Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (105 commits)
  SELinux: don't check permissions for kernel mounts
  security: pass mount flags to security_sb_kern_mount()
  SELinux: correctly detect proc filesystems of the form "proc/foo"
  Audit: Log TIOCSTI
  user namespaces: document CFS behavior
  user namespaces: require cap_set{ug}id for CLONE_NEWUSER
  user namespaces: let user_ns be cloned with fairsched
  CRED: fix sparse warnings
  User namespaces: use the current_user_ns() macro
  User namespaces: set of cleanups (v2)
  nfsctl: add headers for credentials
  coda: fix creds reference
  capabilities: define get_vfs_caps_from_disk when file caps are not enabled
  CRED: Allow kernel services to override LSM settings for task actions
  CRED: Add a kernel_service object class to SELinux
  CRED: Differentiate objective and effective subjective credentials on a task
  CRED: Documentation
  CRED: Use creds in file structs
  CRED: Prettify commoncap.c
  CRED: Make execve() take advantage of copy-on-write credentials
  ...

1 files changed, 14 insertions, 13 deletions

diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c
index c6983978a31e..6913f727624d 100644
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -360,7 +360,8 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
         struct ecryptfs_msg_ctx *msg_ctx;
         size_t msg_size;
         struct nsproxy *nsproxy;
-        struct user_namespace *current_user_ns;
+        struct user_namespace *tsk_user_ns;
+        uid_t ctx_euid;
         int rc;
 
         if (msg->index >= ecryptfs_message_buf_len) {
@@ -384,9 +385,9 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
                 mutex_unlock(&ecryptfs_daemon_hash_mux);
                 goto wake_up;
         }
-        current_user_ns = nsproxy->user_ns;
-        rc = ecryptfs_find_daemon_by_euid(&daemon, msg_ctx->task->euid,
-                                          current_user_ns);
+        tsk_user_ns = __task_cred(msg_ctx->task)->user->user_ns;
+        ctx_euid = task_euid(msg_ctx->task);
+        rc = ecryptfs_find_daemon_by_euid(&daemon, ctx_euid, tsk_user_ns);
         rcu_read_unlock();
         mutex_unlock(&ecryptfs_daemon_hash_mux);
         if (rc) {
@@ -394,28 +395,28 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t euid,
                 printk(KERN_WARNING "%s: User [%d] received a "
                        "message response from process [0x%p] but does "
                        "not have a registered daemon\n", __func__,
-                       msg_ctx->task->euid, pid);
+                       ctx_euid, pid);
                 goto wake_up;
         }
-        if (msg_ctx->task->euid != euid) {
+        if (ctx_euid != euid) {
                 rc = -EBADMSG;
                 printk(KERN_WARNING "%s: Received message from user "
                        "[%d]; expected message from user [%d]\n", __func__,
-                       euid, msg_ctx->task->euid);
+                       euid, ctx_euid);
                 goto unlock;
         }
-        if (current_user_ns != user_ns) {
+        if (tsk_user_ns != user_ns) {
                 rc = -EBADMSG;
                 printk(KERN_WARNING "%s: Received message from user_ns "
                        "[0x%p]; expected message from user_ns [0x%p]\n",
-                       __func__, user_ns, nsproxy->user_ns);
+                       __func__, user_ns, tsk_user_ns);
                 goto unlock;
         }
         if (daemon->pid != pid) {
                 rc = -EBADMSG;
                 printk(KERN_ERR "%s: User [%d] sent a message response "
                        "from an unrecognized process [0x%p]\n",
-                       __func__, msg_ctx->task->euid, pid);
+                       __func__, ctx_euid, pid);
                 goto unlock;
         }
         if (msg_ctx->state != ECRYPTFS_MSG_CTX_STATE_PENDING) {
@@ -464,14 +465,14 @@ ecryptfs_send_message_locked(char *data, int data_len, u8 msg_type,
                              struct ecryptfs_msg_ctx **msg_ctx)
 {
         struct ecryptfs_daemon *daemon;
+        uid_t euid = current_euid();
         int rc;
 
-        rc = ecryptfs_find_daemon_by_euid(&daemon, current->euid,
-                                          current->nsproxy->user_ns);
+        rc = ecryptfs_find_daemon_by_euid(&daemon, euid, current_user_ns());
         if (rc || !daemon) {
                 rc = -ENOTCONN;
                 printk(KERN_ERR "%s: User [%d] does not have a daemon "
-                       "registered\n", __func__, current->euid);
+                       "registered\n", __func__, euid);
                 goto out;
         }
         mutex_lock(&ecryptfs_msg_ctx_lists_mux);