Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security

* 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
  TOMOYO: Fix incomplete read after seek.
  Smack: allow to access /smack/access as normal user
  TOMOYO: Fix unused kernel config option.
  Smack: fix: invalid length set for the result of /smack/access
  Smack: compilation fix
  Smack: fix for /smack/access output, use string instead of byte
  Smack: domain transition protections (v3)
  Smack: Provide information for UDS getsockopt(SO_PEERCRED)
  Smack: Clean up comments
  Smack: Repair processing of fcntl
  Smack: Rule list lookup performance
  Smack: check permissions from user space (v2)
  TOMOYO: Fix quota and garbage collector.
  TOMOYO: Remove redundant tasklist_lock.
  TOMOYO: Fix domain transition failure warning.
  TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
  TOMOYO: Simplify garbage collector.
  TOMOYO: Fix make namespacecheck warnings.
  target: check hex2bin result
  encrypted-keys: check hex2bin result
  ...

13 files changed, 278 insertions, 197 deletions

diff --git a/fs/attr.c b/fs/attr.c
index 538e27959d3f..7ee7ba488313 100644
--- a/fs/attr.c
+++ b/fs/attr.c
@@ -13,6 +13,7 @@
 #include <linux/fsnotify.h>
 #include <linux/fcntl.h>
 #include <linux/security.h>
+#include <linux/evm.h>
 
 /**
  * inode_change_ok - check if attribute changes to an inode are allowed
@@ -237,8 +238,10 @@ int notify_change(struct dentry * dentry, struct iattr * attr)
         else
                 error = simple_setattr(dentry, attr);
 
-        if (!error)
+        if (!error) {
                 fsnotify_change(dentry, ia_valid);
+                evm_inode_post_setattr(dentry, ia_valid);
+        }
 
         return error;
 }
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 69565e5fc6a0..426aa464f1af 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -383,36 +383,36 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
                                 XATTR_REPLACE);
 }
 
-int btrfs_xattr_security_init(struct btrfs_trans_handle *trans,
-                              struct inode *inode, struct inode *dir,
-                              const struct qstr *qstr)
+int btrfs_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                     void *fs_info)
 {
-        int err;
-        size_t len;
-        void *value;
-        char *suffix;
+        const struct xattr *xattr;
+        struct btrfs_trans_handle *trans = fs_info;
         char *name;
+        int err = 0;
 
-        err = security_inode_init_security(inode, dir, qstr, &suffix, &value,
-                                           &len);
-        if (err) {
-                if (err == -EOPNOTSUPP)
-                        return 0;
-                return err;
-        }
-
-        name = kmalloc(XATTR_SECURITY_PREFIX_LEN + strlen(suffix) + 1,
-                       GFP_NOFS);
-        if (!name) {
-                err = -ENOMEM;
-        } else {
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
+                               strlen(xattr->name) + 1, GFP_NOFS);
+                if (!name) {
+                        err = -ENOMEM;
+                        break;
+                }
                 strcpy(name, XATTR_SECURITY_PREFIX);
-                strcpy(name + XATTR_SECURITY_PREFIX_LEN, suffix);
-                err = __btrfs_setxattr(trans, inode, name, value, len, 0);
+                strcpy(name + XATTR_SECURITY_PREFIX_LEN, xattr->name);
+                err = __btrfs_setxattr(trans, inode, name,
+                                       xattr->value, xattr->value_len, 0);
                 kfree(name);
+                if (err < 0)
+                        break;
         }
-
-        kfree(suffix);
-        kfree(value);
         return err;
 }
+
+int btrfs_xattr_security_init(struct btrfs_trans_handle *trans,
+                              struct inode *inode, struct inode *dir,
+                              const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                            &btrfs_initxattrs, trans);
+}
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 2a22fb2989e4..c32308882148 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -22,6 +22,7 @@
 #include <linux/fs.h>
 #include <linux/posix_acl_xattr.h>
 #include <linux/slab.h>
+#include <linux/xattr.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
 #include "cifsglob.h"
@@ -31,16 +32,8 @@
 #define MAX_EA_VALUE_SIZE 65535
 #define CIFS_XATTR_DOS_ATTRIB "user.DosAttrib"
 #define CIFS_XATTR_CIFS_ACL "system.cifs_acl"
-#define CIFS_XATTR_USER_PREFIX "user."
-#define CIFS_XATTR_SYSTEM_PREFIX "system."
-#define CIFS_XATTR_OS2_PREFIX "os2."
-#define CIFS_XATTR_SECURITY_PREFIX "security."
-#define CIFS_XATTR_TRUSTED_PREFIX "trusted."
-#define XATTR_TRUSTED_PREFIX_LEN  8
-#define XATTR_SECURITY_PREFIX_LEN 9
-/* BB need to add server (Samba e.g) support for security and trusted prefix */
-
 
+/* BB need to add server (Samba e.g) support for security and trusted prefix */
 
 int cifs_removexattr(struct dentry *direntry, const char *ea_name)
 {
@@ -76,8 +69,8 @@ int cifs_removexattr(struct dentry *direntry, const char *ea_name)
         }
         if (ea_name == NULL) {
                 cFYI(1, "Null xattr names not supported");
-        } else if (strncmp(ea_name, CIFS_XATTR_USER_PREFIX, 5)
-                && (strncmp(ea_name, CIFS_XATTR_OS2_PREFIX, 4))) {
+        } else if (strncmp(ea_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)
+                && (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN))) {
                 cFYI(1,
                      "illegal xattr request %s (only user namespace supported)",
                      ea_name);
@@ -88,7 +81,7 @@ int cifs_removexattr(struct dentry *direntry, const char *ea_name)
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto remove_ea_exit;
 
-                ea_name += 5; /* skip past user. prefix */
+                ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */
                 rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, NULL,
                         (__u16)0, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -149,21 +142,23 @@ int cifs_setxattr(struct dentry *direntry, const char *ea_name,
 
         if (ea_name == NULL) {
                 cFYI(1, "Null xattr names not supported");
-        } else if (strncmp(ea_name, CIFS_XATTR_USER_PREFIX, 5) == 0) {
+        } else if (strncmp(ea_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)
+                   == 0) {
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto set_ea_exit;
                 if (strncmp(ea_name, CIFS_XATTR_DOS_ATTRIB, 14) == 0)
                         cFYI(1, "attempt to set cifs inode metadata");
 
-                ea_name += 5; /* skip past user. prefix */
+                ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */
                 rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, ea_value,
                         (__u16)value_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
-        } else if (strncmp(ea_name, CIFS_XATTR_OS2_PREFIX, 4) == 0) {
+        } else if (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN)
+                   == 0) {
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto set_ea_exit;
 
-                ea_name += 4; /* skip past os2. prefix */
+                ea_name += XATTR_OS2_PREFIX_LEN; /* skip past os2. prefix */
                 rc = CIFSSMBSetEA(xid, pTcon, full_path, ea_name, ea_value,
                         (__u16)value_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -269,7 +264,8 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
         /* return alt name if available as pseudo attr */
         if (ea_name == NULL) {
                 cFYI(1, "Null xattr names not supported");
-        } else if (strncmp(ea_name, CIFS_XATTR_USER_PREFIX, 5) == 0) {
+        } else if (strncmp(ea_name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)
+                   == 0) {
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto get_ea_exit;
 
@@ -277,15 +273,15 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                         cFYI(1, "attempt to query cifs inode metadata");
                         /* revalidate/getattr then populate from inode */
                 } /* BB add else when above is implemented */
-                ea_name += 5; /* skip past user. prefix */
+                ea_name += XATTR_USER_PREFIX_LEN; /* skip past user. prefix */
                 rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
                         buf_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
-        } else if (strncmp(ea_name, CIFS_XATTR_OS2_PREFIX, 4) == 0) {
+        } else if (strncmp(ea_name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) {
                 if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto get_ea_exit;
 
-                ea_name += 4; /* skip past os2. prefix */
+                ea_name += XATTR_OS2_PREFIX_LEN; /* skip past os2. prefix */
                 rc = CIFSSMBQAllEAs(xid, pTcon, full_path, ea_name, ea_value,
                         buf_size, cifs_sb->local_nls,
                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -339,10 +335,10 @@ ssize_t cifs_getxattr(struct dentry *direntry, const char *ea_name,
                 cFYI(1, "Query CIFS ACL not supported yet");
 #endif /* CONFIG_CIFS_ACL */
         } else if (strncmp(ea_name,
-                  CIFS_XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) == 0) {
+                  XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) == 0) {
                 cFYI(1, "Trusted xattr namespace not supported yet");
         } else if (strncmp(ea_name,
-                  CIFS_XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) == 0) {
+                  XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) == 0) {
                 cFYI(1, "Security xattr namespace not supported yet");
         } else
                 cFYI(1,
diff --git a/fs/ext2/xattr_security.c b/fs/ext2/xattr_security.c
index 5d979b4347b0..c922adc8ef41 100644
--- a/fs/ext2/xattr_security.c
+++ b/fs/ext2/xattr_security.c
@@ -46,28 +46,30 @@ ext2_xattr_security_set(struct dentry *dentry, const char *name,
                               value, size, flags);
 }
 
-int
-ext2_init_security(struct inode *inode, struct inode *dir,
-                   const struct qstr *qstr)
+int ext2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                    void *fs_info)
 {
-        int err;
-        size_t len;
-        void *value;
-        char *name;
+        const struct xattr *xattr;
+        int err = 0;
 
-        err = security_inode_init_security(inode, dir, qstr, &name, &value, &len);
-        if (err) {
-                if (err == -EOPNOTSUPP)
-                        return 0;
-                return err;
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                err = ext2_xattr_set(inode, EXT2_XATTR_INDEX_SECURITY,
+                                     xattr->name, xattr->value,
+                                     xattr->value_len, 0);
+                if (err < 0)
+                        break;
         }
-        err = ext2_xattr_set(inode, EXT2_XATTR_INDEX_SECURITY,
-                             name, value, len, 0);
-        kfree(name);
-        kfree(value);
         return err;
 }
 
+int
+ext2_init_security(struct inode *inode, struct inode *dir,
+                   const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                            &ext2_initxattrs, NULL);
+}
+
 const struct xattr_handler ext2_xattr_security_handler = {
         .prefix = XATTR_SECURITY_PREFIX,
         .list   = ext2_xattr_security_list,
diff --git a/fs/ext3/xattr_security.c b/fs/ext3/xattr_security.c
index b8d9f83aa5c5..3c218b8a51d4 100644
--- a/fs/ext3/xattr_security.c
+++ b/fs/ext3/xattr_security.c
@@ -48,28 +48,32 @@ ext3_xattr_security_set(struct dentry *dentry, const char *name,
                               name, value, size, flags);
 }
 
-int
-ext3_init_security(handle_t *handle, struct inode *inode, struct inode *dir,
-                   const struct qstr *qstr)
+int ext3_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                    void *fs_info)
 {
-        int err;
-        size_t len;
-        void *value;
-        char *name;
+        const struct xattr *xattr;
+        handle_t *handle = fs_info;
+        int err = 0;
 
-        err = security_inode_init_security(inode, dir, qstr, &name, &value, &len);
-        if (err) {
-                if (err == -EOPNOTSUPP)
-                        return 0;
-                return err;
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                err = ext3_xattr_set_handle(handle, inode,
+                                            EXT3_XATTR_INDEX_SECURITY,
+                                            xattr->name, xattr->value,
+                                            xattr->value_len, 0);
+                if (err < 0)
+                        break;
         }
-        err = ext3_xattr_set_handle(handle, inode, EXT3_XATTR_INDEX_SECURITY,
-                                    name, value, len, 0);
-        kfree(name);
-        kfree(value);
         return err;
 }
 
+int
+ext3_init_security(handle_t *handle, struct inode *inode, struct inode *dir,
+                   const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                            &ext3_initxattrs, handle);
+}
+
 const struct xattr_handler ext3_xattr_security_handler = {
         .prefix = XATTR_SECURITY_PREFIX,
         .list   = ext3_xattr_security_list,
diff --git a/fs/ext4/xattr_security.c b/fs/ext4/xattr_security.c
index 007c3bfbf094..34e4350dd4d9 100644
--- a/fs/ext4/xattr_security.c
+++ b/fs/ext4/xattr_security.c
@@ -48,28 +48,32 @@ ext4_xattr_security_set(struct dentry *dentry, const char *name,
                               name, value, size, flags);
 }
 
-int
-ext4_init_security(handle_t *handle, struct inode *inode, struct inode *dir,
-                   const struct qstr *qstr)
+int ext4_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                    void *fs_info)
 {
-        int err;
-        size_t len;
-        void *value;
-        char *name;
+        const struct xattr *xattr;
+        handle_t *handle = fs_info;
+        int err = 0;
 
-        err = security_inode_init_security(inode, dir, qstr, &name, &value, &len);
-        if (err) {
-                if (err == -EOPNOTSUPP)
-                        return 0;
-                return err;
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                err = ext4_xattr_set_handle(handle, inode,
+                                            EXT4_XATTR_INDEX_SECURITY,
+                                            xattr->name, xattr->value,
+                                            xattr->value_len, 0);
+                if (err < 0)
+                        break;
         }
-        err = ext4_xattr_set_handle(handle, inode, EXT4_XATTR_INDEX_SECURITY,
-                                    name, value, len, 0);
-        kfree(name);
-        kfree(value);
         return err;
 }
 
+int
+ext4_init_security(handle_t *handle, struct inode *inode, struct inode *dir,
+                   const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                            &ext4_initxattrs, handle);
+}
+
 const struct xattr_handler ext4_xattr_security_handler = {
         .prefix = XATTR_SECURITY_PREFIX,
         .list   = ext4_xattr_security_list,
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 900cf986aadc..6525b804d5ec 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -624,31 +624,29 @@ fail:
         return error;
 }
 
-static int gfs2_security_init(struct gfs2_inode *dip, struct gfs2_inode *ip,
-                              const struct qstr *qstr)
+int gfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                    void *fs_info)
 {
-        int err;
-        size_t len;
-        void *value;
-        char *name;
-
-        err = security_inode_init_security(&ip->i_inode, &dip->i_inode, qstr,
-                                           &name, &value, &len);
-
-        if (err) {
-                if (err == -EOPNOTSUPP)
-                        return 0;
-                return err;
+        const struct xattr *xattr;
+        int err = 0;
+
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                err = __gfs2_xattr_set(inode, xattr->name, xattr->value,
+                                       xattr->value_len, 0,
+                                       GFS2_EATYPE_SECURITY);
+                if (err < 0)
+                        break;
         }
-
-        err = __gfs2_xattr_set(&ip->i_inode, name, value, len, 0,
-                               GFS2_EATYPE_SECURITY);
-        kfree(value);
-        kfree(name);
-
         return err;
 }
 
+static int gfs2_security_init(struct gfs2_inode *dip, struct gfs2_inode *ip,
+                              const struct qstr *qstr)
+{
+        return security_inode_init_security(&ip->i_inode, &dip->i_inode, qstr,
+                                            &gfs2_initxattrs, NULL);
+}
+
 /**
  * gfs2_create_inode - Create a new inode
  * @dir: The parent directory
diff --git a/fs/jffs2/security.c b/fs/jffs2/security.c
index cfeb7164b085..0f20208df602 100644
--- a/fs/jffs2/security.c
+++ b/fs/jffs2/security.c
@@ -22,26 +22,29 @@
 #include <linux/security.h>
 #include "nodelist.h"
 
-/* ---- Initial Security Label Attachment -------------- */
-int jffs2_init_security(struct inode *inode, struct inode *dir,
-                        const struct qstr *qstr)
+/* ---- Initial Security Label(s) Attachment callback --- */
+int jffs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                     void *fs_info)
 {
-        int rc;
-        size_t len;
-        void *value;
-        char *name;
+        const struct xattr *xattr;
+        int err = 0;
 
-        rc = security_inode_init_security(inode, dir, qstr, &name, &value, &len);
-        if (rc) {
-                if (rc == -EOPNOTSUPP)
-                        return 0;
-                return rc;
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                err = do_jffs2_setxattr(inode, JFFS2_XPREFIX_SECURITY,
+                                        xattr->name, xattr->value,
+                                        xattr->value_len, 0);
+                if (err < 0)
+                        break;
         }
-        rc = do_jffs2_setxattr(inode, JFFS2_XPREFIX_SECURITY, name, value, len, 0);
+        return err;
+}
 
-        kfree(name);
-        kfree(value);
-        return rc;
+/* ---- Initial Security Label(s) Attachment ----------- */
+int jffs2_init_security(struct inode *inode, struct inode *dir,
+                        const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                            &jffs2_initxattrs, NULL);
 }
 
 /* ---- XATTR Handler for "security.*" ----------------- */
diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
index e87fedef23db..26683e15b3ac 100644
--- a/fs/jfs/xattr.c
+++ b/fs/jfs/xattr.c
@@ -1089,38 +1089,37 @@ int jfs_removexattr(struct dentry *dentry, const char *name)
 }
 
 #ifdef CONFIG_JFS_SECURITY
-int jfs_init_security(tid_t tid, struct inode *inode, struct inode *dir,
-                      const struct qstr *qstr)
+int jfs_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                   void *fs_info)
 {
-        int rc;
-        size_t len;
-        void *value;
-        char *suffix;
+        const struct xattr *xattr;
+        tid_t *tid = fs_info;
         char *name;
-
-        rc = security_inode_init_security(inode, dir, qstr, &suffix, &value,
-                                          &len);
-        if (rc) {
-                if (rc == -EOPNOTSUPP)
-                        return 0;
-                return rc;
-        }
-        name = kmalloc(XATTR_SECURITY_PREFIX_LEN + 1 + strlen(suffix),
-                       GFP_NOFS);
-        if (!name) {
-                rc = -ENOMEM;
-                goto kmalloc_failed;
+        int err = 0;
+
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
+                               strlen(xattr->name) + 1, GFP_NOFS);
+                if (!name) {
+                        err = -ENOMEM;
+                        break;
+                }
+                strcpy(name, XATTR_SECURITY_PREFIX);
+                strcpy(name + XATTR_SECURITY_PREFIX_LEN, xattr->name);
+
+                err = __jfs_setxattr(*tid, inode, name,
+                                     xattr->value, xattr->value_len, 0);
+                kfree(name);
+                if (err < 0)
+                        break;
         }
-        strcpy(name, XATTR_SECURITY_PREFIX);
-        strcpy(name + XATTR_SECURITY_PREFIX_LEN, suffix);
-
-        rc = __jfs_setxattr(tid, inode, name, value, len, 0);
-
-        kfree(name);
-kmalloc_failed:
-        kfree(suffix);
-        kfree(value);
+        return err;
+}
 
-        return rc;
+int jfs_init_security(tid_t tid, struct inode *inode, struct inode *dir,
+                      const struct qstr *qstr)
+{
+        return security_inode_init_security(inode, dir, qstr,
+                                            &jfs_initxattrs, &tid);
 }
 #endif
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 81ecf9c0bf0a..194fb22ef79d 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -7185,20 +7185,9 @@ int ocfs2_init_security_and_acl(struct inode *dir,
 {
         int ret = 0;
         struct buffer_head *dir_bh = NULL;
-        struct ocfs2_security_xattr_info si = {
-                .enable = 1,
-        };
 
-        ret = ocfs2_init_security_get(inode, dir, qstr, &si);
+        ret = ocfs2_init_security_get(inode, dir, qstr, NULL);
         if (!ret) {
-                ret = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
-                                      si.name, si.value, si.value_len,
-                                      XATTR_CREATE);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto leave;
-                }
-        } else if (ret != -EOPNOTSUPP) {
                 mlog_errno(ret);
                 goto leave;
         }
@@ -7255,6 +7244,22 @@ static int ocfs2_xattr_security_set(struct dentry *dentry, const char *name,
                                name, value, size, flags);
 }
 
+int ocfs2_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                     void *fs_info)
+{
+        const struct xattr *xattr;
+        int err = 0;
+
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                err = ocfs2_xattr_set(inode, OCFS2_XATTR_INDEX_SECURITY,
+                                      xattr->name, xattr->value,
+                                      xattr->value_len, XATTR_CREATE);
+                if (err)
+                        break;
+        }
+        return err;
+}
+
 int ocfs2_init_security_get(struct inode *inode,
                             struct inode *dir,
                             const struct qstr *qstr,
@@ -7263,8 +7268,13 @@ int ocfs2_init_security_get(struct inode *inode,
         /* check whether ocfs2 support feature xattr */
         if (!ocfs2_supports_xattr(OCFS2_SB(dir->i_sb)))
                 return -EOPNOTSUPP;
-        return security_inode_init_security(inode, dir, qstr, &si->name,
-                                            &si->value, &si->value_len);
+        if (si)
+                return security_old_inode_init_security(inode, dir, qstr,
+                                                        &si->name, &si->value,
+                                                        &si->value_len);
+
+        return security_inode_init_security(inode, dir, qstr,
+                                            &ocfs2_initxattrs, NULL);
 }
 
 int ocfs2_init_security_set(handle_t *handle,
diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
index ef66c18a9332..534668fa41be 100644
--- a/fs/reiserfs/xattr_security.c
+++ b/fs/reiserfs/xattr_security.c
@@ -66,8 +66,8 @@ int reiserfs_security_init(struct inode *dir, struct inode *inode,
         if (IS_PRIVATE(dir))
                 return 0;
 
-        error = security_inode_init_security(inode, dir, qstr, &sec->name,
-                                             &sec->value, &sec->length);
+        error = security_old_inode_init_security(inode, dir, qstr, &sec->name,
+                                                 &sec->value, &sec->length);
         if (error) {
                 if (error == -EOPNOTSUPP)
                         error = 0;
diff --git a/fs/xattr.c b/fs/xattr.c
index f060663ab70c..67583de8218c 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -14,6 +14,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/security.h>
+#include <linux/evm.h>
 #include <linux/syscalls.h>
 #include <linux/module.h>
 #include <linux/fsnotify.h>
@@ -166,6 +167,64 @@ out_noalloc:
 }
 EXPORT_SYMBOL_GPL(xattr_getsecurity);
 
+/*
+ * vfs_getxattr_alloc - allocate memory, if necessary, before calling getxattr
+ *
+ * Allocate memory, if not already allocated, or re-allocate correct size,
+ * before retrieving the extended attribute.
+ *
+ * Returns the result of alloc, if failed, or the getxattr operation.
+ */
+ssize_t
+vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value,
+                   size_t xattr_size, gfp_t flags)
+{
+        struct inode *inode = dentry->d_inode;
+        char *value = *xattr_value;
+        int error;
+
+        error = xattr_permission(inode, name, MAY_READ);
+        if (error)
+                return error;
+
+        if (!inode->i_op->getxattr)
+                return -EOPNOTSUPP;
+
+        error = inode->i_op->getxattr(dentry, name, NULL, 0);
+        if (error < 0)
+                return error;
+
+        if (!value || (error > xattr_size)) {
+                value = krealloc(*xattr_value, error + 1, flags);
+                if (!value)
+                        return -ENOMEM;
+                memset(value, 0, error + 1);
+        }
+
+        error = inode->i_op->getxattr(dentry, name, value, error);
+        *xattr_value = value;
+        return error;
+}
+
+/* Compare an extended attribute value with the given value */
+int vfs_xattr_cmp(struct dentry *dentry, const char *xattr_name,
+                  const char *value, size_t size, gfp_t flags)
+{
+        char *xattr_value = NULL;
+        int rc;
+
+        rc = vfs_getxattr_alloc(dentry, xattr_name, &xattr_value, 0, flags);
+        if (rc < 0)
+                return rc;
+
+        if ((rc != size) || (memcmp(xattr_value, value, rc) != 0))
+                rc = -EINVAL;
+        else
+                rc = 0;
+        kfree(xattr_value);
+        return rc;
+}
+
 ssize_t
 vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
 {
@@ -243,8 +302,10 @@ vfs_removexattr(struct dentry *dentry, const char *name)
         error = inode->i_op->removexattr(dentry, name);
         mutex_unlock(&inode->i_mutex);
 
-        if (!error)
+        if (!error) {
                 fsnotify_xattr(dentry);
+                evm_inode_post_removexattr(dentry, name);
+        }
         return error;
 }
 EXPORT_SYMBOL_GPL(vfs_removexattr);
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 673704fab748..28856accb4fa 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -102,37 +102,38 @@ xfs_mark_inode_dirty(
 
 }
 
+
+int xfs_initxattrs(struct inode *inode, const struct xattr *xattr_array,
+                   void *fs_info)
+{
+        const struct xattr *xattr;
+        struct xfs_inode *ip = XFS_I(inode);
+        int error = 0;
+
+        for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+                error = xfs_attr_set(ip, xattr->name, xattr->value,
+                                     xattr->value_len, ATTR_SECURE);
+                if (error < 0)
+                        break;
+        }
+        return error;
+}
+
 /*
  * Hook in SELinux.  This is not quite correct yet, what we really need
  * here (as we do for default ACLs) is a mechanism by which creation of
  * these attrs can be journalled at inode creation time (along with the
  * inode, of course, such that log replay can't cause these to be lost).
  */
+
 STATIC int
 xfs_init_security(
         struct inode    *inode,
         struct inode    *dir,
         const struct qstr *qstr)
 {
-        struct xfs_inode *ip = XFS_I(inode);
-        size_t          length;
-        void            *value;
-        unsigned char   *name;
-        int             error;
-
-        error = security_inode_init_security(inode, dir, qstr, (char **)&name,
-                                             &value, &length);
-        if (error) {
-                if (error == -EOPNOTSUPP)
-                        return 0;
-                return -error;
-        }
-
-        error = xfs_attr_set(ip, name, value, length, ATTR_SECURE);
-
-        kfree(name);
-        kfree(value);
-        return error;
+        return security_inode_init_security(inode, dir, qstr,
+                                            &xfs_initxattrs, NULL);
 }
 
 static void