Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (25 commits)
  security: remove register_security hook
  security: remove dummy module fix
  security: remove dummy module
  security: remove unused sb_get_mnt_opts hook
  LSM/SELinux: show LSM mount options in /proc/mounts
  SELinux: allow fstype unknown to policy to use xattrs if present
  security: fix return of void-valued expressions
  SELinux: use do_each_thread as a proper do/while block
  SELinux: remove unused and shadowed addrlen variable
  SELinux: more user friendly unknown handling printk
  selinux: change handling of invalid classes (Was: Re: 2.6.26-rc5-mm1 selinux whine)
  SELinux: drop load_mutex in security_load_policy
  SELinux: fix off by 1 reference of class_to_string in context_struct_compute_av
  SELinux: open code sidtab lock
  SELinux: open code load_mutex
  SELinux: open code policy_rwlock
  selinux: fix endianness bug in network node address handling
  selinux: simplify ioctl checking
  SELinux: enable processes with mac_admin to get the raw inode contexts
  Security: split proc ptrace checking into read vs. attach
  ...

1 files changed, 10 insertions, 9 deletions

diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 8b1706b7b3cc..77d745da48bb 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -239,7 +239,8 @@ int mls_context_isvalid(struct policydb *p, struct context *c)
  * Policy read-lock must be held for sidtab lookup.
  *
  */
-int mls_context_to_sid(char oldc,
+int mls_context_to_sid(struct policydb *pol,
+                       char oldc,
                        char **scontext,
                        struct context *context,
                        struct sidtab *s,
@@ -286,7 +287,7 @@ int mls_context_to_sid(char oldc,
                 *p++ = 0;
 
         for (l = 0; l < 2; l++) {
-                levdatum = hashtab_search(policydb.p_levels.table, scontextp);
+                levdatum = hashtab_search(pol->p_levels.table, scontextp);
                 if (!levdatum) {
                         rc = -EINVAL;
                         goto out;
@@ -311,7 +312,7 @@ int mls_context_to_sid(char oldc,
                                         *rngptr++ = 0;
                                 }
 
-                                catdatum = hashtab_search(policydb.p_cats.table,
+                                catdatum = hashtab_search(pol->p_cats.table,
                                                           scontextp);
                                 if (!catdatum) {
                                         rc = -EINVAL;
@@ -327,7 +328,7 @@ int mls_context_to_sid(char oldc,
                                 if (rngptr) {
                                         int i;
 
-                                        rngdatum = hashtab_search(policydb.p_cats.table, rngptr);
+                                        rngdatum = hashtab_search(pol->p_cats.table, rngptr);
                                         if (!rngdatum) {
                                                 rc = -EINVAL;
                                                 goto out;
@@ -395,7 +396,7 @@ int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
         if (!tmpstr) {
                 rc = -ENOMEM;
         } else {
-                rc = mls_context_to_sid(':', &tmpstr, context,
+                rc = mls_context_to_sid(&policydb, ':', &tmpstr, context,
                                         NULL, SECSID_NULL);
                 kfree(freestr);
         }
@@ -436,13 +437,13 @@ int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
                 struct mls_level *usercon_clr = &(usercon->range.level[1]);
 
                 /* Honor the user's default level if we can */
-                if (mls_level_between(user_def, fromcon_sen, fromcon_clr)) {
+                if (mls_level_between(user_def, fromcon_sen, fromcon_clr))
                         *usercon_sen = *user_def;
-                } else if (mls_level_between(fromcon_sen, user_def, user_clr)) {
+                else if (mls_level_between(fromcon_sen, user_def, user_clr))
                         *usercon_sen = *fromcon_sen;
-                } else if (mls_level_between(fromcon_clr, user_low, user_def)) {
+                else if (mls_level_between(fromcon_clr, user_low, user_def))
                         *usercon_sen = *user_low;
-                } else
+                else
                         return -EINVAL;
 
                 /* Lower the clearance of available contexts