Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (61 commits)
  KEYS: Return more accurate error codes
  LSM: Add __init to fixup function.
  TOMOYO: Add pathname grouping support.
  ima: remove ACPI dependency
  TPM: ACPI/PNP dependency removal
  security/selinux/ss: Use kstrdup
  TOMOYO: Use stack memory for pending entry.
  Revert "ima: remove ACPI dependency"
  Revert "TPM: ACPI/PNP dependency removal"
  KEYS: Do preallocation for __key_link()
  TOMOYO: Use mutex_lock_interruptible.
  KEYS: Better handling of errors from construct_alloc_key()
  KEYS: keyring_serialise_link_sem is only needed for keyring->keyring links
  TOMOYO: Use GFP_NOFS rather than GFP_KERNEL.
  ima: remove ACPI dependency
  TPM: ACPI/PNP dependency removal
  selinux: generalize disabling of execmem for plt-in-heap archs
  LSM Audit: rename LSM_AUDIT_NO_AUDIT to LSM_AUDIT_DATA_NONE
  CRED: Holding a spinlock does not imply the holding of RCU read lock
  SMACK: Don't #include Ext2 headers
  ...

4 files changed, 5 insertions, 54 deletions

diff --git a/kernel/acct.c b/kernel/acct.c
index e4c0e1fee9b0..385b88461c29 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -216,7 +216,6 @@ static int acct_on(char *name)
 {
         struct file *file;
         struct vfsmount *mnt;
-        int error;
         struct pid_namespace *ns;
         struct bsd_acct_struct *acct = NULL;
 
@@ -244,13 +243,6 @@ static int acct_on(char *name)
                 }
         }
 
-        error = security_acct(file);
-        if (error) {
-                kfree(acct);
-                filp_close(file, NULL);
-                return error;
-        }
-
         spin_lock(&acct_lock);
         if (ns->bacct == NULL) {
                 ns->bacct = acct;
@@ -281,7 +273,7 @@ static int acct_on(char *name)
  */
 SYSCALL_DEFINE1(acct, const char __user *, name)
 {
-        int error;
+        int error = 0;
 
         if (!capable(CAP_SYS_PACCT))
                 return -EPERM;
@@ -299,13 +291,11 @@ SYSCALL_DEFINE1(acct, const char __user *, name)
                 if (acct == NULL)
                         return 0;
 
-                error = security_acct(NULL);
-                if (!error) {
-                        spin_lock(&acct_lock);
-                        acct_file_reopen(acct, NULL, NULL);
-                        spin_unlock(&acct_lock);
-                }
+                spin_lock(&acct_lock);
+                acct_file_reopen(acct, NULL, NULL);
+                spin_unlock(&acct_lock);
         }
+
         return error;
 }
 
diff --git a/kernel/cred.c b/kernel/cred.c
index 8f3672a58a1e..2c24870c55d1 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -522,8 +522,6 @@ int commit_creds(struct cred *new)
 #endif
         BUG_ON(atomic_read(&new->usage) < 1);
 
-        security_commit_creds(new, old);
-
         get_cred(new); /* we will require a ref for the subj creds too */
 
         /* dumpability changes */
diff --git a/kernel/groups.c b/kernel/groups.c
index 2b45b2ee3964..53b1916c9492 100644
--- a/kernel/groups.c
+++ b/kernel/groups.c
@@ -164,12 +164,6 @@ int groups_search(const struct group_info *group_info, gid_t grp)
  */
 int set_groups(struct cred *new, struct group_info *group_info)
 {
-        int retval;
-
-        retval = security_task_setgroups(group_info);
-        if (retval)
-                return retval;
-
         put_group_info(new->group_info);
         groups_sort(group_info);
         get_group_info(group_info);
diff --git a/kernel/sys.c b/kernel/sys.c
index 7cb426a58965..0d36d889c74d 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -492,10 +492,6 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
                 return -ENOMEM;
         old = current_cred();
 
-        retval = security_task_setgid(rgid, egid, (gid_t)-1, LSM_SETID_RE);
-        if (retval)
-                goto error;
-
         retval = -EPERM;
         if (rgid != (gid_t) -1) {
                 if (old->gid == rgid ||
@@ -543,10 +539,6 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
                 return -ENOMEM;
         old = current_cred();
 
-        retval = security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_ID);
-        if (retval)
-                goto error;
-
         retval = -EPERM;
         if (capable(CAP_SETGID))
                 new->gid = new->egid = new->sgid = new->fsgid = gid;
@@ -610,10 +602,6 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
                 return -ENOMEM;
         old = current_cred();
 
-        retval = security_task_setuid(ruid, euid, (uid_t)-1, LSM_SETID_RE);
-        if (retval)
-                goto error;
-
         retval = -EPERM;
         if (ruid != (uid_t) -1) {
                 new->uid = ruid;
@@ -675,10 +663,6 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
                 return -ENOMEM;
         old = current_cred();
 
-        retval = security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_ID);
-        if (retval)
-                goto error;
-
         retval = -EPERM;
         if (capable(CAP_SETUID)) {
                 new->suid = new->uid = uid;
@@ -719,9 +703,6 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
         if (!new)
                 return -ENOMEM;
 
-        retval = security_task_setuid(ruid, euid, suid, LSM_SETID_RES);
-        if (retval)
-                goto error;
         old = current_cred();
 
         retval = -EPERM;
@@ -788,10 +769,6 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
                 return -ENOMEM;
         old = current_cred();
 
-        retval = security_task_setgid(rgid, egid, sgid, LSM_SETID_RES);
-        if (retval)
-                goto error;
-
         retval = -EPERM;
         if (!capable(CAP_SETGID)) {
                 if (rgid != (gid_t) -1 && rgid != old->gid &&
@@ -851,9 +828,6 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
         old = current_cred();
         old_fsuid = old->fsuid;
 
-        if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
-                goto error;
-
         if (uid == old->uid  || uid == old->euid  ||
             uid == old->suid || uid == old->fsuid ||
             capable(CAP_SETUID)) {
@@ -864,7 +838,6 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
                 }
         }
 
-error:
         abort_creds(new);
         return old_fsuid;
 
@@ -888,9 +861,6 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
         old = current_cred();
         old_fsgid = old->fsgid;
 
-        if (security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS))
-                goto error;
-
         if (gid == old->gid  || gid == old->egid  ||
             gid == old->sgid || gid == old->fsgid ||
             capable(CAP_SETGID)) {
@@ -900,7 +870,6 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
                 }
         }
 
-error:
         abort_creds(new);
         return old_fsgid;