Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit: (29 commits)
  audit: no leading space in audit_log_d_path prefix
  audit: treat s_id as an untrusted string
  audit: fix signedness bug in audit_log_execve_info()
  audit: comparison on interprocess fields
  audit: implement all object interfield comparisons
  audit: allow interfield comparison between gid and ogid
  audit: complex interfield comparison helper
  audit: allow interfield comparison in audit rules
  Kernel: Audit Support For The ARM Platform
  audit: do not call audit_getname on error
  audit: only allow tasks to set their loginuid if it is -1
  audit: remove task argument to audit_set_loginuid
  audit: allow audit matching on inode gid
  audit: allow matching on obj_uid
  audit: remove audit_finish_fork as it can't be called
  audit: reject entry,always rules
  audit: inline audit_free to simplify the look of generic code
  audit: drop audit_set_macxattr as it doesn't do anything
  audit: inline checks for not needing to collect aux records
  audit: drop some potentially inadvisable likely notations
  ...

Use evil merge to fix up grammar mistakes in Kconfig file.

Bad speling and horrible grammar (and copious swearing) is to be
expected, but let's keep it to commit messages and comments, rather than
expose it to users in config help texts or printouts.

1 files changed, 15 insertions, 1 deletions

diff --git a/init/Kconfig b/init/Kconfig
index 6ac2236244c..3f42cd66f0f 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -355,7 +355,7 @@ config AUDIT
 
 config AUDITSYSCALL
         bool "Enable system-call auditing support"
-        depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH)
+        depends on AUDIT && (X86 || PPC || S390 || IA64 || UML || SPARC64 || SUPERH || ARM)
         default y if SECURITY_SELINUX
         help
           Enable low-overhead system-call auditing infrastructure that
@@ -372,6 +372,20 @@ config AUDIT_TREE
         depends on AUDITSYSCALL
         select FSNOTIFY
 
+config AUDIT_LOGINUID_IMMUTABLE
+        bool "Make audit loginuid immutable"
+        depends on AUDIT
+        help
+          The config option toggles if a task setting its loginuid requires
+          CAP_SYS_AUDITCONTROL or if that task should require no special permissions
+          but should instead only allow setting its loginuid if it was never
+          previously set.  On systems which use systemd or a similar central
+          process to restart login services this should be set to true.  On older
+          systems in which an admin would typically have to directly stop and
+          start processes this should be set to false.  Setting this to true allows
+          one to drop potentially dangerous capabilites from the login tasks,
+          but may not be backwards compatible with older init systems.
+
 source "kernel/irq/Kconfig"
 
 menu "RCU Subsystem"