Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (24 commits)
  integrity: special fs magic
  As pointed out by Jonathan Corbet, the timer must be deleted before
  ERROR: code indent should use tabs where possible
  The tpm_dev_release function is only called for platform devices, not pnp
  Protect tpm_chip_list when transversing it.
  Renames num_open to is_open, as only one process can open the file at a time.
  Remove the BKL calls from the TPM driver, which were added in the overall
  netlabel: Add configuration support for local labeling
  cipso: Add support for native local labeling and fixup mapping names
  netlabel: Changes to the NetLabel security attributes to allow LSMs to pass full contexts
  selinux: Cache NetLabel secattrs in the socket's security struct
  selinux: Set socket NetLabel based on connection endpoint
  netlabel: Add functionality to set the security attributes of a packet
  netlabel: Add network address selectors to the NetLabel/LSM domain mapping
  netlabel: Add a generic way to create ordered linked lists of network addrs
  netlabel: Replace protocol/NetLabel linking with refrerence counts
  smack: Fix missing calls to netlbl_skbuff_err()
  selinux: Fix missing calls to netlbl_skbuff_err()
  selinux: Fix a problem in security_netlbl_sid_to_secattr()
  selinux: Better local/forward check in selinux_ip_postroute()
  ...

8 files changed, 473 insertions, 114 deletions

diff --git a/security/inode.c b/security/inode.c
index ca4958ebad8d..efea5a605466 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -20,8 +20,7 @@
 #include <linux/init.h>
 #include <linux/namei.h>
 #include <linux/security.h>
-
-#define SECURITYFS_MAGIC        0x73636673
+#include <linux/magic.h>
 
 static struct vfsmount *mount;
 static int mount_count;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 48881394fbd4..88f19536efad 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -291,6 +291,7 @@ static void sk_free_security(struct sock *sk)
         struct sk_security_struct *ssec = sk->sk_security;
 
         sk->sk_security = NULL;
+        selinux_netlbl_sk_security_free(ssec);
         kfree(ssec);
 }
 
@@ -3800,6 +3801,7 @@ out:
 
 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
 {
+        struct sock *sk = sock->sk;
         struct inode_security_struct *isec;
         int err;
 
@@ -3813,7 +3815,6 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
         isec = SOCK_INODE(sock)->i_security;
         if (isec->sclass == SECCLASS_TCP_SOCKET ||
             isec->sclass == SECCLASS_DCCP_SOCKET) {
-                struct sock *sk = sock->sk;
                 struct avc_audit_data ad;
                 struct sockaddr_in *addr4 = NULL;
                 struct sockaddr_in6 *addr6 = NULL;
@@ -3847,6 +3848,8 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
                         goto out;
         }
 
+        err = selinux_netlbl_socket_connect(sk, address);
+
 out:
         return err;
 }
@@ -4076,20 +4079,28 @@ static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
 }
 
 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
-                                       struct avc_audit_data *ad,
-                                       u16 family, char *addrp)
+                                       u16 family)
 {
         int err;
         struct sk_security_struct *sksec = sk->sk_security;
         u32 peer_sid;
         u32 sk_sid = sksec->sid;
+        struct avc_audit_data ad;
+        char *addrp;
+
+        AVC_AUDIT_DATA_INIT(&ad, NET);
+        ad.u.net.netif = skb->iif;
+        ad.u.net.family = family;
+        err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
+        if (err)
+                return err;
 
         if (selinux_compat_net)
-                err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
+                err = selinux_sock_rcv_skb_iptables_compat(sk, skb, &ad,
                                                            family, addrp);
         else
                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
-                                   PACKET__RECV, ad);
+                                   PACKET__RECV, &ad);
         if (err)
                 return err;
 
@@ -4098,12 +4109,14 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
                 if (err)
                         return err;
                 err = avc_has_perm(sk_sid, peer_sid,
-                                   SECCLASS_PEER, PEER__RECV, ad);
+                                   SECCLASS_PEER, PEER__RECV, &ad);
+                if (err)
+                        selinux_netlbl_err(skb, err, 0);
         } else {
-                err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
+                err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
                 if (err)
                         return err;
-                err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
+                err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
         }
 
         return err;
@@ -4117,6 +4130,8 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         u32 sk_sid = sksec->sid;
         struct avc_audit_data ad;
         char *addrp;
+        u8 secmark_active;
+        u8 peerlbl_active;
 
         if (family != PF_INET && family != PF_INET6)
                 return 0;
@@ -4125,6 +4140,18 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
                 family = PF_INET;
 
+        /* If any sort of compatibility mode is enabled then handoff processing
+         * to the selinux_sock_rcv_skb_compat() function to deal with the
+         * special handling.  We do this in an attempt to keep this function
+         * as fast and as clean as possible. */
+        if (selinux_compat_net || !selinux_policycap_netpeer)
+                return selinux_sock_rcv_skb_compat(sk, skb, family);
+
+        secmark_active = selinux_secmark_enabled();
+        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+        if (!secmark_active && !peerlbl_active)
+                return 0;
+
         AVC_AUDIT_DATA_INIT(&ad, NET);
         ad.u.net.netif = skb->iif;
         ad.u.net.family = family;
@@ -4132,15 +4159,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         if (err)
                 return err;
 
-        /* If any sort of compatibility mode is enabled then handoff processing
-         * to the selinux_sock_rcv_skb_compat() function to deal with the
-         * special handling.  We do this in an attempt to keep this function
-         * as fast and as clean as possible. */
-        if (selinux_compat_net || !selinux_policycap_netpeer)
-                return selinux_sock_rcv_skb_compat(sk, skb, &ad,
-                                                   family, addrp);
-
-        if (netlbl_enabled() || selinux_xfrm_enabled()) {
+        if (peerlbl_active) {
                 u32 peer_sid;
 
                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
@@ -4148,13 +4167,17 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)