;
                case 'w':
-                        ex.access |= ACC_WRITE;
+                        ex.access |= DEVCG_ACC_WRITE;
                        break;
                case 'm':
-                        ex.access |= ACC_MKNOD;
+                        ex.access |= DEVCG_ACC_MKNOD;
                        break;
                case '\n':
                case '\0':
@@ -805,12 +797,12 @@ struct cgroup_subsys devices_cgrp_subsys = {
 * @type: device type
 * @major: device major number
 * @minor: device minor number
- * @access: combination of ACC_WRITE, ACC_READ and ACC_MKNOD
+ * @access: combination of DEVCG_ACC_WRITE, DEVCG_ACC_READ and DEVCG_ACC_MKNOD
 *
 * returns 0 on success, -EPERM case the operation is not permitted
 */
-static int __devcgroup_check_permission(short type, u32 major, u32 minor,
+int __devcgroup_check_permission(short type, u32 major, u32 minor,
-                                        short access)
+                                 short access)
 {
        struct dev_cgroup *dev_cgroup;
        bool rc;
@@ -832,37 +824,3 @@ static int __devcgroup_check_permission(short type, u32 major, u32 minor,
        return 0;
 }
-int __devcgroup_inode_permission(struct inode *inode, int mask)
-{
-        short type, access = 0;
-        if (S_ISBLK(inode->i_mode))
-                type = DEV_BLOCK;
-        if (S_ISCHR(inode->i_mode))
-                type = DEV_CHAR;
-        if (mask & MAY_WRITE)
-                access |= ACC_WRITE;
-        if (mask & MAY_READ)
-                access |= ACC_READ;
-        return __devcgroup_check_permission(type, imajor(inode), iminor(inode),
-                        access);
-}
-int devcgroup_inode_mknod(int mode, dev_t dev)
-{
-        short type;
-        if (!S_ISBLK(mode) && !S_ISCHR(mode))
-                return 0;
-        if (S_ISBLK(mode))
-                type = DEV_BLOCK;
-        else
-                type = DEV_CHAR;
-        return __devcgroup_check_permission(type, MAJOR(dev), MINOR(dev),
-                        ACC_MKNOD);
-}
diff --git a/security/integrity/Makefile b/security/integrity/Makefile
index 8d1f4bf51087..04d6e462b079 100644
--- a/security/integrity/Makefile
+++ b/security/integrity/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for caching inode integrity data (iint)
 #
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 06554c448dce..6f9e4ce568cd 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -112,21 +112,25 @@ int __init integrity_init_keyring(const unsigned int id)
 int __init integrity_load_x509(const unsigned int id, const char *path)
 {
        key_ref_t key;
-        char *data;
+        void *data;
+        loff_t size;
        int rc;
        if (!keyring[id])
                return -EINVAL;
-        rc = integrity_read_file(path, &data);
+        rc = kernel_read_file_from_path(path, &data, &size, 0,
-        if (rc < 0)
+                                        READING_X509_CERTIFICATE);
+        if (rc < 0) {
+                pr_err("Unable to open file: %s (%d)", path, rc);
                return rc;
+        }
        key = key_create_or_update(make_key_ref(keyring[id], 1),
                                   "asymmetric",
                                   NULL,
                                   data,
-                                   rc,
+                                   size,
                                   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
                                    KEY_USR_VIEW | KEY_USR_READ),
                                   KEY_ALLOC_NOT_IN_QUOTA);
@@ -139,6 +143,6 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
                          key_ref_to_ptr(key)->description, path);
                key_ref_put(key);
        }
-        kfree(data);
+        vfree(data);
        return 0;
 }
diff --git a/security/integrity/evm/evm.h b/security/integrity/evm/evm.h
index f5f12727771a..241aca315b0c 100644
--- a/security/integrity/evm/evm.h
+++ b/security/integrity/evm/evm.h
@@ -23,6 +23,9 @@
 #define EVM_INIT_HMAC   0x0001
 #define EVM_INIT_X509   0x0002
+#define EVM_SETUP       0x80000000 /* userland has signaled key load */
+#define EVM_INIT_MASK (EVM_INIT_HMAC | EVM_INIT_X509 | EVM_SETUP)
 extern int evm_initialized;
 extern char *evm_hmac;
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 1d32cd20009a..bcd64baf8788 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -80,7 +80,7 @@ static struct shash_desc *init_desc(char type)
        if (type == EVM_XATTR_HMAC) {
                if (!(evm_initialized & EVM_INIT_HMAC)) {
-                        pr_err("HMAC key is not set\n");
+                        pr_err_once("HMAC key is not set\n");
                        return ERR_PTR(-ENOKEY);
                }
                tfm = &hmac_tfm;
diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 063d38aef64e..9826c02e2db8 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -49,6 +49,9 @@ char *evm_config_xattrnames[] = {
        XATTR_NAME_SMACKMMAP,
 #endif
 #endif
+#ifdef CONFIG_SECURITY_APPARMOR
+        XATTR_NAME_APPARMOR,
+#endif
 #ifdef CONFIG_IMA_APPRAISE
        XATTR_NAME_IMA,
 #endif
diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c
index c8dccd54d501..319cf16d6603 100644
--- a/security/integrity/evm/evm_secfs.c
+++ b/security/integrity/evm/evm_secfs.c
@@ -40,7 +40,7 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf,
        if (*ppos != 0)
                return 0;
-        sprintf(temp, "%d", evm_initialized);
+        sprintf(temp, "%d", (evm_initialized & ~EVM_SETUP));
        rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
        return rc;
@@ -61,24 +61,29 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf,
 static ssize_t evm_write_key(struct file *file, const char __user *buf,
                             size_t count, loff_t *ppos)
 {
-        char temp[80];
+        int i, ret;
-        int i;
-        if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_INIT_HMAC))
+        if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP))
                return -EPERM;
-        if (count >= sizeof(temp) || count == 0)
+        ret = kstrtoint_from_user(buf, count, 0, &i);
-                return -EINVAL;
-        if (copy_from_user(temp, buf, count) != 0)
-                return -EFAULT;
-        temp[count] = '\0';
+        if (ret)
+                return ret;
-        if ((sscanf(temp, "%d", &i) != 1) || (i != 1))
+        /* Reject invalid values */
+        if (!i || (i & ~EVM_INIT_MASK) != 0)
                return -EINVAL;
-        evm_init_key();
+        if (i & EVM_INIT_HMAC) {
+                ret = evm_init_key();
+                if (ret != 0)
+                        return ret;
+                /* Forbid further writes after the symmetric key is loaded */
+                i |= EVM_SETUP;
+        }
+        evm_initialized |= i;
        return count;
 }
diff --git a/security/integrity/iint.c b/security/integrity/iint.c
index 6fc888ca468e..c84e05866052 100644
--- a/security/integrity/iint.c
+++ b/security/integrity/iint.c
@@ -200,55 +200,6 @@ int integrity_kernel_read(struct file *file, loff_t offset,
 }
 /*
- * integrity_read_file - read entire file content into the buffer
- *
- * This is function opens a file, allocates the buffer of required
- * size, read entire file content to the buffer and closes the file
- *
- * It is used only by init code.
- *
- */
-int __init integrity_read_file(const char *path, char **data)
-{
-        struct file *file;
-        loff_t size;
-        char *buf;
-        int rc = -EINVAL;
-        if (!path || !*path)
-                return -EINVAL;
-        file = filp_open(path, O_RDONLY, 0);
-        if (IS_ERR(file)) {
-                rc = PTR_ERR(file);
-                pr_err("Unable to open file: %s (%d)", path, rc);
-                return rc;
-        }
-        size = i_size_read(file_inode(file));
-        if (size <= 0)
-                goto out;
-        buf = kmalloc(size, GFP_KERNEL);
-        if (!buf) {
-                rc = -ENOMEM;
-                goto out;
-        }
-        rc = integrity_kernel_read(file, 0, buf, size);
-        if (rc == size) {
-                *data = buf;
-        } else {
-                kfree(buf);
-                if (rc >= 0)
-                        rc = -EIO;
-        }
-out:
-        fput(file);
-        return rc;
-}
-/*
 * integrity_load_keys - load integrity keys hook
 *
 * Hooks is called from init/main.c:kernel_init_freeable()
diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile
index 29f198bde02b..d921dc4f9eb0 100644
--- a/security/integrity/ima/Makefile
+++ b/security/integrity/ima/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for building Trusted Computing Group's(TCG) runtime Integrity
 # Measurement Architecture(IMA).
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index c2edba8de35e..c7e8db0ea4c0 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -199,42 +199,59 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
        struct inode *inode = file_inode(file);
        const char *filename = file->f_path.dentry->d_name.name;
        int result = 0;
+        int length;
+        void *tmpbuf;
+        u64 i_version;
        struct {
                struct ima_digest_data hdr;
                char digest[IMA_MAX_DIGEST_SIZE];
        } hash;
-        if (!(iint->flags & IMA_COLLECTED)) {
+        if (iint->flags & IMA_COLLECTED)
-                u64 i_version = file_inode(file)->i_version;
+                goto out;
-                if (file->f_flags & O_DIRECT) {
+        /*
-                        audit_cause = "failed(directio)";
+         * Dectecting file change is based on i_version. On filesystems
-                        result = -EACCES;
+         * which do not support i_version, support is limited to an initial
-                        goto out;
+         * measurement/appraisal/audit.
-                }
+         */
+        i_version = file_inode(file)->i_version;
+        hash.hdr.algo = algo;
-                hash.hdr.algo = algo;
+        /* Initialize hash digest to 0's in case of failure */
+        memset(&hash.digest, 0, sizeof(hash.digest));
-                result = (!buf) ?  ima_calc_file_hash(file, &hash.hdr) :
-                        ima_calc_buffer_hash(buf, size, &hash.hdr);
+        if (buf)
-                if (!result) {
+                result = ima_calc_buffer_hash(buf, size, &hash.hdr);
-                        int length = sizeof(hash.hdr) + hash.hdr.length;
+        else
-                        void *tmpbuf = krealloc(iint->ima_hash, length,
+                result = ima_calc_file_hash(file, &hash.hdr);
-                                                GFP_NOFS);
-                        if (tmpbuf) {
+        if (result && result != -EBADF && result != -EINVAL)
-                                iint->ima_hash = tmpbuf;
+                goto out;
-                                memcpy(iint->ima_hash, &hash, length);
-                                iint->version = i_version;
+        length = sizeof(hash.hdr) + hash.hdr.length;
-                                iint->flags |= IMA_COLLECTED;
+        tmpbuf = krealloc(iint->ima_hash, length, GFP_NOFS);
-                        } else
+        if (!tmpbuf) {
-                                result = -ENOMEM;
+                result = -ENOMEM;
-                }
+                goto out;
        }
+        iint->ima_hash = tmpbuf;
+        memcpy(iint->ima_hash, &hash, length);
+        iint->version = i_version;
+        /* Possibly temporary failure due to type of read (eg. O_DIRECT) */
+        if (!result)
+                iint->flags |= IMA_COLLECTED;
 out:
-        if (result)
+        if (result) {
+                if (file->f_flags & O_DIRECT)
+                        audit_cause = "failed(directio)";
                integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
                                    filename, "collect_data", audit_cause,
                                    result, 0);
+        }
        return result;
 }
@@ -278,7 +295,7 @@ void ima_store_measurement(struct integrity_iint_cache *iint,
        }
        result = ima_store_template(entry, violation, inode, filename, pcr);
-        if (!result || result == -EEXIST) {
+        if ((!result || result == -EEXIST) && !(file->f_flags & O_DIRECT)) {
                iint->flags |= IMA_MEASURED;
                iint->measured_pcrs |= (0x1 << pcr);
        }
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 809ba70fbbbf..65fbcf3c32c7 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -40,7 +40,7 @@ __setup("ima_appraise=", default_appraise_setup);
 */
 bool is_ima_appraise_enabled(void)
 {
-        return (ima_appraise & IMA_APPRAISE_ENFORCE) ? 1 : 0;
+        return ima_appraise & IMA_APPRAISE_ENFORCE;
 }
 /*
@@ -320,6 +320,9 @@ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
        if (iint->flags & IMA_DIGSIG)
                return;
+        if (iint->ima_file_status != INTEGRITY_PASS)
+                return;
        rc = ima_collect_measurement(iint, file, NULL, 0, ima_hash_algo);
        if (rc < 0)
                return;
@@ -405,7 +408,7 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
                if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
                        return -EINVAL;
                ima_reset_appraise_flags(d_backing_inode(dentry),
-                         (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
+                        xvalue->type == EVM_IMA_XATTR_DIGSIG);
                result = 0;
        }
        return result;
diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 802d5d20f36f..9057b163c378 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -27,11 +27,6 @@
 #include "ima.h"
-struct ahash_completion {
-        struct completion completion;
-        int err;
-};
 /* minimum file size for ahash use */
 static unsigned long ima_ahash_minsize;
 module_param_named(ahash_minsize, ima_ahash_minsize, ulong, 0644);
@@ -196,30 +191,13 @@ static void ima_free_atfm(struct crypto_ahash *tfm)
                crypto_free_ahash(tfm);
 }
-static void ahash_complete(struct crypto_async_request *req, int err)
+static inline int ahash_wait(int err, struct crypto_wait *wait)
 {
-        struct ahash_completion *res = req->data;
-        if (err == -EINPROGRESS)
+        err = crypto_wait_req(err, wait);
-                return;
-        res->err = err;
-        complete(&res->completion);
-}
-static int ahash_wait(int err, struct ahash_completion *res)
+        if (err)
-{
-        switch (err) {
-        case 0:
-                break;
-        case -EINPROGRESS:
-        case -EBUSY:
-                wait_for_completion(&res->completion);
-                reinit_completion(&res->completion);
-                err = res->err;
-                /* fall through */
-        default:
                pr_crit_ratelimited("ahash calculation failed: err: %d\n", err);
-        }
        return err;
 }
@@ -233,7 +211,7 @@ static int ima_calc_file_hash_atfm(struct file *file,
        int rc, read = 0, rbuf_len, active = 0, ahash_rc = 0;
        struct ahash_request *req;
        struct scatterlist sg[1];
-        struct ahash_completion res;
+        struct crypto_wait wait;
        size_t rbuf_size[2];
        hash->length = crypto_ahash_digestsize(tfm);
@@ -242,12 +220,12 @@ static int ima_calc_file_hash_atfm(struct file *file,
        if (!req)
                return -ENOMEM;
-        init_completion(&res.completion);
+        crypto_init_wait(&wait);
        ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
                                   CRYPTO_TFM_REQ_MAY_SLEEP,
-                                   ahash_complete, &res);
+                                   crypto_req_done, &wait);
-        rc = ahash_wait(crypto_ahash_init(req), &res);
+        rc = ahash_wait(crypto_ahash_init(req), &wait);
        if (rc)
                goto out1;
@@ -288,7 +266,7 @@ static int ima_calc_file_hash_atfm(struct file *file,
                         * read/request, wait for the completion of the
                         * previous ahash_update() request.
                         */
-                        rc = ahash_wait(ahash_rc, &res);
+                        rc = ahash_wait(ahash_rc, &wait);
                        if (rc)
                                goto out3;
                }
@@ -304,7 +282,7 @@ static int ima_calc_file_hash_atfm(struct file *file,
                         * read/request, wait for the completion of the
                         * previous ahash_update() request.
                         */
-                        rc = ahash_wait(ahash_rc, &res);
+                        rc = ahash_wait(ahash_rc, &wait);
                        if (rc)
                                goto out3;
                }
@@ -318,7 +296,7 @@ static int ima_calc_file_hash_atfm(struct file *file,
                        active = !active; /* swap buffers, if we use two */
        }
        /* wait for the last update request to complete */
-        rc = ahash_wait(ahash_rc, &res);
+        rc = ahash_wait(ahash_rc, &wait);
 out3:
        if (read)
                file->f_mode &= ~FMODE_READ;
@@ -327,7 +305,7 @@ out3:
 out2:
        if (!rc) {
                ahash_request_set_crypt(req, NULL, hash->digest, 0);
-                rc = ahash_wait(crypto_ahash_final(req), &res);
+                rc = ahash_wait(crypto_ahash_final(req), &wait);
        }
 out1:
        ahash_request_free(req);
@@ -441,6 +419,16 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
        loff_t i_size;
        int rc;
+        /*
+         * For consistency, fail file's opened with the O_DIRECT flag on
+         * filesystems mounted with/without DAX option.
+         */
+        if (file->f_flags & O_DIRECT) {
+                hash->length = hash_digest_size[ima_hash_algo];
+                hash->algo = ima_hash_algo;
+                return -EINVAL;
+        }
        i_size = i_size_read(file_inode(file));
        if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
@@ -527,7 +515,7 @@ static int calc_buffer_ahash_atfm(const void *buf, loff_t len,
 {
        struct ahash_request *req;
        struct scatterlist sg;
-        struct ahash_completion res;
+        struct crypto_wait wait;
        int rc, ahash_rc = 0;
        hash->length = crypto_ahash_digestsize(tfm);
@@ -536,12 +524,12 @@ static int calc_buffer_ahash_atfm(const void *buf, loff_t len,
        if (!req)
                return -ENOMEM;
-        init_completion(&res.completion);
+        crypto_init_wait(&wait);
        ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
                                   CRYPTO_TFM_REQ_MAY_SLEEP,
-                                   ahash_complete, &res);
+                                   crypto_req_done, &wait);
-        rc = ahash_wait(crypto_ahash_init(req), &res);
+        rc = ahash_wait(crypto_ahash_init(req), &wait);
        if (rc)
                goto out;
@@ -551,10 +539,10 @@ static int calc_buffer_ahash_atfm(const void *buf, loff_t len,
        ahash_rc = crypto_ahash_update(req);
        /* wait for the update request to complete */
-        rc = ahash_wait(ahash_rc, &res);
+        rc = ahash_wait(ahash_rc, &wait);
        if (!rc) {
                ahash_request_set_crypt(req, NULL, hash->digest, 0);
-                rc = ahash_wait(crypto_ahash_final(req), &res);
+                rc = ahash_wait(crypto_ahash_final(req), &wait);
        }
 out:
        ahash_request_free(req);
diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
index ad491c51e833..fa540c0469da 100644
--- a/security/integrity/ima/ima_fs.c
+++ b/security/integrity/ima/ima_fs.c
@@ -32,7 +32,7 @@ bool ima_canonical_fmt;
 static int __init default_canonical_fmt_setup(char *str)
 {
 #ifdef __BIG_ENDIAN
-        ima_canonical_fmt = 1;
+        ima_canonical_fmt = true;
 #endif
        return 1;
 }
@@ -429,10 +429,10 @@ static int ima_release_policy(struct inode *inode, struct file *file)
        }
        ima_update_policy();
-#ifndef CONFIG_IMA_WRITE_POLICY
+#if !defined(CONFIG_IMA_WRITE_POLICY) && !defined(CONFIG_IMA_READ_POLICY)
        securityfs_remove(ima_policy);
        ima_policy = NULL;
-#else
+#elif defined(CONFIG_IMA_WRITE_POLICY)
        clear_bit(IMA_FS_BUSY, &ima_fs_flags);
 #endif
        return 0;
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 2aebb7984437..770654694efc 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
                        ima_hash_algo = HASH_ALGO_SHA1;
                else if (strncmp(str, "md5", 3) == 0)
                        ima_hash_algo = HASH_ALGO_MD5;
+                else
+                        return 1;
                goto out;
        }
@@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
                        break;
                }
        }
+        if (i == HASH_ALGO__LAST)
+                return 1;
 out:
        hash_setup_done = 1;
        return 1;
@@ -235,11 +239,8 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
        hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
        rc = ima_collect_measurement(iint, file, buf, size, hash_algo);
-        if (rc != 0) {
+        if (rc != 0 && rc != -EBADF && rc != -EINVAL)
-                if (file->f_flags & O_DIRECT)
-                        rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
                goto out_digsig;
-        }
        if (!pathbuf)   /* ima_rdwr_violation possibly pre-fetched */
                pathname = ima_d_path(&file->f_path, &pathbuf, filename);
@@ -247,12 +248,14 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
        if (action & IMA_MEASURE)
                ima_store_measurement(iint, file, pathname,
                                      xattr_value, xattr_len, pcr);
-        if (action & IMA_APPRAISE_SUBMASK)
+        if (rc == 0 && (action & IMA_APPRAISE_SUBMASK))
                rc = ima_appraise_measurement(func, iint, file, pathname,
                                              xattr_value, xattr_len, opened);
        if (action & IMA_AUDIT)
                ima_audit_measurement(iint, pathname);
+        if ((file->f_flags & O_DIRECT) && (iint->flags & IMA_PERMIT_DIRECTIO))
+                rc = 0;
 out_digsig:
        if ((mask & MAY_WRITE) && (iint->flags & IMA_DIGSIG) &&
             !(iint->flags & IMA_NEW_FILE))
@@ -359,12 +362,12 @@ void ima_post_path_mknod(struct dentry *dentry)
 */
 int ima_read_file(struct file *file, enum kernel_read_file_id read_id)
 {
+        bool sig_enforce = is_module_sig_enforced();
        if (!file && read_id == READING_MODULE) {
-#ifndef CONFIG_MODULE_SIG_FORCE
+                if (!sig_enforce && (ima_appraise & IMA_APPRAISE_MODULES) &&
-                if ((ima_appraise & IMA_APPRAISE_MODULES) &&
                    (ima_appraise & IMA_APPRAISE_ENFORCE))
                        return -EACCES; /* INTEGRITY_UNKNOWN */
-#endif
                return 0;       /* We rely on module signature checking */
        }
        return 0;
@@ -406,6 +409,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
        if (!file && read_id == READING_MODULE) /* MODULE_SIG_FORCE enabled */
                return 0;
+        /* permit signed certs */
+        if (!file && read_id == READING_X509_CERTIFICATE)
+                return 0;
        if (!file || !buf || size == 0) { /* should never happen */
                if (ima_appraise & IMA_APPRAISE_ENFORCE)
                        return -EACCES;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 95209a5f8595..ee4613fa5840 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -196,9 +196,9 @@ static int __init policy_setup(char *str)
                if ((strcmp(p, "tcb") == 0) && !ima_policy)
                        ima_policy = DEFAULT_TCB;
                else if (strcmp(p, "appraise_tcb") == 0)
-                        ima_use_appraise_tcb = 1;
+                        ima_use_appraise_tcb = true;
                else if (strcmp(p, "secure_boot") == 0)
-                        ima_use_secure_boot = 1;
+                        ima_use_secure_boot = true;
        }
        return 1;
@@ -207,7 +207,7 @@ __setup("ima_policy=", policy_setup);
 static int __init default_appraise_policy_setup(char *str)
 {
-        ima_use_appraise_tcb = 1;
+        ima_use_appraise_tcb = true;
        return 1;
 }
 __setup("ima_appraise_tcb", default_appraise_policy_setup);
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index a53e7e4ab06c..e1bf040fb110 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -120,8 +120,6 @@ struct integrity_iint_cache *integrity_iint_find(struct inode *inode);
 int integrity_kernel_read(struct file *file, loff_t offset,
                          void *addr, unsigned long count);
-int __init integrity_read_file(const char *path, char **data);
 #define INTEGRITY_KEYRING_EVM           0
 #define INTEGRITY_KEYRING_IMA           1
 #define INTEGRITY_KEYRING_MODULE        2
diff --git a/security/keys/Kconfig b/security/keys/Kconfig
index a7a23b5541f8..6462e6654ccf 100644
--- a/security/keys/Kconfig
+++ b/security/keys/Kconfig
@@ -45,10 +45,9 @@ config BIG_KEYS
        bool "Large payload keys"
        depends on KEYS
        depends on TMPFS
-        depends on (CRYPTO_ANSI_CPRNG = y || CRYPTO_DRBG = y)
+        select CRYPTO
        select CRYPTO_AES
-        select CRYPTO_ECB
+        select CRYPTO_GCM
-        select CRYPTO_RNG
        help
          This option provides support for holding large keys within the kernel
          (for example Kerberos ticket caches).  The data may be stored out to
diff --git a/security/keys/Makefile b/security/keys/Makefile
index 57dff0c15809..ef1581b337a3 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for key management
 #
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 6acb00f6f22c..929e14978c42 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -1,5 +1,6 @@
 /* Large capacity key type
 *
+ * Copyright (C) 2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 *
@@ -16,10 +17,10 @@
 #include <linux/shmem_fs.h>
 #include <linux/err.h>
 #include <linux/scatterlist.h>
+#include <linux/random.h>
 #include <keys/user-type.h>
 #include <keys/big_key-type.h>
-#include <crypto/rng.h>
+#include <crypto/aead.h>
-#include <crypto/skcipher.h>
 /*
 * Layout of key payload words.
@@ -49,7 +50,12 @@ enum big_key_op {
 /*
 * Key size for big_key data encryption
 */
-#define ENC_KEY_SIZE    16
+#define ENC_KEY_SIZE 32
+/*
+ * Authentication tag length
+ */
+#define ENC_AUTHTAG_SIZE 16
 /*
 * big_key defined keys take an arbitrary string as the description and an
@@ -64,57 +70,62 @@ struct key_type key_type_big_key = {
        .destroy                = big_key_destroy,
        .describe               = big_key_describe,
        .read                   = big_key_read,
+        /* no ->update(); don't add it without changing big_key_crypt() nonce */
 };
 /*
- * Crypto names for big_key data encryption
+ * Crypto names for big_key data authenticated encryption
 */
-static const char big_key_rng_name[] = "stdrng";
+static const char big_key_alg_name[] = "gcm(aes)";
-static const char big_key_alg_name[] = "ecb(aes)";
 /*
- * Crypto algorithms for big_key data encryption
+ * Crypto algorithms for big_key data authenticated encryption
 */
-static struct crypto_rng *big_key_rng;
+static struct crypto_aead *big_key_aead;
-static struct crypto_skcipher *big_key_skcipher;
 /*
- * Generate random key to encrypt big_key data
+ * Since changing the key affects the entire object, we need a mutex.
 */
-static inline int big_key_gen_enckey(u8 *key)
+static DEFINE_MUTEX(big_key_aead_lock);
-{
-        return crypto_rng_get_bytes(big_key_rng, key, ENC_KEY_SIZE);
-}
 /*
 * Encrypt/decrypt big_key data
 */
 static int big_key_crypt(enum big_key_op op, u8 *data, size_t datalen, u8 *key)
 {
-        int ret = -EINVAL;
+        int ret;
        struct scatterlist sgio;
-        SKCIPHER_REQUEST_ON_STACK(req, big_key_skcipher);
+        struct aead_request *aead_req;
+        /* We always use a zero nonce. The reason we can get away with this is
-        if (crypto_skcipher_setkey(big_key_skcipher, key, ENC_KEY_SIZE)) {
+         * because we're using a different randomly generated key for every
+         * different encryption. Notably, too, key_type_big_key doesn't define
+         * an .update function, so there's no chance we'll wind up reusing the
+         * key to encrypt updated data. Simply put: one key, one encryption.
+         */
+        u8 zero_nonce[crypto_aead_ivsize(big_key_aead)];
+        aead_req = aead_request_alloc(big_key_aead, GFP_KERNEL);
+        if (!aead_req)
+                return -ENOMEM;
+        memset(zero_nonce, 0, sizeof(zero_nonce));
+        sg_init_one(&sgio, data, datalen + (op == BIG_KEY_ENC ? ENC_AUTHTAG_SIZE : 0));
+        aead_request_set_crypt(aead_req, &sgio, &sgio, datalen, zero_nonce);
+        aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL);
+        aead_request_set_ad(aead_req, 0);
+        mutex_lock(&big_key_aead_lock);
+        if (crypto_aead_setkey(big_key_aead, key, ENC_KEY_SIZE)) {
                ret = -EAGAIN;
                goto error;
        }
-        skcipher_request_set_tfm(req, big_key_skcipher);
-        skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP,
-                                      NULL, NULL);
-        sg_init_one(&sgio, data, datalen);
-        skcipher_request_set_crypt(req, &sgio, &sgio, datalen, NULL);
        if (op == BIG_KEY_ENC)
-                ret = crypto_skcipher_encrypt(req);
+                ret = crypto_aead_encrypt(aead_req);
        else
-                ret = crypto_skcipher_decrypt(req);
+                ret = crypto_aead_decrypt(aead_req);
-        skcipher_request_zero(req);
 error:
+        mutex_unlock(&big_key_aead_lock);
+        aead_request_free(aead_req);
        return ret;
 }
@@ -146,16 +157,13 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                 *
                 * File content is stored encrypted with randomly generated key.
                 */
-                size_t enclen = ALIGN(datalen, crypto_skcipher_blocksize(big_key_skcipher));
+                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                loff_t pos = 0;
-                /* prepare aligned data to encrypt */
                data = kmalloc(enclen, GFP_KERNEL);
                if (!data)
                        return -ENOMEM;
                memcpy(data, prep->data, datalen);
-                memset(data + datalen, 0x00, enclen - datalen);
                /* generate random key */
                enckey = kmalloc(ENC_KEY_SIZE, GFP_KERNEL);
@@ -163,13 +171,12 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                        ret = -ENOMEM;
                        goto error;
                }
+                ret = get_random_bytes_wait(enckey, ENC_KEY_SIZE);
-                ret = big_key_gen_enckey(enckey);
+                if (unlikely(ret))
-                if (ret)
                        goto err_enckey;
                /* encrypt aligned data */
-                ret = big_key_crypt(BIG_KEY_ENC, data, enclen, enckey);
+                ret = big_key_crypt(BIG_KEY_ENC, data, datalen, enckey);
                if (ret)
                        goto err_enckey;
@@ -195,7 +202,7 @@ int big_key_preparse(struct key_preparsed_payload *prep)
                *path = file->f_path;
                path_get(path);
                fput(file);
-                kfree(data);
+                kzfree(data);
        } else {
                /* Just store the data in a buffer */
                void *data = kmalloc(datalen, GFP_KERNEL);
@@ -211,9 +218,9 @@ int big_key_preparse(struct key_preparsed_payload *prep)
 err_fput:
        fput(file);
 err_enckey:
-        kfree(enckey);
+        kzfree(enckey);
 error:
-        kfree(data);
+        kzfree(data);
        return ret;
 }
@@ -227,7 +234,7 @@ void big_key_free_preparse(struct key_preparsed_payload *prep)
                path_put(path);
        }
-        kfree(prep->payload.data[big_key_data]);
+        kzfree(prep->payload.data[big_key_data]);
 }
 /*
@@ -240,7 +247,7 @@ void big_key_revoke(struct key *key)
        /* clear the quota */
        key_payload_reserve(key, 0);
-        if (key_is_instantiated(key) &&
+        if (key_is_positive(key) &&
            (size_t)key->payload.data[big_key_len] > BIG_KEY_FILE_THRESHOLD)
                vfs_truncate(path, 0);
 }
@@ -259,7 +266,7 @@ void big_key_destroy(struct key *key)
                path->mnt = NULL;
                path->dentry = NULL;
        }
-        kfree(key->payload.data[big_key_data]);
+        kzfree(key->payload.data[big_key_data]);
        key->payload.data[big_key_data] = NULL;
 }
@@ -272,7 +279,7 @@ void big_key_describe(const struct key *key, struct seq_file *m)
        seq_puts(m, key->description);
-        if (key_is_instantiated(key))
+        if (key_is_positive(key))
                seq_printf(m, ": %zu [%s]",
                           datalen,
                           datalen > BIG_KEY_FILE_THRESHOLD ? "file" : "buff");
@@ -295,7 +302,7 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
                struct file *file;
                u8 *data;
                u8 *enckey = (u8 *)key->payload.data[big_key_data];
-                size_t enclen = ALIGN(datalen, crypto_skcipher_blocksize(big_key_skcipher));
+                size_t enclen = datalen + ENC_AUTHTAG_SIZE;
                loff_t pos = 0;
                data = kmalloc(enclen, GFP_KERNEL);
@@ -328,7 +335,7 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
 err_fput:
                fput(file);
 error:
-                kfree(data);
+                kzfree(data);
        } else {
                ret = datalen;
                if (copy_to_user(buffer, key->payload.data[big_key_data],
@@ -344,47 +351,31 @@ error:
 */
 static int __init big_key_init(void)
 {
-        struct crypto_skcipher *cipher;
-        struct crypto_rng *rng;
        int ret;
-        rng = crypto_alloc_rng(big_key_rng_name, 0, 0);
-        if (IS_ERR(rng)) {
-                pr_err("Can't alloc rng: %ld\n", PTR_ERR(rng));
-                return PTR_ERR(rng);
-        }
-        big_key_rng = rng;
-        /* seed RNG */
-        ret = crypto_rng_reset(rng, NULL, crypto_rng_seedsize(rng));
-        if (ret) {
-                pr_err("Can't reset rng: %d\n", ret);
-                goto error_rng;
-        }
        /* init block cipher */
-        cipher = crypto_alloc_skcipher(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
+        big_key_aead = crypto_alloc_aead(big_key_alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(cipher)) {
+        if (IS_ERR(big_key_aead)) {
-                ret = PTR_ERR(cipher);
+                ret = PTR_ERR(big_key_aead);
                pr_err("Can't alloc crypto: %d\n", ret);
-                goto error_rng;
+                return ret;
+        }
+        ret = crypto_aead_setauthsize(big_key_aead, ENC_AUTHTAG_SIZE);
+        if (ret < 0) {
+                pr_err("Can't set crypto auth tag len: %d\n", ret);
+                goto free_aead;
        }
-        big_key_skcipher = cipher;
        ret = register_key_type(&key_type_big_key);
        if (ret < 0) {
                pr_err("Can't register type: %d\n", ret);
-                goto error_cipher;
+                goto free_aead;
        }
        return 0;
-error_cipher:
+free_aead:
-        crypto_free_skcipher(big_key_skcipher);
+        crypto_free_aead(big_key_aead);
-error_rng:
-        crypto_free_rng(big_key_rng);
        return ret;
 }
diff --git a/security/keys/encrypted-keys/Makefile b/security/keys/encrypted-keys/Makefile
index d6f8433250a5..7a44dce6f69d 100644
--- a/security/keys/encrypted-keys/Makefile
+++ b/security/keys/encrypted-keys/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for encrypted keys
 #
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 69855ba0d3b3..d92cbf9687c3 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -309,6 +309,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
        down_read(&ukey->sem);
        upayload = user_key_payload_locked(ukey);
+        if (!upayload) {
+                /* key was revoked before we acquired its semaphore */
+                up_read(&ukey->sem);
+                key_put(ukey);
+                ukey = ERR_PTR(-EKEYREVOKED);
+                goto error;
+        }
        *master_key = upayload->data;
        *master_keylen = upayload->datalen;
 error:
@@ -847,7 +854,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
        size_t datalen = prep->datalen;
        int ret = 0;
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (key_is_negative(key))
                return -ENOKEY;
        if (datalen <= 0 || datalen > 32767 || !prep->data)
                return -EINVAL;
diff --git a/security/keys/encrypted-keys/encrypted.h b/security/keys/encrypted-keys/encrypted.h
index 47802c0de735..1809995db452 100644
--- a/security/keys/encrypted-keys/encrypted.h
+++ b/security/keys/encrypted-keys/encrypted.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #ifndef __ENCRYPTED_KEY_H
 #define __ENCRYPTED_KEY_H
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 87cb260e4890..7207e6094dc1 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -29,10 +29,10 @@ DECLARE_WORK(key_gc_work, key_garbage_collector);
 /*
 * Reaper for links from keyrings to dead keys.
 */
-static void key_gc_timer_func(unsigned long);
+static void key_gc_timer_func(struct timer_list *);
-static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
+static DEFINE_TIMER(key_gc_timer, key_gc_timer_func);
-static time_t key_gc_next_run = LONG_MAX;
+static time64_t key_gc_next_run = TIME64_MAX;
 static struct key_type *key_gc_dead_keytype;
 static unsigned long key_gc_flags;
@@ -53,12 +53,12 @@ struct key_type key_type_dead = {
 * Schedule a garbage collection run.
 * - time precision isn't particularly important
 */
-void key_schedule_gc(time_t gc_at)
+void key_schedule_gc(time64_t gc_at)
 {
        unsigned long expires;
-        time_t now = current_kernel_time().tv_sec;
+        time64_t now = ktime_get_real_seconds();
-        kenter("%ld", gc_at - now);
+        kenter("%lld", gc_at - now);
        if (gc_at <= now || test_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags)) {
                kdebug("IMMEDIATE");
@@ -84,10 +84,10 @@ void key_schedule_gc_links(void)
 * Some key's cleanup time was met after it expired, so we need to get the
 * reaper to go through a cycle finding expired keys.
 */
-static void key_gc_timer_func(unsigned long data)
+static void key_gc_timer_func(struct timer_list *unused)
 {
        kenter("");
-        key_gc_next_run = LONG_MAX;
+        key_gc_next_run = TIME64_MAX;
        key_schedule_gc_links();
 }
@@ -129,15 +129,15 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
        while (!list_empty(keys)) {
                struct key *key =
                        list_entry(keys->next, struct key, graveyard_link);
+                short state = key->state;
                list_del(&key->graveyard_link);
                kdebug("- %u", key->serial);
                key_check(key);
                /* Throw away the key data if the key is instantiated */
-                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+                if (state == KEY_IS_POSITIVE && key->type->destroy)
-                    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
-                    key->type->destroy)
                        key->type->destroy(key);
                security_key_free(key);
@@ -151,7 +151,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
                }
                atomic_dec(&key->user->nkeys);
-                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+                if (state != KEY_IS_UNINSTANTIATED)
                        atomic_dec(&key->user->nikeys);
                key_user_put(key->user);
@@ -184,11 +184,11 @@ static void key_garbage_collector(struct work_struct *work)
        struct rb_node *cursor;
        struct key *key;
-        time_t new_timer, limit;
+        time64_t new_timer, limit;
        kenter("[%lx,%x]", key_gc_flags, gc_state);
-        limit = current_kernel_time().tv_sec;
+        limit = ktime_get_real_seconds();
        if (limit > key_gc_delay)
                limit -= key_gc_delay;
        else
@@ -204,7 +204,7 @@ static void key_garbage_collector(struct work_struct *work)
                gc_state |= KEY_GC_REAPING_DEAD_1;
        kdebug("new pass %x", gc_state);
-        new_timer = LONG_MAX;
+        new_timer = TIME64_MAX;
        /* As only this function is permitted to remove things from the key
         * serial tree, if cursor is non-NULL then it will always point to a
@@ -235,7 +235,7 @@ continue_scanning:
                if (gc_state & KEY_GC_SET_TIMER) {
                        if (key->expiry > limit && key->expiry < new_timer) {
-                                kdebug("will expire %x in %ld",
+                                kdebug("will expire %x in %lld",
                                       key_serial(key), key->expiry - limit);
                                new_timer = key->expiry;
                        }
@@ -276,7 +276,7 @@ maybe_resched:
         */
        kdebug("pass complete");
-        if (gc_state & KEY_GC_SET_TIMER && new_timer != (time_t)LONG_MAX) {
+        if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
                new_timer += key_gc_delay;
                key_schedule_gc(new_timer);
        }
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 1c02c6547038..9f8208dc0e55 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -130,7 +130,7 @@ struct keyring_search_context {
        int                     skipped_ret;
        bool                    possessed;
        key_ref_t               result;
-        struct timespec         now;
+        time64_t                now;
 };
 extern bool key_default_cmp(const struct key *key,
@@ -141,7 +141,7 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 extern key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx);
 extern key_ref_t search_process_keyrings(struct keyring_search_context *ctx);
-extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
+extern struct key *find_keyring_by_name(const char *name, bool uid_keyring);
 extern int install_user_keyrings(void);
 extern int install_thread_keyring_to_cred(struct cred *);
@@ -169,10 +169,10 @@ extern void key_change_session_keyring(struct callback_head *twork);
 extern struct work_struct key_gc_work;
 extern unsigned key_gc_delay;
-extern void keyring_gc(struct key *keyring, time_t limit);
+extern void keyring_gc(struct key *keyring, time64_t limit);
 extern void keyring_restriction_gc(struct key *keyring,
                                   struct key_type *dead_type);
-extern void key_schedule_gc(time_t gc_at);
+extern void key_schedule_gc(time64_t gc_at);
 extern void key_schedule_gc_links(void);
 extern void key_gc_keytype(struct key_type *ktype);
@@ -211,7 +211,7 @@ extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
 /*
 * Determine whether a key is dead.
 */
-static inline bool key_is_dead(const struct key *key, time_t limit)
+static inline bool key_is_dead(const struct key *key, time64_t limit)
 {
        return
                key->flags & ((1 << KEY_FLAG_DEAD) |
diff --git a/security/keys/key.c b/security/keys/key.c
index 83da68d98b40..d97c9394b5dd 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -54,10 +54,10 @@ void __key_check(const struct key *key)
 struct key_user *key_user_lookup(kuid_t uid)
 {
        struct key_user *candidate = NULL, *user;
-        struct rb_node *parent = NULL;
+        struct rb_node *parent, **p;
-        struct rb_node **p;
 try_again:
+        parent = NULL;
        p = &key_user_tree.rb_node;
        spin_lock(&key_user_lock);
@@ -302,6 +302,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
                key->flags |= 1 << KEY_FLAG_IN_QUOTA;
        if (flags & KEY_ALLOC_BUILT_IN)
                key->flags |= 1 << KEY_FLAG_BUILTIN;
+        if (flags & KEY_ALLOC_UID_KEYRING)
+                key->flags |= 1 << KEY_FLAG_UID_KEYRING;
 #ifdef KEY_DEBUGGING
        key->magic = KEY_DEBUG_MAGIC;
@@ -400,6 +402,18 @@ int key_payload_reserve(struct key *key, size_t datalen)
 EXPORT_SYMBOL(key_payload_reserve);
 /*
+ * Change the key state to being instantiated.
+ */
+static void mark_key_instantiated(struct key *key, int reject_error)
+{
+        /* Commit the payload before setting the state; barrier versus
+         * key_read_state().
+         */
+        smp_store_release(&key->state,
+                          (reject_error < 0) ? reject_error : KEY_IS_POSITIVE);
+}
+/*
 * Instantiate a key and link it into the target keyring atomically.  Must be
 * called with the target keyring's semaphore writelocked.  The target key's
 * semaphore need not be locked as instantiation is serialised by
@@ -422,14 +436,14 @@ static int __key_instantiate_and_link(struct key *key,
        mutex_lock(&key_construction_mutex);
        /* can't instantiate twice */
-        if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+        if (key->state == KEY_IS_UNINSTANTIATED) {
                /* instantiate the key */
                ret = key->type->instantiate(key, prep);
                if (ret == 0) {
                        /* mark the key as being instantiated */
                        atomic_inc(&key->user->nikeys);
-                        set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
+                        mark_key_instantiated(key, 0);
                        if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
                                awaken = 1;
@@ -446,7 +460,7 @@ static int __key_instantiate_and_link(struct key *key,
                        if (authkey)
                                key_revoke(authkey);
-                        if (prep->expiry != TIME_T_MAX) {
+                        if (prep->expiry != TIME64_MAX) {
                                key->expiry = prep->expiry;
                                key_schedule_gc(prep->expiry + key_gc_delay);
                        }
@@ -492,7 +506,7 @@ int key_instantiate_and_link(struct key *key,
        prep.data = data;
        prep.datalen = datalen;
        prep.quotalen = key->type->def_datalen;
-        prep.expiry = TIME_T_MAX;
+        prep.expiry = TIME64_MAX;
        if (key->type->preparse) {
                ret = key->type->preparse(&prep);
                if (ret < 0)
@@ -556,7 +570,6 @@ int key_reject_and_link(struct key *key,
                        struct key *authkey)
 {
        struct assoc_array_edit *edit;
-        struct timespec now;
        int ret, awaken, link_ret = 0;
        key_check(key);
@@ -575,15 +588,11 @@ int key_reject_and_link(struct key *key,
        mutex_lock(&key_construction_mutex);
        /* can't instantiate twice */
-        if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+        if (key->state == KEY_IS_UNINSTANTIATED) {
                /* mark the key as being negatively instantiated */
                atomic_inc(&key->user->nikeys);
-                key->reject_error = -error;
+                mark_key_instantiated(key, -error);
-                smp_wmb();
+                key->expiry = ktime_get_real_seconds() + timeout;
-                set_bit(KEY_FLAG_NEGATIVE, &key->flags);
-                set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
-                now = current_kernel_time();
-                key->expiry = now.tv_sec + timeout;
                key_schedule_gc(key->expiry + key_gc_delay);
                if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
@@ -699,16 +708,13 @@ found_kernel_type:
 void key_set_timeout(struct key *key, unsigned timeout)
 {
-        struct timespec now;
+        time64_t expiry = 0;
-        time_t expiry = 0;
        /* make the changes with the locks held to prevent races */
        down_write(&key->sem);
-        if (timeout > 0) {
+        if (timeout > 0)
-                now = current_kernel_time();
+                expiry = ktime_get_real_seconds() + timeout;
-                expiry = now.tv_sec + timeout;
-        }
        key->expiry = expiry;
        key_schedule_gc(key->expiry + key_gc_delay);
@@ -750,8 +756,8 @@ static inline key_ref_t __key_update(key_ref_t key_ref,
        ret = key->type->update(key, prep);
        if (ret == 0)
-                /* updating a negative key instantiates it */
+                /* Updating a negative key positively instantiates it */
-                clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
+                mark_key_instantiated(key, 0);
        up_write(&key->sem);
@@ -827,7 +833,6 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
        key_check(keyring);
-        key_ref = ERR_PTR(-EPERM);
        if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION))
                restrict_link = keyring->restrict_link;
@@ -839,7 +844,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
        prep.data = payload;
        prep.datalen = plen;
        prep.quotalen = index_key.type->def_datalen;
-        prep.expiry = TIME_T_MAX;
+        prep.expiry = TIME64_MAX;
        if (index_key.type->preparse) {
                ret = index_key.type->preparse(&prep);
                if (ret < 0) {
@@ -934,6 +939,16 @@ error:
         */
        __key_link_end(keyring, &index_key, edit);
+        key = key_ref_to_ptr(key_ref);
+        if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) {
+                ret = wait_for_key_construction(key, true);
+                if (ret < 0) {
+                        key_ref_put(key_ref);
+                        key_ref = ERR_PTR(ret);
+                        goto error_free_prep;
+                }
+        }
        key_ref = __key_update(key_ref, &prep);
        goto error_free_prep;
 }
@@ -973,7 +988,7 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
        prep.data = payload;
        prep.datalen = plen;
        prep.quotalen = key->type->def_datalen;
-        prep.expiry = TIME_T_MAX;
+        prep.expiry = TIME64_MAX;
        if (key->type->preparse) {
                ret = key->type->preparse(&prep);
                if (ret < 0)
@@ -984,8 +999,8 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
        ret = key->type->update(key, &prep);
        if (ret == 0)
-                /* updating a negative key instantiates it */
+                /* Updating a negative key positively instantiates it */
-                clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
+                mark_key_instantiated(key, 0);
        up_write(&key->sem);
@@ -1007,8 +1022,7 @@ EXPORT_SYMBOL(key_update);
 */
 void key_revoke(struct key *key)
 {
-        struct timespec now;
+        time64_t time;
-        time_t time;
        key_check(key);
@@ -1023,8 +1037,7 @@ void key_revoke(struct key *key)
                key->type->revoke(key);
        /* set the death time to no more than the expiry time */
-        now = current_kernel_time();
+        time = ktime_get_real_seconds();
-        time = now.tv_sec;
        if (key->revoked_at == 0 || key->revoked_at > time) {
                key->revoked_at = time;
                key_schedule_gc(key->revoked_at + key_gc_delay);
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index ab0b337c84b4..1ffe60bb2845 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -766,12 +766,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
        key = key_ref_to_ptr(key_ref);
+        ret = key_read_state(key);
+        if (ret < 0)
+                goto error2; /* Negatively instantiated */
        /* see if we can read it directly */
        ret = key_permission(key_ref, KEY_NEED_READ);
        if (ret == 0)
                goto can_read_key;
        if (ret != -EACCES)
-                goto error;
+                goto error2;
        /* we can't; see if it's searchable from this process's keyrings
         * - we automatically take account of the fact that it may be
@@ -896,7 +900,7 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
                atomic_dec(&key->user->nkeys);
                atomic_inc(&newowner->nkeys);
-                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+                if (key->state != KEY_IS_UNINSTANTIATED) {
                        atomic_dec(&key->user->nikeys);
                        atomic_inc(&newowner->nikeys);
                }
@@ -1406,11 +1410,9 @@ long keyctl_assume_authority(key_serial_t id)
        }
        ret = keyctl_change_reqkey_auth(authkey);
-        if (ret < 0)
+        if (ret == 0)
-                goto error;
+                ret = authkey->serial;
        key_put(authkey);
-        ret = authkey->serial;
 error:
        return ret;
 }
@@ -1586,9 +1588,8 @@ error_keyring:
 * The caller must have Setattr permission to change keyring restrictions.
 *
 * The requested type name may be a NULL pointer to reject all attempts
- * to link to the keyring. If _type is non-NULL, _restriction can be
+ * to link to the keyring.  In this case, _restriction must also be NULL.
- * NULL or a pointer to a string describing the restriction. If _type is
+ * Otherwise, both _type and _restriction must be non-NULL.
- * NULL, _restriction must also be NULL.
 *
 * Returns 0 if successful.
 */
@@ -1596,7 +1597,6 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
                             const char __user *_restriction)
 {
        key_ref_t key_ref;
-        bool link_reject = !_type;
        char type[32];
        char *restriction = NULL;
        long ret;
@@ -1605,31 +1605,29 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
        if (IS_ERR(key_ref))
                return PTR_ERR(key_ref);
+        ret = -EINVAL;
        if (_type) {
+                if (!_restriction)
+                        goto error;
                ret = key_get_type_from_user(type, _type, sizeof(type));
                if (ret < 0)
                        goto error;
-        }
-        if (_restriction) {
-                if (!_type) {
-                        ret = -EINVAL;
-                        goto error;
-                }
                restriction = strndup_user(_restriction, PAGE_SIZE);
                if (IS_ERR(restriction)) {
                        ret = PTR_ERR(restriction);
                        goto error;
                }
+        } else {
+                if (_restriction)
+                        goto error;
        }
-        ret = keyring_restrict(key_ref, link_reject ? NULL : type, restriction);
+        ret = keyring_restrict(key_ref, _type ? type : NULL, restriction);
        kfree(restriction);
 error:
        key_ref_put(key_ref);
        return ret;
 }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index de81793f9920..d0bccebbd3b5 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -414,7 +414,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
        else
                seq_puts(m, "[anon]");
-        if (key_is_instantiated(keyring)) {
+        if (key_is_positive(keyring)) {
                if (keyring->keys.nr_leaves_on_tree != 0)
                        seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
                else
@@ -423,7 +423,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
 }
 struct keyring_read_iterator_context {
-        size_t                  qty;
+        size_t                  buflen;
        size_t                  count;
        key_serial_t __user     *buffer;
 };
@@ -435,9 +435,9 @@ static int keyring_read_iterator(const void *object, void *data)
        int ret;
        kenter("{%s,%d},,{%zu/%zu}",
-               key->type->name, key->serial, ctx->count, ctx->qty);
+               key->type->name, key->serial, ctx->count, ctx->buflen);
-        if (ctx->count >= ctx->qty)
+        if (ctx->count >= ctx->buflen)
                return 1;
        ret = put_user(key->serial, ctx->buffer);
@@ -459,38 +459,33 @@ static long keyring_read(const struct key *keyring,
                         char __user *buffer, size_t buflen)
 {
        struct keyring_read_iterator_context ctx;
-        unsigned long nr_keys;
+        long ret;
-        int ret;
        kenter("{%d},,%zu", key_serial(keyring), buflen);
        if (buflen & (sizeof(key_serial_t) - 1))
                return -EINVAL;
-        nr_keys = keyring->keys.nr_leaves_on_tree;
+        /* Copy as many key IDs as fit into the buffer */
-        if (nr_keys == 0)
+        if (buffer && buflen) {
-                return 0;
+                ctx.buffer = (key_serial_t __user *)buffer;
+                ctx.buflen = buflen;
-        /* Calculate how much data we could return */
+                ctx.count = 0;
-        ctx.qty = nr_keys * sizeof(key_serial_t);
+                ret = assoc_array_iterate(&keyring->keys,
+                                          keyring_read_iterator, &ctx);
-        if (!buffer || !buflen)
+                if (ret < 0) {
-                return ctx.qty;
+                        kleave(" = %ld [iterate]", ret);
+                        return ret;
-        if (buflen > ctx.qty)
+                }
-                ctx.qty = buflen;
-        /* Copy the IDs of the subscribed keys into the buffer */
-        ctx.buffer = (key_serial_t __user *)buffer;
-        ctx.count = 0;
-        ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
-        if (ret < 0) {
-                kleave(" = %d [iterate]", ret);
-                return ret;
        }
-        kleave(" = %zu [ok]", ctx.count);
+        /* Return the size of the buffer needed */
-        return ctx.count;
+        ret = keyring->keys.nr_leaves_on_tree * sizeof(key_serial_t);
+        if (ret <= buflen)
+                kleave("= %ld [ok]", ret);
+        else
+                kleave("= %ld [buffer too small]", ret);
+        return ret;
 }
 /*
@@ -557,7 +552,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 {
        struct keyring_search_context *ctx = iterator_data;
        const struct key *key = keyring_ptr_to_key(object);
-        unsigned long kflags = key->flags;
+        unsigned long kflags = READ_ONCE(key->flags);
+        short state = READ_ONCE(key->state);
        kenter("{%d}", key->serial);
@@ -569,6 +565,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
        /* skip invalidated, revoked and expired keys */
        if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+                time64_t expiry = READ_ONCE(key->expiry);
                if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
                              (1 << KEY_FLAG_REVOKED))) {
                        ctx->result = ERR_PTR(-EKEYREVOKED);
@@ -576,7 +574,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
                        goto skipped;
                }
-                if (key->expiry && ctx->now.tv_sec >= key->expiry) {
+                if (expiry && ctx->now >= expiry) {
                        if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED))
                                ctx->result = ERR_PTR(-EKEYEXPIRED);
                        kleave(" = %d [expire]", ctx->skipped_ret);
@@ -601,9 +599,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
        if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
                /* we set a different error code if we pass a negative key */
-                if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
+                if (state < 0) {
-                        smp_rmb();
+                        ctx->result = ERR_PTR(state);
-                        ctx->result = ERR_PTR(key->reject_error);
                        kleave(" = %d [neg]", ctx->skipped_ret);
                        goto skipped;
                }
@@ -837,10 +834,10 @@ found:
        key = key_ref_to_ptr(ctx->result);
        key_check(key);
        if (!(ctx->flags & KEYRING_SEARCH_NO_UPDATE_TIME)) {
-                key->last_used_at = ctx->now.tv_sec;
+                key->last_used_at = ctx->now;
-                keyring->last_used_at = ctx->now.tv_sec;
+                keyring->last_used_at = ctx->now;
                while (sp > 0)
-                        stack[--sp].keyring->last_used_at = ctx->now.tv_sec;
+                        stack[--sp].keyring->last_used_at = ctx->now;
        }
        kleave(" = true");
        return true;
@@ -901,7 +898,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
        }
        rcu_read_lock();
-        ctx->now = current_kernel_time();
+        ctx->now = ktime_get_real_seconds();
        if (search_nested_keyrings(keyring, ctx))
                __key_get(key_ref_to_ptr(ctx->result));
        rcu_read_unlock();
@@ -1101,15 +1098,15 @@ found:
 /*
 * Find a keyring with the specified name.
 *
- * All named keyrings in the current user namespace are searched, provided they
+ * Only keyrings that have nonzero refcount, are not revoked, and are owned by a
- * grant Search permission directly to the caller (unless this check is
+ * user in the current user namespace are considered.  If @uid_keyring is %true,
- * skipped).  Keyrings whose usage points have reached zero or who have been
+ * the keyring additionally must have been allocated as a user or user session
- * revoked are skipped.
+ * keyring; otherwise, it must grant Search permission directly to the caller.
 *
 * Returns a pointer to the keyring with the keyring's refcount having being
 * incremented on success.  -ENOKEY is returned if a key could not be found.
 */
-struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
+struct key *find_keyring_by_name(const char *name, bool uid_keyring)
 {
        struct key *keyring;
        int bucket;
@@ -1137,17 +1134,22 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                        if (strcmp(keyring->description, name) != 0)
                                continue;
-                        if (!skip_perm_check &&
+                        if (uid_keyring) {
-                            key_permission(make_key_ref(keyring, 0),
+                                if (!test_bit(KEY_FLAG_UID_KEYRING,
-                                           KEY_NEED_SEARCH) < 0)
+                                              &keyring->flags))
-                                continue;
+                                        continue;
+                        } else {
+                                if (key_permission(make_key_ref(keyring, 0),
+                                                   KEY_NEED_SEARCH) < 0)
+                                        continue;
+                        }
                        /* we've got a match but we might end up racing with
                         * key_cleanup() if the keyring is currently 'dead'
                         * (ie. it has a zero usage count) */
                        if (!refcount_inc_not_zero(&keyring->usage))
                                continue;
-                        keyring->last_used_at = current_kernel_time().tv_sec;
+                        keyring->last_used_at = ktime_get_real_seconds();
                        goto out;
                }
        }
@@ -1487,7 +1489,7 @@ static void keyring_revoke(struct key *keyring)
 static bool keyring_gc_select_iterator(void *object, void *iterator_data)
 {
        struct key *key = keyring_ptr_to_key(object);
-        time_t *limit = iterator_data;
+        time64_t *limit = iterator_data;
        if (key_is_dead(key, *limit))
                return false;
@@ -1498,7 +1500,7 @@ static bool keyring_gc_select_iterator(void *object, void *iterator_data)
 static int keyring_gc_check_iterator(const void *object, void *iterator_data)
 {
        const struct key *key = keyring_ptr_to_key(object);
-        time_t *limit = iterator_data;
+        time64_t *limit = iterator_data;
        key_check(key);
        return key_is_dead(key, *limit);
@@ -1510,7 +1512,7 @@ static int keyring_gc_check_iterator(const void *object, void *iterator_data)
 * Not called with any locks held.  The keyring's key struct will not be
 * deallocated under us as only our caller may deallocate it.
 */
-void keyring_gc(struct key *keyring, time_t limit)
+void keyring_gc(struct key *keyring, time64_t limit)
 {
        int result;
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 732cc0beffdf..f68dc04d614e 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -88,7 +88,8 @@ EXPORT_SYMBOL(key_task_permission);
 */
 int key_validate(const struct key *key)
 {
-        unsigned long flags = key->flags;
+        unsigned long flags = READ_ONCE(key->flags);
+        time64_t expiry = READ_ONCE(key->expiry);
        if (flags & (1 << KEY_FLAG_INVALIDATED))
                return -ENOKEY;
@@ -99,9 +100,8 @@ int key_validate(const struct key *key)
                return -EKEYREVOKED;
        /* check it hasn't expired */
-        if (key->expiry) {
+        if (expiry) {
-                struct timespec now = current_kernel_time();
+                if (ktime_get_real_seconds() >= expiry)
-                if (now.tv_sec >= key->expiry)
                        return -EKEYEXPIRED;
        }
diff --git a/security/keys/proc.c b/security/keys/proc.c
index bf08d02b6646..fbc4af5c6c9f 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -178,16 +178,18 @@ static int proc_keys_show(struct seq_file *m, void *v)
 {
        struct rb_node *_p = v;
        struct key *key = rb_entry(_p, struct key, serial_node);
-        struct timespec now;
+        unsigned long flags;
-        unsigned long timo;
        key_ref_t key_ref, skey_ref;
+        time64_t now, expiry;
        char xbuf[16];
+        short state;
+        u64 timo;
        int rc;
        struct keyring_search_context ctx = {
                .index_key.type         = key->type,
                .index_key.description  = key->description,
-                .cred                   = current_cred(),
+                .cred                   = m->file->f_cred,
                .match_data.cmp         = lookup_user_key_possessed,
                .match_data.raw_data    = key,
                .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
@@ -207,51 +209,51 @@ static int proc_keys_show(struct seq_file *m, void *v)
                }
        }
-        /* check whether the current task is allowed to view the key (assuming
+        /* check whether the current task is allowed to view the key */
-         * non-possession)
-         * - the caller holds a spinlock, and thus the RCU read lock, making our
-         *   access to __current_cred() safe
-         */
        rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
        if (rc < 0)
                return 0;
-        now = current_kernel_time();
+        now = ktime_get_real_seconds();
        rcu_read_lock();
        /* come up with a suitable timeout value */
-        if (key->expiry == 0) {
+        expiry = READ_ONCE(key->expiry);
+        if (expiry == 0) {
                memcpy(xbuf, "perm", 5);
-        } else if (now.tv_sec >= key->expiry) {
+        } else if (now >= expiry) {
                memcpy(xbuf, "expd", 5);
        } else {
-                timo = key->expiry - now.tv_sec;
+                timo = expiry - now;
                if (timo < 60)
-                        sprintf(xbuf, "%lus", timo);
+                        sprintf(xbuf, "%llus", timo);
                else if (timo < 60*60)
-                        sprintf(xbuf, "%lum", timo / 60);
+                        sprintf(xbuf, "%llum", div_u64(timo, 60));
                else if (timo < 60*60*24)
-                        sprintf(xbuf, "%luh", timo / (60*60));
+                        sprintf(xbuf, "%lluh", div_u64(timo, 60 * 60));
                else if (timo < 60*60*24*7)
-                        sprintf(xbuf, "%lud", timo / (60*60*24));
+                        sprintf(xbuf, "%llud", div_u64(timo, 60 * 60 * 24));
                else
-                        sprintf(xbuf, "%luw", timo / (60*60*24*7));
+                        sprintf(xbuf, "%lluw", div_u64(timo, 60 * 60 * 24 * 7));
        }
-#define showflag(KEY, LETTER, FLAG) \
+        state = key_read_state(key);
-        (test_bit(FLAG, &(KEY)->flags) ? LETTER : '-')
+#define showflag(FLAGS, LETTER, FLAG) \
+        ((FLAGS & (1 << FLAG)) ? LETTER : '-')
+        flags = READ_ONCE(key->flags);
        seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ",
                   key->serial,
-                   showflag(key, 'I', KEY_FLAG_INSTANTIATED),
+                   state != KEY_IS_UNINSTANTIATED ? 'I' : '-',
-                   showflag(key, 'R', KEY_FLAG_REVOKED),
+                   showflag(flags, 'R', KEY_FLAG_REVOKED),
-                   showflag(key, 'D', KEY_FLAG_DEAD),
+                   showflag(flags, 'D', KEY_FLAG_DEAD),
-                   showflag(key, 'Q', KEY_FLAG_IN_QUOTA),
+                   showflag(flags, 'Q', KEY_FLAG_IN_QUOTA),
-                   showflag(key, 'U', KEY_FLAG_USER_CONSTRUCT),
+                   showflag(flags, 'U', KEY_FLAG_USER_CONSTRUCT),
-                   showflag(key, 'N', KEY_FLAG_NEGATIVE),
+                   state < 0 ? 'N' : '-',
-                   showflag(key, 'i', KEY_FLAG_INVALIDATED),
+                   showflag(flags, 'i', KEY_FLAG_INVALIDATED),
                   refcount_read(&key->usage),
                   xbuf,
                   key->perm,
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 86bced9fdbdf..d5b25e535d3a 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -77,7 +77,8 @@ int install_user_keyrings(void)
                if (IS_ERR(uid_keyring)) {
                        uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID,
                                                    cred, user_keyring_perm,
-                                                    KEY_ALLOC_IN_QUOTA,
+                                                    KEY_ALLOC_UID_KEYRING |
+                                                        KEY_ALLOC_IN_QUOTA,
                                                    NULL, NULL);
                        if (IS_ERR(uid_keyring)) {
                                ret = PTR_ERR(uid_keyring);
@@ -94,7 +95,8 @@ int install_user_keyrings(void)
                        session_keyring =
                                keyring_alloc(buf, user->uid, INVALID_GID,
                                              cred, user_keyring_perm,
-                                              KEY_ALLOC_IN_QUOTA,
+                                              KEY_ALLOC_UID_KEYRING |
+                                                  KEY_ALLOC_IN_QUOTA,
                                              NULL, NULL);
                        if (IS_ERR(session_keyring)) {
                                ret = PTR_ERR(session_keyring);
@@ -728,7 +730,7 @@ try_again:
        ret = -EIO;
        if (!(lflags & KEY_LOOKUP_PARTIAL) &&
-            !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+            key_read_state(key) == KEY_IS_UNINSTANTIATED)
                goto invalid_key;
        /* check the permissions */
@@ -736,7 +738,7 @@ try_again:
        if (ret < 0)
                goto invalid_key;
-        key->last_used_at = current_kernel_time().tv_sec;
+        key->last_used_at = ktime_get_real_seconds();
 error:
        put_cred(ctx.cred);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 63e63a42db3c..114f7408feee 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -251,11 +251,12 @@ static int construct_key(struct key *key, const void *callout_info,
 * The keyring selected is returned with an extra reference upon it which the
 * caller must release.
 */
-static void construct_get_dest_keyring(struct key **_dest_keyring)
+static int construct_get_dest_keyring(struct key **_dest_keyring)
 {
        struct request_key_auth *rka;
        const struct cred *cred = current_cred();
        struct key *dest_keyring = *_dest_keyring, *authkey;
+        int ret;
        kenter("%p", dest_keyring);
@@ -264,6 +265,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
                /* the caller supplied one */
                key_get(dest_keyring);
        } else {
+                bool do_perm_check = true;
                /* use a default keyring; falling through the cases until we
                 * find one that we actually have */
                switch (cred->jit_keyring) {
@@ -278,8 +281,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
                                        dest_keyring =
                                                key_get(rka->dest_keyring);
                                up_read(&authkey->sem);
-                                if (dest_keyring)
+                                if (dest_keyring) {
+                                        do_perm_check = false;
                                        break;
+                                }
                        }
                case KEY_REQKEY_DEFL_THREAD_KEYRING:
@@ -314,11 +319,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
                default:
                        BUG();
                }
+                /*
+                 * Require Write permission on the keyring.  This is essential
+                 * because the default keyring may be the session keyring, and
+                 * joining a keyring only requires Search permission.
+                 *
+                 * However, this check is skipped for the "requestor keyring" so
+                 * that /sbin/request-key can itself use request_key() to add
+                 * keys to the original requestor's destination keyring.
+                 */
+                if (dest_keyring && do_perm_check) {
+                        ret = key_permission(make_key_ref(dest_keyring, 1),
+                                             KEY_NEED_WRITE);
+                        if (ret) {
+                                key_put(dest_keyring);
+                                return ret;
+                        }
+                }
        }
        *_dest_keyring = dest_keyring;
        kleave(" [dk %d]", key_serial(dest_keyring));
-        return;
+        return 0;
 }
 /*
@@ -444,11 +467,15 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
        if (ctx->index_key.type == &key_type_keyring)
                return ERR_PTR(-EPERM);
-        user = key_user_lookup(current_fsuid());
+        ret = construct_get_dest_keyring(&dest_keyring);
-        if (!user)
+        if (ret)
-                return ERR_PTR(-ENOMEM);
+                goto error;
-        construct_get_dest_keyring(&dest_keyring);
+        user = key_user_lookup(current_fsuid());
+        if (!user) {
+                ret = -ENOMEM;
+                goto error_put_dest_keyring;
+        }
        ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
        key_user_put(user);
@@ -463,7 +490,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
        } else if (ret == -EINPROGRESS) {
                ret = 0;
        } else {
-                goto couldnt_alloc_key;
+                goto error_put_dest_keyring;
        }
        key_put(dest_keyring);
@@ -473,8 +500,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
 construction_failed:
        key_negate_and_link(key, key_negative_timeout, NULL, NULL);
        key_put(key);
-couldnt_alloc_key:
+error_put_dest_keyring:
        key_put(dest_keyring);
+error:
        kleave(" = %d", ret);
        return ERR_PTR(ret);
 }
@@ -546,9 +574,7 @@ struct key *request_key_and_link(struct key_type *type,
        if (!IS_ERR(key_ref)) {
                key = key_ref_to_ptr(key_ref);
                if (dest_keyring) {
-                        construct_get_dest_keyring(&dest_keyring);
                        ret = key_link(dest_keyring, key);
-                        key_put(dest_keyring);
                        if (ret < 0) {
                                key_put(key);
                                key = ERR_PTR(ret);
@@ -595,10 +621,9 @@ int wait_for_key_construction(struct key *key, bool intr)
                          intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
        if (ret)
                return -ERESTARTSYS;
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
+        ret = key_read_state(key);
-                smp_rmb();
+        if (ret < 0)
-                return key->reject_error;
+                return ret;
-        }
        return key_validate(key);
 }
 EXPORT_SYMBOL(wait_for_key_construction);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index afe9d22ab361..424e1d90412e 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -73,7 +73,7 @@ static void request_key_auth_describe(const struct key *key,
        seq_puts(m, "key:");
        seq_puts(m, key->description);
-        if (key_is_instantiated(key))
+        if (key_is_positive(key))
                seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
 }
@@ -120,6 +120,18 @@ static void request_key_auth_revoke(struct key *key)
        }
 }
+static void free_request_key_auth(struct request_key_auth *rka)
+{
+        if (!rka)
+                return;
+        key_put(rka->target_key);
+        key_put(rka->dest_keyring);
+        if (rka->cred)
+                put_cred(rka->cred);
+        kfree(rka->callout_info);
+        kfree(rka);
+}
 /*
 * Destroy an instantiation authorisation token key.
 */
@@ -129,15 +141,7 @@ static void request_key_auth_destroy(struct key *key)
        kenter("{%d}", key->serial);
-        if (rka->cred) {
+        free_request_key_auth(rka);
-                put_cred(rka->cred);
-                rka->cred = NULL;
-        }
-        key_put(rka->target_key);
-        key_put(rka->dest_keyring);
-        kfree(rka->callout_info);
-        kfree(rka);
 }
 /*
@@ -151,22 +155,18 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
        const struct cred *cred = current->cred;
        struct key *authkey = NULL;
        char desc[20];
-        int ret;
+        int ret = -ENOMEM;
        kenter("%d,", target->serial);
        /* allocate a auth record */
-        rka = kmalloc(sizeof(*rka), GFP_KERNEL);
+        rka = kzalloc(sizeof(*rka), GFP_KERNEL);
-        if (!rka) {
+        if (!rka)
-                kleave(" = -ENOMEM");
+                goto error;
-                return ERR_PTR(-ENOMEM);
+        rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
-        }
+        if (!rka->callout_info)
-        rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
+                goto error_free_rka;
-        if (!rka->callout_info) {
+        rka->callout_len = callout_len;
-                kleave(" = -ENOMEM");
-                kfree(rka);
-                return ERR_PTR(-ENOMEM);
-        }
        /* see if the calling process is already servicing the key request of
         * another process */
@@ -176,8 +176,12 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                /* if the auth key has been revoked, then the key we're
                 * servicing is already instantiated */
-                if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
+                if (test_bit(KEY_FLAG_REVOKED,
-                        goto auth_key_revoked;
+                             &cred->request_key_auth->flags)) {
+                        up_read(&cred->request_key_auth->sem);
+                        ret = -EKEYREVOKED;
+                        goto error_free_rka;
+                }
                irka = cred->request_key_auth->payload.data[0];
                rka->cred = get_cred(irka->cred);
@@ -193,8 +197,6 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
        rka->target_key = key_get(target);
        rka->dest_keyring = key_get(dest_keyring);
-        memcpy(rka->callout_info, callout_info, callout_len);
-        rka->callout_len = callout_len;
        /* allocate the auth key */
        sprintf(desc, "%x", target->serial);
@@ -205,32 +207,22 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                            KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
        if (IS_ERR(authkey)) {
                ret = PTR_ERR(authkey);
-                goto error_alloc;
+                goto error_free_rka;
        }
        /* construct the auth key */
        ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
        if (ret < 0)
-                goto error_inst;
+                goto error_put_authkey;
        kleave(" = {%d,%d}", authkey->serial, refcount_read(&authkey->usage));
        return authkey;
-auth_key_revoked:
+error_put_authkey:
-        up_read(&cred->request_key_auth->sem);
-        kfree(rka->callout_info);
-        kfree(rka);
-        kleave("= -EKEYREVOKED");
-        return ERR_PTR(-EKEYREVOKED);
-error_inst:
-        key_revoke(authkey);
        key_put(authkey);
-error_alloc:
+error_free_rka:
-        key_put(rka->target_key);
+        free_request_key_auth(rka);
-        key_put(rka->dest_keyring);
+error:
-        kfree(rka->callout_info);
-        kfree(rka);
        kleave("= %d", ret);
        return ERR_PTR(ret);
 }
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index ddfaebf60fc8..98aa89ff7bfd 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1066,7 +1066,7 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep)
        char *datablob;
        int ret = 0;
-        if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (key_is_negative(key))
                return -ENOKEY;
        p = key->payload.data[0];
        if (!p->migratable)
@@ -1147,20 +1147,21 @@ static long trusted_read(const struct key *key, char __user *buffer,
        p = dereference_key_locked(key);
        if (!p)
                return -EINVAL;
-        if (!buffer || buflen <= 0)
-                return 2 * p->blob_len;
-        ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
-        if (!ascii_buf)
-                return -ENOMEM;
-        bufp = ascii_buf;
+        if (buffer && buflen >= 2 * p->blob_len) {
-        for (i = 0; i < p->blob_len; i++)
+                ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
-                bufp = hex_byte_pack(bufp, p->blob[i]);
+                if (!ascii_buf)
-        if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
+                        return -ENOMEM;
+                bufp = ascii_buf;
+                for (i = 0; i < p->blob_len; i++)
+                        bufp = hex_byte_pack(bufp, p->blob[i]);
+                if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
+                        kzfree(ascii_buf);
+                        return -EFAULT;
+                }
                kzfree(ascii_buf);
-                return -EFAULT;
        }
-        kzfree(ascii_buf);
        return 2 * p->blob_len;
 }
diff --git a/security/keys/trusted.h b/security/keys/trusted.h
index ff001a5dcb24..8d5fe9eafb22 100644
--- a/security/keys/trusted.h
+++ b/security/keys/trusted.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #ifndef __TRUSTED_KEY_H
 #define __TRUSTED_KEY_H
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 3d8c68eba516..9f558bedba23 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -114,7 +114,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
        /* attach the new data, displacing the old */
        key->expiry = prep->expiry;
-        if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+        if (key_is_positive(key))
                zap = dereference_key_locked(key);
        rcu_assign_keypointer(key, prep->payload.data[0]);
        prep->payload.data[0] = NULL;
@@ -162,7 +162,7 @@ EXPORT_SYMBOL_GPL(user_destroy);
 void user_describe(const struct key *key, struct seq_file *m)
 {
        seq_puts(m, key->description);
-        if (key_is_instantiated(key))
+        if (key_is_positive(key))
                seq_printf(m, ": %u", key->datalen);
 }
diff --git a/security/min_addr.c b/security/min_addr.c
index f728728f193b..94d2b0cf0e7b 100644
--- a/security/min_addr.c
+++ b/security/min_addr.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 #include <linux/init.h>
 #include <linux/mm.h>
 #include <linux/security.h>
diff --git a/security/security.c b/security/security.c
index 4bf0f571b4ef..1cd8526cb0b7 100644
--- a/security/security.c
+++ b/security/security.c
@@ -12,6 +12,7 @@
 *      (at your option) any later version.
 */
+#include <linux/bpf.h>
 #include <linux/capability.h>
 #include <linux/dcache.h>
 #include <linux/module.h>
@@ -1703,3 +1704,34 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
                                actx);
 }
 #endif /* CONFIG_AUDIT */
+#ifdef CONFIG_BPF_SYSCALL
+int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
+{
+        return call_int_hook(bpf, 0, cmd, attr, size);
+}
+int security_bpf_map(struct bpf_map *map, fmode_t fmode)
+{
+        return call_int_hook(bpf_map, 0, map, fmode);
+}
+int security_bpf_prog(struct bpf_prog *prog)
+{
+        return call_int_hook(bpf_prog, 0, prog);
+}
+int security_bpf_map_alloc(struct bpf_map *map)
+{
+        return call_int_hook(bpf_map_alloc_security, 0, map);
+}
+int security_bpf_prog_alloc(struct bpf_prog_aux *aux)
+{
+        return call_int_hook(bpf_prog_alloc_security, 0, aux);
+}
+void security_bpf_map_free(struct bpf_map *map)
+{
+        call_void_hook(bpf_map_free_security, map);
+}
+void security_bpf_prog_free(struct bpf_prog_aux *aux)
+{
+        call_void_hook(bpf_prog_free_security, aux);
+}
+#endif /* CONFIG_BPF_SYSCALL */
diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index ff5895ede96f..c7161f8792b2 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 #
 # Makefile for building the SELinux module as part of the kernel tree.
 #
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f5d304736852..8644d864e3c1 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -85,6 +85,7 @@
 #include <linux/export.h>
 #include <linux/msg.h>
 #include <linux/shm.h>
+#include <linux/bpf.h>
 #include "avc.h"
 #include "objsec.h"
@@ -1814,6 +1815,10 @@ static inline int file_path_has_perm(const struct cred *cred,
        return inode_has_perm(cred, file_inode(file), av, &ad);
 }
+#ifdef CONFIG_BPF_SYSCALL
+static int bpf_fd_pass(struct file *file, u32 sid);
+#endif
 /* Check whether a task can use an open file descriptor to
   access an inode in a given way.  Check access to the
   descriptor itself, and then use dentry_has_perm to
@@ -1844,6 +1849,12 @@ static int file_has_perm(const struct cred *cred,
                        goto out;
        }
+#ifdef CONFIG_BPF_SYSCALL
+        rc = bpf_fd_pass(file, cred_sid(cred));
+        if (rc)
+                return rc;
+#endif
        /* av is zero if only checking access to the descriptor. */
        rc = 0;
        if (av)
@@ -2164,6 +2175,12 @@ static int selinux_binder_transfer_file(struct task_struct *from,
                        return rc;
        }
+#ifdef CONFIG_BPF_SYSCALL
+        rc = bpf_fd_pass(file, sid);
+        if (rc)
+                return rc;
+#endif
        if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
                return 0;
@@ -2918,13 +2935,12 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
 {
        const struct task_security_struct *tsec = current_security();
        struct superblock_security_struct *sbsec;
-        u32 sid, newsid, clen;
+        u32 newsid, clen;
        int rc;
        char *context;
        sbsec = dir->i_sb->s_security;
-        sid = tsec->sid;
        newsid = tsec->create_sid;
        rc = selinux_determine_inode_label(current_security(),
@@ -3124,27 +3140,6 @@ static int selinux_inode_getattr(const struct path *path)
        return path_has_perm(current_cred(), path, FILE__GETATTR);
 }
-static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
-{
-        const struct cred *cred = current_cred();
-        if (!strncmp(name, XATTR_SECURITY_PREFIX,
-                     sizeof XATTR_SECURITY_PREFIX - 1)) {
-                if (!strcmp(name, XATTR_NAME_CAPS)) {
-                        if (!capable(CAP_SETFCAP))
-                                return -EPERM;
-                } else if (!capable(CAP_SYS_ADMIN)) {
-                        /* A different attribute in the security namespace.
-                           Restrict to administrator. */
-                        return -EPERM;
-                }
-        }
-        /* Not an attribute we recognize, so just check the
-           ordinary setattr permission. */
-        return dentry_has_perm(cred, dentry, FILE__SETATTR);
-}
 static bool has_cap_mac_admin(bool audit)
 {
        const struct cred *cred = current_cred();
@@ -3167,8 +3162,15 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        u32 newsid, sid = current_sid();
        int rc = 0;
-        if (strcmp(name, XATTR_NAME_SELINUX))
+        if (strcmp(name, XATTR_NAME_SELINUX)) {
-                return selinux_inode_setotherxattr(dentry, name);
+                rc = cap_inode_setxattr(dentry, name, value, size, flags);
+                if (rc)
+                        return rc;
+                /* Not an attribute we recognize, so just check the
+                   ordinary setattr permission. */
+                return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+        }
        sbsec = inode->i_sb->s_security;
        if (!(sbsec->flags & SBLABEL_MNT))
@@ -3191,18 +3193,17 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
                if (!has_cap_mac_admin(true)) {
                        struct audit_buffer *ab;
                        size_t audit_size;
-                        const char *str;
                        /* We strip a nul only if it is at the end, otherwise the
                         * context contains a nul and we should audit that */
                        if (value) {
-                                str = value;
+                                const char *str = value;
                                if (str[size - 1] == '\0')
                                        audit_size = size - 1;
                                else
                                        audit_size = size;
                        } else {
-                                str = "";
                                audit_size = 0;
                        }
                        ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
@@ -3282,8 +3283,15 @@ static int selinux_inode_listxattr(struct dentry *dentry)
 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
 {
-        if (strcmp(name, XATTR_NAME_SELINUX))
+        if (strcmp(name, XATTR_NAME_SELINUX)) {
-                return selinux_inode_setotherxattr(dentry, name);
+                int rc = cap_inode_removexattr(dentry, name);
+                if (rc)
+                        return rc;
+                /* Not an attribute we recognize, so just check the
+                   ordinary setattr permission. */
+                return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
+        }
        /* No one is allowed to remove a SELinux security label.
           You can change the label, but all data must be labeled. */
@@ -3978,8 +3986,8 @@ static int selinux_task_getioprio(struct task_struct *p)
                            PROCESS__GETSCHED, NULL);
 }
-int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
+static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
-                         unsigned int flags)
+                                unsigned int flags)
 {
        u32 av = 0;
@@ -6252,6 +6260,139 @@ static void selinux_ib_free_security(void *ib_sec)
 }
 #endif
+#ifdef CONFIG_BPF_SYSCALL
+static int selinux_bpf(int cmd, union bpf_attr *attr,
+                                     unsigned int size)
+{
+        u32 sid = current_sid();
+        int ret;
+        switch (cmd) {
+        case BPF_MAP_CREATE:
+                ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
+                                   NULL);
+                break;
+        case BPF_PROG_LOAD:
+                ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
+                                   NULL);
+                break;
+        default:
+                ret = 0;
+                break;
+        }
+        return ret;
+}
+static u32 bpf_map_fmode_to_av(fmode_t fmode)
+{
+        u32 av = 0;
+        if (fmode & FMODE_READ)
+                av |= BPF__MAP_READ;
+        if (fmode & FMODE_WRITE)
+                av |= BPF__MAP_WRITE;
+        return av;
+}
+/* This function will check the file pass through unix socket or binder to see
+ * if it is a bpf related object. And apply correspinding checks on the bpf
+ * object based on the type. The bpf maps and programs, not like other files and
+ * socket, are using a shared anonymous inode inside the kernel as their inode.
+ * So checking that inode cannot identify if the process have privilege to
+ * access the bpf object and that's why we have to add this additional check in
+ * selinux_file_receive and selinux_binder_transfer_files.
+ */
+static int bpf_fd_pass(struct file *file, u32 sid)
+{
+        struct bpf_security_struct *bpfsec;
+        struct bpf_prog *prog;
+        struct bpf_map *map;
+        int ret;
+        if (file->f_op == &bpf_map_fops) {
+                map = file->private_data;
+                bpfsec = map->security;
+                ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
+                                   bpf_map_fmode_to_av(file->f_mode), NULL);
+                if (ret)
+                        return ret;
+        } else if (file->f_op == &bpf_prog_fops) {
+                prog = file->private_data;
+                bpfsec = prog->aux->security;
+                ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
+                                   BPF__PROG_RUN, NULL);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
+{
+        u32 sid = current_sid();
+        struct bpf_security_struct *bpfsec;
+        bpfsec = map->security;
+        return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
+                            bpf_map_fmode_to_av(fmode), NULL);
+}
+static int selinux_bpf_prog(struct bpf_prog *prog)
+{
+        u32 sid = current_sid();
+        struct bpf_security_struct *bpfsec;
+        bpfsec = prog->aux->security;
+        return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
+                            BPF__PROG_RUN, NULL);
+}
+static int selinux_bpf_map_alloc(struct bpf_map *map)
+{
+        struct bpf_security_struct *bpfsec;
+        bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
+        if (!bpfsec)
+                return -ENOMEM;
+        bpfsec->sid = current_sid();
+        map->security = bpfsec;
+        return 0;
+}
+static void selinux_bpf_map_free(struct bpf_map *map)
+{
+        struct bpf_security_struct *bpfsec = map->security;
+        map->security = NULL;
+        kfree(bpfsec);
+}
+static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
+{
+        struct bpf_security_struct *bpfsec;
+        bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
+        if (!bpfsec)
+                return -ENOMEM;
+        bpfsec->sid = current_sid();
+        aux->security = bpfsec;
+        return 0;
+}
+static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
+{
+        struct bpf_security_struct *bpfsec = aux->security;
+        aux->security = NULL;
+        kfree(bpfsec);
+}
+#endif
 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
        LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
@@ -6471,6 +6612,16 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
        LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
        LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
 #endif
+#ifdef CONFIG_BPF_SYSCALL
+        LSM_HOOK_INIT(bpf, selinux_bpf),
+        LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
+        LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
+        LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
+        LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
+        LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
+        LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
+#endif
 };
 static __init int selinux_init(void)
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index a5004e9de11a..57d61cf36500 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Access vector cache interface for object managers.
 *
diff --git a/security/selinux/include/avc_ss.h b/security/selinux/include/avc_ss.h
index 37d57dadd476..3bcc72769b87 100644
--- a/security/selinux/include/avc_ss.h
+++ b/security/selinux/include/avc_ss.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Access vector cache interface for the security server.
 *
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 35ffb29a69cb..acdee7795297 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 #include <linux/capability.h>
 #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
@@ -237,6 +238,8 @@ struct security_class_mapping secclass_map[] = {
          { "access", NULL } },
        { "infiniband_endport",
          { "manage_subnet", NULL } },
+        { "bpf",
+          {"map_create", "map_read", "map_write", "prog_load", "prog_run"} },
        { NULL }
  };
diff --git a/security/selinux/include/initial_sid_to_string.h b/security/selinux/include/initial_sid_to_string.h
index a59b64e3fd02..4f93f697f71c 100644
--- a/security/selinux/include/initial_sid_to_string.h
+++ b/security/selinux/include/initial_sid_to_string.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /* This file is automatically generated.  Do not edit. */
 static const char *initial_sid_to_string[] =
 {
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 1649cd18eb0b..3d54468ce334 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -150,6 +150,10 @@ struct pkey_security_struct {
        u32     sid;    /* SID of pkey */
 };
+struct bpf_security_struct {
+        u32 sid;  /*SID of bpf obj creater*/
+};
 extern unsigned int selinux_checkreqprot;
 #endif /* _SELINUX_OBJSEC_H_ */
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 28dfb2f93e4d..02f0412d42f2 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Security server interface.
 *
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 36a7ce9e11ff..1f173a7a4daa 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * SELinux support for the XFRM LSM hooks
 *
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 771c96afe1d5..c91543a617ac 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -361,7 +361,6 @@ static int cond_read_av_list(struct policydb *p, void *fp, struct cond_av_list *
        *ret_list = NULL;
-        len = 0;
        rc = next_entry(buf, fp, sizeof(u32));
        if (rc)
                return rc;
diff --git a/security/selinux/ss/constraint.h b/security/selinux/ss/constraint.h
index 33ae2aec4f36..4e563be9ef5f 100644
--- a/security/selinux/ss/constraint.h
+++ b/security/selinux/ss/constraint.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * A constraint is a condition that must be satisfied in
 * order for one or more permissions to be granted.
diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
index a2c0f37c42ae..2260c44a568c 100644
--- a/security/selinux/ss/context.h
+++ b/security/selinux/ss/context.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * A security context is a set of security attributes
 * associated with each subject and object controlled
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index fc28149a4f2e..b6a78b09235c 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Implementation of the extensible bitmap type.
 *
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index da1325dda550..edf4fa39c60a 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * An extensible bitmap is a bitmap that supports an
 * arbitrary number of bits.  Extensible bitmaps are
diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c
index 686c3917064c..fe25b3fb2154 100644
--- a/security/selinux/ss/hashtab.c
+++ b/security/selinux/ss/hashtab.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Implementation of the hash table type.
 *
@@ -9,6 +10,8 @@
 #include <linux/sched.h>
 #include "hashtab.h"
+static struct kmem_cache *hashtab_node_cachep;
 struct hashtab *hashtab_create(u32 (*hash_value)(struct hashtab *h, const void *key),
                               int (*keycmp)(struct hashtab *h, const void *key1, const void *key2),
                               u32 size)
@@ -57,7 +60,7 @@ int hashtab_insert(struct hashtab *h, void *key, void *datum)
        if (cur && (h->keycmp(h, key, cur->key) == 0))
                return -EEXIST;
-        newnode = kzalloc(sizeof(*newnode), GFP_KERNEL);
+        newnode = kmem_cache_zalloc(hashtab_node_cachep, GFP_KERNEL);
        if (!newnode)
                return -ENOMEM;
        newnode->key = key;
@@ -106,7 +109,7 @@ void hashtab_destroy(struct hashtab *h)
                while (cur) {
                        temp = cur;
                        cur = cur->next;
-                        kfree(temp);
+                        kmem_cache_free(hashtab_node_cachep, temp);
                }
                h->htable[i] = NULL;
        }
@@ -148,7 +151,7 @@ void hashtab_stat(struct hashtab *h, struct hashtab_info *info)
        slots_used = 0;
        max_chain_len = 0;
-        for (slots_used = max_chain_len = i = 0; i < h->size; i++) {
+        for (i = 0; i < h->size; i++) {
                cur = h->htable[i];
                if (cur) {
                        slots_used++;
@@ -166,3 +169,14 @@ void hashtab_stat(struct hashtab *h, struct hashtab_info *info)
        info->slots_used = slots_used;
        info->max_chain_len = max_chain_len;
 }
+void hashtab_cache_init(void)
+{
+                hashtab_node_cachep = kmem_cache_create("hashtab_node",
+                        sizeof(struct hashtab_node),
+                        0, SLAB_PANIC, NULL);
+}
+void hashtab_cache_destroy(void)
+{
+                kmem_cache_destroy(hashtab_node_cachep);
+}
diff --git a/security/selinux/ss/hashtab.h b/security/selinux/ss/hashtab.h
index 009fb5e06172..6183ee2a2e7a 100644
--- a/security/selinux/ss/hashtab.h
+++ b/security/selinux/ss/hashtab.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * A hash table (hashtab) maintains associations between
 * key values and datum values.  The type of the key values
@@ -84,4 +85,8 @@ int hashtab_map(struct hashtab *h,
 /* Fill info with some hash table statistics */
 void hashtab_stat(struct hashtab *h, struct hashtab_info *info);
+/* Use kmem_cache for hashtab_node */
+void hashtab_cache_init(void);
+void hashtab_cache_destroy(void);
 #endif  /* _SS_HASHTAB_H */
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index d9dc34f4fade..ad982ce8bfa4 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Implementation of the multi-level security (MLS) policy.
 *
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index 0f0a1d65b2ce..131d76266ea5 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Multi-level security (MLS) policy operations.
 *
diff --git a/security/selinux/ss/mls_types.h b/security/selinux/ss/mls_types.h
index 47f3702cd596..068e0d7809db 100644
--- a/security/selinux/ss/mls_types.h
+++ b/security/selinux/ss/mls_types.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Type definitions for the multi-level security (MLS) policy.
 *
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index e4a1c0dc561a..33cfe5d3d6cb 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2060,10 +2060,12 @@ int security_load_policy(void *data, size_t len)
        if (!ss_initialized) {
                avtab_cache_init();
                ebitmap_cache_init();
+                hashtab_cache_init();
                rc = policydb_read(&policydb, fp);
                if (rc) {
                        avtab_cache_destroy();
                        ebitmap_cache_destroy();
+                        hashtab_cache_destroy();
                        goto out;
                }
@@ -2075,6 +2077,7 @@ int security_load_policy(void *data, size_t len)
                        policydb_destroy(&policydb);
                        avtab_cache_destroy();
                        ebitmap_cache_destroy();
+                        hashtab_cache_destroy();
                        goto out;
                }
@@ -2083,6 +2086,7 @@ int security_load_policy(void *data, size_t len)
                        policydb_destroy(&policydb);
                        avtab_cache_destroy();
                        ebitmap_cache_destroy();
+                        hashtab_cache_destroy();
                        goto out;
                }
diff --git a/security/selinux/ss/services.h b/security/selinux/ss/services.h
index 3d9fa9556b4f..356bdd36cf6d 100644
--- a/security/selinux/ss/services.h
+++ b/security/selinux/ss/services.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * Implementation of the security services.
 *
diff --git a/security/selinux/ss/sidtab.c b/security/selinux/ss/sidtab.c
index 6ae08efc5ae7..5be31b7af225 100644
--- a/security/selinux/ss/sidtab.c
+++ b/security/selinux/ss/sidtab.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Implementation of the SID table type.
 *
diff --git a/security/selinux/ss/sidtab.h b/security/selinux/ss/sidtab.h
index de5d0ea583d2..a1a1d2617b6f 100644
--- a/security/selinux/ss/sidtab.h
+++ b/security/selinux/ss/sidtab.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * A security identifier table (sidtab) is a hash table
 * of security context structures indexed by SID value.
diff --git a/security/selinux/ss/symtab.c b/security/selinux/ss/symtab.c
index d1a6745849a7..dc2ce94165d3 100644
--- a/security/selinux/ss/symtab.c
+++ b/security/selinux/ss/symtab.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * Implementation of the symbol table type.
 *
diff --git a/security/selinux/ss/symtab.h b/security/selinux/ss/symtab.h
index 0bc12d587d3a..d75fcafe7281 100644
--- a/security/selinux/ss/symtab.h
+++ b/security/selinux/ss/symtab.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * A symbol table (symtab) maintains associations between symbol
 * strings and datum values.  The type of the datum values
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 569f28034116..14cc7940b36d 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1473,7 +1473,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
 * @inode: the object
 * @name: attribute name
 * @buffer: where to put the result
- * @alloc: unused
+ * @alloc: duplicate memory
 *
 * Returns the size of the attribute or an error code
 */
@@ -1486,43 +1486,38 @@ static int smack_inode_getsecurity(struct inode *inode,
        struct super_block *sbp;
        struct inode *ip = (struct inode *)inode;
        struct smack_known *isp;
-        int ilen;
-        int rc = 0;
-        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
+        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0)
                isp = smk_of_inode(inode);
-                ilen = strlen(isp->smk_known);
+        else {
-                *buffer = isp->smk_known;
+                /*
-                return ilen;
+                 * The rest of the Smack xattrs are only on sockets.
-        }
+                 */
+                sbp = ip->i_sb;
+                if (sbp->s_magic != SOCKFS_MAGIC)
+                        return -EOPNOTSUPP;
-        /*
+                sock = SOCKET_I(ip);
-         * The rest of the Smack xattrs are only on sockets.
+                if (sock == NULL || sock->sk == NULL)
-         */
+                        return -EOPNOTSUPP;
-        sbp = ip->i_sb;
-        if (sbp->s_magic != SOCKFS_MAGIC)
-                return -EOPNOTSUPP;
-        sock = SOCKET_I(ip);
+                ssp = sock->sk->sk_security;
-        if (sock == NULL || sock->sk == NULL)
-                return -EOPNOTSUPP;
-        ssp = sock->sk->sk_security;
-        if (strcmp(name, XATTR_SMACK_IPIN) == 0)
+                if (strcmp(name, XATTR_SMACK_IPIN) == 0)
-                isp = ssp->smk_in;
+                        isp = ssp->smk_in;
-        else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
+                else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
-                isp = ssp->smk_out;
+                        isp = ssp->smk_out;
-        else
+                else
-                return -EOPNOTSUPP;
+                        return -EOPNOTSUPP;
+        }
-        ilen = strlen(isp->smk_known);
+        if (alloc) {
-        if (rc == 0) {
+                *buffer = kstrdup(isp->smk_known, GFP_KERNEL);
-                *buffer = isp->smk_known;
+                if (*buffer == NULL)
-                rc = ilen;
+                        return -ENOMEM;
        }
-        return rc;
+        return strlen(isp->smk_known);
 }
diff --git a/security/tomoyo/Makefile b/security/tomoyo/Makefile
index 65dbcb2fd850..b7c6a7ffc058 100644
--- a/security/tomoyo/Makefile
+++ b/security/tomoyo/Makefile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
 obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
 targets += builtin-policy.h
diff --git a/security/tomoyo/audit.c b/security/tomoyo/audit.c
index a51edfbe593b..0f73fe30e37a 100644
--- a/security/tomoyo/audit.c
+++ b/security/tomoyo/audit.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/audit.c
 *
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index c19970db89c4..25eed4b0b0e8 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/common.c
 *
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index d9628d1635b2..7adccdd8e36d 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
 * security/tomoyo/common.h
 *
diff --git a/security/tomoyo/condition.c b/security/tomoyo/condition.c
index 6c4528d4b48f..8d0e1b9c9c57 100644
--- a/security/tomoyo/condition.c
+++ b/security/tomoyo/condition.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/condition.c
 *
diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c
index 00d223e9fb37..f6758dad981f 100644
--- a/security/tomoyo/domain.c
+++ b/security/tomoyo/domain.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/domain.c
 *
diff --git a/security/tomoyo/environ.c b/security/tomoyo/environ.c
index ad4c6e18a437..7f0a471f19b2 100644
--- a/security/tomoyo/environ.c
+++ b/security/tomoyo/environ.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/environ.c
 *
diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
index 223f21ffa632..2a374b4da8f5 100644
--- a/security/tomoyo/file.c
+++ b/security/tomoyo/file.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/file.c
 *
diff --git a/security/tomoyo/gc.c b/security/tomoyo/gc.c
index 540bc29e1b5a..e22bea811c57 100644
--- a/security/tomoyo/gc.c
+++ b/security/tomoyo/gc.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/gc.c
 *
diff --git a/security/tomoyo/group.c b/security/tomoyo/group.c
index 944ad77d8fba..21b0cc3a7e1a 100644
--- a/security/tomoyo/group.c
+++ b/security/tomoyo/group.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/group.c
 *
diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c
index 078fac0bb4c5..81b951652051 100644
--- a/security/tomoyo/load_policy.c
+++ b/security/tomoyo/load_policy.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/load_policy.c
 *
diff --git a/security/tomoyo/memory.c b/security/tomoyo/memory.c
index 1598b559ac42..12477e0b0a11 100644
--- a/security/tomoyo/memory.c
+++ b/security/tomoyo/memory.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/memory.c
 *
diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
index 14b53fb2a0cf..807fd91dbb54 100644
--- a/security/tomoyo/mount.c
+++ b/security/tomoyo/mount.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/mount.c
 *
diff --git a/security/tomoyo/network.c b/security/tomoyo/network.c
index 6c02ac478247..cd6932e5225c 100644
--- a/security/tomoyo/network.c
+++ b/security/tomoyo/network.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/network.c
 *
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index a97b275ca3af..6ff8c21e4fff 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/realpath.c
 *
diff --git a/security/tomoyo/securityfs_if.c b/security/tomoyo/securityfs_if.c
index 06ab41b1ff28..49393c2a3f8b 100644
--- a/security/tomoyo/securityfs_if.c
+++ b/security/tomoyo/securityfs_if.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/securityfs_if.c
 *
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index d25b705360e0..213b8c593668 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/tomoyo.c
 *
diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index cac431d381d2..d3d9d9f1edb0 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
 * security/tomoyo/util.c
 *
author	James Morris <james.l.morris@oracle.com>	2017-12-11 01:01:08 -0500
committer	James Morris <james.l.morris@oracle.com>	2017-12-11 01:01:08 -0500
commit	d21bd6898336a7892914d308d5e0868f0b863571 (patch)
tree	f5f756c25348b5a6c1ce9ddbaa7d1ecd1bef40b0 /security
parent	34d8751fd4ffa34e85ee7e85d34168b3f3f62b42 (diff)
parent	50c4c4e268a2d7a3e58ebb698ac74da0de40ae36 (diff)