Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (44 commits)
  nommu: Provide mmap_min_addr definition.
  TOMOYO: Add description of lists and structures.
  TOMOYO: Remove unused field.
  integrity: ima audit dentry_open failure
  TOMOYO: Remove unused parameter.
  security: use mmap_min_addr indepedently of security models
  TOMOYO: Simplify policy reader.
  TOMOYO: Remove redundant markers.
  SELinux: define audit permissions for audit tree netlink messages
  TOMOYO: Remove unused mutex.
  tomoyo: avoid get+put of task_struct
  smack: Remove redundant initialization.
  integrity: nfsd imbalance bug fix
  rootplug: Remove redundant initialization.
  smack: do not beyond ARRAY_SIZE of data
  integrity: move ima_counts_get
  integrity: path_check update
  IMA: Add __init notation to ima functions
  IMA: Minimal IMA policy and boot param for TCB IMA policy
  selinux: remove obsolete read buffer limit from sel_read_bool
  ...

1 files changed, 67 insertions, 1 deletions

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 11d2cb19d7a6..f83a80980726 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -41,6 +41,7 @@ enum smk_inos {
         SMK_AMBIENT     = 7,    /* internet ambient label */
         SMK_NETLBLADDR  = 8,    /* single label hosts */
         SMK_ONLYCAP     = 9,    /* the only "capable" label */
+        SMK_LOGGING     = 10,   /* logging */
 };
 
 /*
@@ -775,7 +776,7 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
         struct sockaddr_in newname;
         char smack[SMK_LABELLEN];
         char *sp;
-        char data[SMK_NETLBLADDRMAX];
+        char data[SMK_NETLBLADDRMAX + 1];
         char *host = (char *)&newname.sin_addr.s_addr;
         int rc;
         struct netlbl_audit audit_info;
@@ -1192,6 +1193,69 @@ static const struct file_operations smk_onlycap_ops = {
 };
 
 /**
+ * smk_read_logging - read() for /smack/logging
+ * @filp: file pointer, not actually used
+ * @buf: where to put the result
+ * @cn: maximum to send along
+ * @ppos: where to start
+ *
+ * Returns number of bytes read or error code, as appropriate
+ */
+static ssize_t smk_read_logging(struct file *filp, char __user *buf,
+                                size_t count, loff_t *ppos)
+{
+        char temp[32];
+        ssize_t rc;
+
+        if (*ppos != 0)
+                return 0;
+
+        sprintf(temp, "%d\n", log_policy);
+        rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
+        return rc;
+}
+
+/**
+ * smk_write_logging - write() for /smack/logging
+ * @file: file pointer, not actually used
+ * @buf: where to get the data from
+ * @count: bytes sent
+ * @ppos: where to start
+ *
+ * Returns number of bytes written or error code, as appropriate
+ */
+static ssize_t smk_write_logging(struct file *file, const char __user *buf,
+                                size_t count, loff_t *ppos)
+{
+        char temp[32];
+        int i;
+
+        if (!capable(CAP_MAC_ADMIN))
+                return -EPERM;
+
+        if (count >= sizeof(temp) || count == 0)
+                return -EINVAL;
+
+        if (copy_from_user(temp, buf, count) != 0)
+                return -EFAULT;
+
+        temp[count] = '\0';
+
+        if (sscanf(temp, "%d", &i) != 1)
+                return -EINVAL;
+        if (i < 0 || i > 3)
+                return -EINVAL;
+        log_policy = i;
+        return count;
+}
+
+
+
+static const struct file_operations smk_logging_ops = {
+        .read           = smk_read_logging,
+        .write          = smk_write_logging,
+};
+/**
  * smk_fill_super - fill the /smackfs superblock
  * @sb: the empty superblock
  * @data: unused
@@ -1221,6 +1285,8 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent)
                         {"netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
                 [SMK_ONLYCAP]   =
                         {"onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
+                [SMK_LOGGING]   =
+                        {"logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
                 /* last one */ {""}
         };