Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem updates from James Morris:
 "New notable features:
   - The seccomp work from Will Drewry
   - PR_{GET,SET}_NO_NEW_PRIVS from Andy Lutomirski
   - Longer security labels for Smack from Casey Schaufler
   - Additional ptrace restriction modes for Yama by Kees Cook"

Fix up trivial context conflicts in arch/x86/Kconfig and include/linux/filter.h

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (65 commits)
  apparmor: fix long path failure due to disconnected path
  apparmor: fix profile lookup for unconfined
  ima: fix filename hint to reflect script interpreter name
  KEYS: Don't check for NULL key pointer in key_validate()
  Smack: allow for significantly longer Smack labels v4
  gfp flags for security_inode_alloc()?
  Smack: recursive tramsmute
  Yama: replace capable() with ns_capable()
  TOMOYO: Accept manager programs which do not start with / .
  KEYS: Add invalidation support
  KEYS: Do LRU discard in full keyrings
  KEYS: Permit in-place link replacement in keyring list
  KEYS: Perform RCU synchronisation on keys prior to key destruction
  KEYS: Announce key type (un)registration
  KEYS: Reorganise keys Makefile
  KEYS: Move the key config into security/keys/Kconfig
  KEYS: Use the compat keyctl() syscall wrapper on Sparc64 for Sparc32 compat
  Yama: remove an unused variable
  samples/seccomp: fix dependencies on arch macros
  Yama: add additional ptrace scopes
  ...

1 files changed, 23 insertions, 0 deletions

diff --git a/arch/Kconfig b/arch/Kconfig
index bd265a217bd2..1f9461b9cc89 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -231,4 +231,27 @@ config HAVE_CMPXCHG_DOUBLE
 config ARCH_WANT_OLD_COMPAT_IPC
         bool
 
+config HAVE_ARCH_SECCOMP_FILTER
+        bool
+        help
+          An arch should select this symbol if it provides all of these things:
+          - syscall_get_arch()
+          - syscall_get_arguments()
+          - syscall_rollback()
+          - syscall_set_return_value()
+          - SIGSYS siginfo_t support
+          - secure_computing is called from a ptrace_event()-safe context
+          - secure_computing return value is checked and a return value of -1
+            results in the system call being skipped immediately.
+
+config SECCOMP_FILTER
+        def_bool y
+        depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
+        help
+          Enable tasks to build secure computing environments defined
+          in terms of Berkeley Packet Filter programs which implement
+          task-defined system call filtering polices.
+
+          See Documentation/prctl/seccomp_filter.txt for details.
+
 source "kernel/gcov/Kconfig"