Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  selinux: make mls_compute_sid always polyinstantiate
  security/selinux: constify function pointer tables and fields
  security: add a secctx_to_secid() hook
  security: call security_file_permission from rw_verify_area
  security: remove security_sb_post_mountroot hook
  Security: remove security.h include from mm.h
  Security: remove security_file_mmap hook sparse-warnings (NULL as 0).
  Security: add get, set, and cloning of superblock security information
  security/selinux: Add missing "space"

8 files changed, 564 insertions, 277 deletions

diff --git a/security/dummy.c b/security/dummy.c
index 3ccfbbe973b..48d4b0a5273 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -225,22 +225,40 @@ static void dummy_sb_post_remount (struct vfsmount *mnt, unsigned long flags,
 }
 
 
-static void dummy_sb_post_mountroot (void)
+static void dummy_sb_post_addmount (struct vfsmount *mnt, struct nameidata *nd)
 {
         return;
 }
 
-static void dummy_sb_post_addmount (struct vfsmount *mnt, struct nameidata *nd)
+static int dummy_sb_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
+{
+        return 0;
+}
+
+static void dummy_sb_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
 {
         return;
 }
 
-static int dummy_sb_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
+static int dummy_sb_get_mnt_opts(const struct super_block *sb, char ***mount_options,
+                                 int **flags, int *num_opts)
 {
+        *mount_options = NULL;
+        *flags = NULL;
+        *num_opts = 0;
         return 0;
 }
 
-static void dummy_sb_post_pivotroot (struct nameidata *old_nd, struct nameidata *new_nd)
+static int dummy_sb_set_mnt_opts(struct super_block *sb, char **mount_options,
+                                 int *flags, int num_opts)
+{
+        if (unlikely(num_opts))
+                return -EOPNOTSUPP;
+        return 0;
+}
+
+static void dummy_sb_clone_mnt_opts(const struct super_block *oldsb,
+                                    struct super_block *newsb)
 {
         return;
 }
@@ -928,6 +946,11 @@ static int dummy_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
         return -EOPNOTSUPP;
 }
 
+static int dummy_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
+{
+        return -EOPNOTSUPP;
+}
+
 static void dummy_release_secctx(char *secdata, u32 seclen)
 {
 }
@@ -994,10 +1017,12 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, sb_umount_close);
         set_to_dummy_if_null(ops, sb_umount_busy);
         set_to_dummy_if_null(ops, sb_post_remount);
-        set_to_dummy_if_null(ops, sb_post_mountroot);
         set_to_dummy_if_null(ops, sb_post_addmount);
         set_to_dummy_if_null(ops, sb_pivotroot);
         set_to_dummy_if_null(ops, sb_post_pivotroot);
+        set_to_dummy_if_null(ops, sb_get_mnt_opts);
+        set_to_dummy_if_null(ops, sb_set_mnt_opts);
+        set_to_dummy_if_null(ops, sb_clone_mnt_opts);
         set_to_dummy_if_null(ops, inode_alloc_security);
         set_to_dummy_if_null(ops, inode_free_security);
         set_to_dummy_if_null(ops, inode_init_security);
@@ -1086,6 +1111,7 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, getprocattr);
         set_to_dummy_if_null(ops, setprocattr);
         set_to_dummy_if_null(ops, secid_to_secctx);
+        set_to_dummy_if_null(ops, secctx_to_secid);
         set_to_dummy_if_null(ops, release_secctx);
 #ifdef CONFIG_SECURITY_NETWORK
         set_to_dummy_if_null(ops, unix_stream_connect);
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 3e0d0a6e224..694126003ed 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -26,7 +26,7 @@ static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos);
 static void proc_keys_stop(struct seq_file *p, void *v);
 static int proc_keys_show(struct seq_file *m, void *v);
 
-static struct seq_operations proc_keys_ops = {
+static const struct seq_operations proc_keys_ops = {
         .start  = proc_keys_start,
         .next   = proc_keys_next,
         .stop   = proc_keys_stop,
@@ -47,7 +47,7 @@ static void *proc_key_users_next(struct seq_file *p, void *v, loff_t *_pos);
 static void proc_key_users_stop(struct seq_file *p, void *v);
 static int proc_key_users_show(struct seq_file *m, void *v);
 
-static struct seq_operations proc_key_users_ops = {
+static const struct seq_operations proc_key_users_ops = {
         .start  = proc_key_users_start,
         .next   = proc_key_users_next,
         .stop   = proc_key_users_stop,
diff --git a/security/security.c b/security/security.c
index 0e1f1f12436..ca475ca206e 100644
--- a/security/security.c
+++ b/security/security.c
@@ -288,11 +288,6 @@ void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *d
         security_ops->sb_post_remount(mnt, flags, data);
 }
 
-void security_sb_post_mountroot(void)
-{
-        security_ops->sb_post_mountroot();
-}
-
 void security_sb_post_addmount(struct vfsmount *mnt, struct nameidata *mountpoint_nd)
 {
         security_ops->sb_post_addmount(mnt, mountpoint_nd);
@@ -308,6 +303,26 @@ void security_sb_post_pivotroot(struct nameidata *old_nd, struct nameidata *new_
         security_ops->sb_post_pivotroot(old_nd, new_nd);
 }
 
+int security_sb_get_mnt_opts(const struct super_block *sb,
+                              char ***mount_options,
+                              int **flags, int *num_opts)
+{
+        return security_ops->sb_get_mnt_opts(sb, mount_options, flags, num_opts);
+}
+
+int security_sb_set_mnt_opts(struct super_block *sb,
+                              char **mount_options,
+                              int *flags, int num_opts)
+{
+        return security_ops->sb_set_mnt_opts(sb, mount_options, flags, num_opts);
+}
+
+void security_sb_clone_mnt_opts(const struct super_block *oldsb,
+                                struct super_block *newsb)
+{
+        security_ops->sb_clone_mnt_opts(oldsb, newsb);
+}
+
 int security_inode_alloc(struct inode *inode)
 {
         inode->i_security = NULL;
@@ -816,6 +831,12 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 }
 EXPORT_SYMBOL(security_secid_to_secctx);
 
+int security_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
+{
+        return security_ops->secctx_to_secid(secdata, seclen, secid);
+}
+EXPORT_SYMBOL(security_secctx_to_secid);
+
 void security_release_secctx(char *secdata, u32 seclen)
 {
         return security_ops->release_secctx(secdata, seclen);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9f3124b0886..0396354fff9 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -82,6 +82,8 @@
 #define XATTR_SELINUX_SUFFIX "selinux"
 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
 
+#define NUM_SEL_MNT_OPTS 4
+
 extern unsigned int policydb_loaded_version;
 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
 extern int selinux_compat_net;
@@ -321,8 +323,8 @@ enum {
         Opt_error = -1,
         Opt_context = 1,