Merge ../linux-2.6/

Conflicts:

	drivers/scsi/aacraid/comminit.c

Fixed up by removing the now renamed CONFIG_IOMMU option from
aacraid

Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

15 files changed, 247 insertions, 81 deletions

diff --git a/security/Kconfig b/security/Kconfig
index 34f593410d57..67785df264e5 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -22,16 +22,22 @@ config KEYS
           If you are unsure as to whether this is required, answer N.
 
 config KEYS_DEBUG_PROC_KEYS
-        bool "Enable the /proc/keys file by which all keys may be viewed"
+        bool "Enable the /proc/keys file by which keys may be viewed"
         depends on KEYS
         help
-          This option turns on support for the /proc/keys file through which
-          all the keys on the system can be listed.
+          This option turns on support for the /proc/keys file - through which
+          can be listed all the keys on the system that are viewable by the
+          reading process.
 
-          This option is a slight security risk in that it makes it possible
-          for anyone to see all the keys on the system. Normally the manager
-          pretends keys that are inaccessible to a process don't exist as far
-          as that process is concerned.
+          The only keys included in the list are those that grant View
+          permission to the reading process whether or not it possesses them.
+          Note that LSM security checks are still performed, and may further
+          filter out keys that the current process is not authorised to view.
+
+          Only key attributes are listed here; key payloads are not included in
+          the resulting table.
+
+          If you are unsure as to whether this is required, answer N.
 
 config SECURITY
         bool "Enable different security models"
diff --git a/security/dummy.c b/security/dummy.c
index c3c5493581e2..310fcdf7b749 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -870,7 +870,8 @@ static int dummy_setprocattr(struct task_struct *p, char *name, void *value, siz
 }
 
 #ifdef CONFIG_KEYS
-static inline int dummy_key_alloc(struct key *key, struct task_struct *ctx)
+static inline int dummy_key_alloc(struct key *key, struct task_struct *ctx,
+                                  unsigned long flags)
 {
         return 0;
 }
diff --git a/security/keys/internal.h b/security/keys/internal.h
index e066e6057955..3c2877f0663e 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -99,7 +99,8 @@ extern int install_process_keyring(struct task_struct *tsk);
 extern struct key *request_key_and_link(struct key_type *type,
                                         const char *description,
                                         const char *callout_info,
-                                        struct key *dest_keyring);
+                                        struct key *dest_keyring,
+                                        unsigned long flags);
 
 /*
  * request_key authorisation
diff --git a/security/keys/key.c b/security/keys/key.c
index 51f851557389..80de8c3e9cc3 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -11,15 +11,16 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/poison.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
 #include <linux/workqueue.h>
+#include <linux/random.h>
 #include <linux/err.h>
 #include "internal.h"
 
 static kmem_cache_t     *key_jar;
-static key_serial_t     key_serial_next = 3;
 struct rb_root          key_serial_tree; /* tree of keys indexed by serial */
 DEFINE_SPINLOCK(key_serial_lock);
 
@@ -169,22 +170,23 @@ static void __init __key_insert_serial(struct key *key)
 /*****************************************************************************/
 /*
  * assign a key the next unique serial number
- * - we work through all the serial numbers between 2 and 2^31-1 in turn and
- *   then wrap
+ * - these are assigned randomly to avoid security issues through covert
+ *   channel problems
  */
 static inline void key_alloc_serial(struct key *key)
 {
         struct rb_node *parent, **p;
         struct key *xkey;
 
-        spin_lock(&key_serial_lock);
-
-        /* propose a likely serial number and look for a hole for it in the
+        /* propose a random serial number and look for a hole for it in the
          * serial number tree */
-        key->serial = key_serial_next;
-        if (key->serial < 3)
-                key->serial = 3;
-        key_serial_next = key->serial + 1;
+        do {
+                get_random_bytes(&key->serial, sizeof(key->serial));
+
+                key->serial >>= 1; /* negative numbers are not permitted */
+        } while (key->serial < 3);
+
+        spin_lock(&key_serial_lock);
 
         parent = NULL;
         p = &key_serial_tree.rb_node;
@@ -204,12 +206,11 @@ static inline void key_alloc_serial(struct key *key)
 
         /* we found a key with the proposed serial number - walk the tree from
          * that point looking for the next unused serial number */
- serial_exists:
+serial_exists:
         for (;;) {
-                key->serial = key_serial_next;
+                key->serial++;
                 if (key->serial < 2)
                         key->serial = 2;
-                key_serial_next = key->serial + 1;
 
                 if (!rb_parent(parent))
                         p = &key_serial_tree.rb_node;
@@ -228,7 +229,7 @@ static inline void key_alloc_serial(struct key *key)
         }
 
         /* we've found a suitable hole - arrange for this key to occupy it */
- insert_here:
+insert_here:
         rb_link_node(&key->serial_node, parent, p);
         rb_insert_color(&key->serial_node, &key_serial_tree);
 
@@ -248,7 +249,7 @@ static inline void key_alloc_serial(struct key *key)
  */
 struct key *key_alloc(struct key_type *type, const char *desc,
                       uid_t uid, gid_t gid, struct task_struct *ctx,
-                      key_perm_t perm, int not_in_quota)
+                      key_perm_t perm, unsigned long flags)
 {
         struct key_user *user = NULL;
         struct key *key;
@@ -269,12 +270,14 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 
         /* check that the user's quota permits allocation of another key and
          * its description */
-        if (!not_in_quota) {
+        if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
                 spin_lock(&user->lock);
-                if (user->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
-                    user->qnbytes + quotalen >= KEYQUOTA_MAX_BYTES
-                    )
-                        goto no_quota;
+                if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
+                        if (user->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
+                            user->qnbytes + quotalen >= KEYQUOTA_MAX_BYTES
+                            )
+                                goto no_quota;
+                }
 
                 user->qnkeys++;
                 user->qnbytes += quotalen;
@@ -308,7 +311,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         key->payload.data = NULL;
         key->security = NULL;
 
-        if (!not_in_quota)
+        if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
 
         memset(&key->type_data, 0, sizeof(key->type_data));
@@ -318,7 +321,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 #endif
 
         /* let the security module know about the key */
-        ret = security_key_alloc(key, ctx);
+        ret = security_key_alloc(key, ctx, flags);
         if (ret < 0)
                 goto security_error;
 
@@ -332,7 +335,7 @@ error:
 security_error:
         kfree(key->description);
         kmem_cache_free(key_jar, key);
-        if (!not_in_quota) {
+        if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
                 spin_lock(&user->lock);
                 user->qnkeys--;
                 user->qnbytes -= quotalen;
@@ -345,7 +348,7 @@ security_error:
 no_memory_3:
         kmem_cache_free(key_jar, key);
 no_memory_2:
-        if (!not_in_quota) {
+        if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
                 spin_lock(&user->lock);
                 user->qnkeys--;
                 user->qnbytes -= quotalen;
@@ -761,7 +764,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                const char *description,
                                const void *payload,
                                size_t plen,
-                               int not_in_quota)
+                               unsigned long flags)
 {
         struct key_type *ktype;
         struct key *keyring, *key = NULL;
@@ -822,7 +825,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
         /* allocate a new key */
         key = key_alloc(ktype, description, current->fsuid, current->fsgid,
-                        current, perm, not_in_quota);
+                        current, perm, flags);
         if (IS_ERR(key)) {
                 key_ref = ERR_PTR(PTR_ERR(key));
                 goto error_3;
@@ -986,7 +989,7 @@ void unregister_key_type(struct key_type *ktype)
                 if (key->type == ktype) {
                         if (ktype->destroy)
                                 ktype->destroy(key);
-                        memset(&key->payload, 0xbd, sizeof(key->payload));
+                        memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
                 }
         }
 
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index ed71d86d2ce2..329411cf8768 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -102,7 +102,7 @@ asmlinkage long sys_add_key(const char __user *_type,
         /* create or update the requested key and add it to the target
          * keyring */
         key_ref = key_create_or_update(keyring_ref, type, description,
-                                       payload, plen, 0);
+                                       payload, plen, KEY_ALLOC_IN_QUOTA);
         if (!IS_ERR(key_ref)) {
                 ret = key_ref_to_ptr(key_ref)->serial;
                 key_ref_put(key_ref);
@@ -184,7 +184,8 @@ asmlinkage long sys_request_key(const char __user *_type,
 
         /* do the search */
         key = request_key_and_link(ktype, description, callout_info,
-                                   key_ref_to_ptr(dest_ref));
+                                   key_ref_to_ptr(dest_ref),
+                                   KEY_ALLOC_IN_QUOTA);
         if (IS_ERR(key)) {
                 ret = PTR_ERR(key);
                 goto error5;
@@ -672,6 +673,7 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
  */
 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 {
+        struct key_user *newowner, *zapowner = NULL;
         struct key *key;
         key_ref_t key_ref;
         long ret;
@@ -695,19 +697,50 @@ long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
         if (!capable(CAP_SYS_ADMIN)) {
                 /* only the sysadmin can chown a key to some other UID */
                 if (uid != (uid_t) -1 && key->uid != uid)
-                        goto no_access;
+                        goto error_put;
 
                 /* only the sysadmin can set the key's GID to a group other
                  * than one of those that the current process subscribes to */
                 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
-                        goto no_access;
+                        goto error_put;
         }
 
-        /* change the UID (have to update the quotas) */
+        /* change the UID */
         if (uid != (uid_t) -1 && uid != key->uid) {
-                /* don't support UID changing yet */
-                ret = -EOPNOTSUPP;
-                goto no_access;
+                ret = -ENOMEM;
+                newowner = key_user_lookup(uid);
+                if (!newowner)
+                        goto error_put;
+
+                /* transfer the quota burden to the new user */
+                if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
+                        spin_lock(&newowner->lock);
+                        if (newowner->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
+                            newowner->qnbytes + key->quotalen >=
+                            KEYQUOTA_MAX_BYTES)
+                                goto quota_overrun;
+
+                        newowner->qnkeys++;
+                        newowner->qnbytes += key->quotalen;
+                        spin_unlock(&newowner->lock);
+
+                        spin_lock(&key->user->lock);
+                        key->user->qnkeys--;
+                        key->user->qnbytes -= key->quotalen;
+                        spin_unlock(&key->user->lock);
+                }
+
+                atomic_dec(&key->user->nkeys);
+                atomic_inc(&newowner->nkeys);
+
+                if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+                        atomic_dec(&key->user->nikeys);
+                        atomic_inc(&newowner->nikeys);
+                }
+
+                zapowner = key->user;
+                key->user = newowner;
+                key->uid = uid;
         }
 
         /* change the GID */
@@ -716,12 +749,20 @@ long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 
         ret = 0;
 
- no_access:
+error_put:
         up_write(&key->sem);
         key_put(key);
- error:
+        if (zapowner)
+                key_user_put(zapowner);
+error:
         return ret;
 
+quota_overrun:
+        spin_unlock(&newowner->lock);
+        zapowner = newowner;
+        ret = -EDQUOT;
+        goto error_put;
+
 } /* end keyctl_chown_key() */
 
 /*****************************************************************************/
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 1357207fc9df..e8d02acc51e7 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -49,6 +49,7 @@ static inline unsigned keyring_hash(const char *desc)
 static int keyring_instantiate(struct key *keyring,
                                const void *data, size_t datalen);
 static int keyring_match(const struct key *keyring, const void *criterion);
+static void keyring_revoke(struct key *keyring);
 static void keyring_destroy(struct key *keyring);
 static void keyring_describe(const struct key *keyring, struct seq_file *m);
 static long keyring_read(const struct key *keyring,
@@ -59,6 +60,7 @@ struct key_type key_type_keyring = {
         .def_datalen    = sizeof(struct keyring_list),
         .instantiate    = keyring_instantiate,
         .match          = keyring_match,
+        .revoke         = keyring_revoke,
         .destroy        = keyring_destroy,
         .describe       = keyring_describe,
         .read           = keyring_read,
@@ -240,7 +242,7 @@ static long keyring_read(const struct key *keyring,
  * allocate a keyring and link into the destination keyring
  */
 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
-                          struct task_struct *ctx, int not_in_quota,
+                          struct task_struct *ctx, unsigned long flags,
                           struct key *dest)
 {
         struct key *keyring;
@@ -249,7 +251,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
         keyring = key_alloc(&key_type_keyring, description,
                             uid, gid, ctx,
                             (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
-                            not_in_quota);
+                            flags);
 
         if (!IS_ERR(keyring)) {
                 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
@@ -953,3 +955,22 @@ int keyring_clear(struct key *keyring)
 } /* end keyring_clear() */
 
 EXPORT_SYMBOL(keyring_clear);
+
+/*****************************************************************************/
+/*
+ * dispose of the links from a revoked keyring
+ * - called with the key sem write-locked
+ */
+static void keyring_revoke(struct key *keyring)
+{
+        struct keyring_list *klist = keyring->payload.subscriptions;
+
+        /* adjust the quota */
+        key_payload_reserve(keyring, 0);
+
+        if (klist) {
+                rcu_assign_pointer(keyring->payload.subscriptions, NULL);
+                call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
+        }
+
+} /* end keyring_revoke() */
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 12b750e51fbf..686a9ee0c5de 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -137,6 +137,13 @@ static int proc_keys_show(struct seq_file *m, void *v)
         struct timespec now;
         unsigned long timo;
         char xbuf[12];
+        int rc;
+
+        /* check whether the current task is allowed to view the key (assuming
+         * non-possession) */
+        rc = key_task_permission(make_key_ref(key, 0), current, KEY_VIEW);
+        if (rc < 0)
+                return 0;
 
         now = current_kernel_time();
 
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 4d9825f9962c..32150cf7c37f 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -77,7 +77,8 @@ int alloc_uid_keyring(struct user_struct *user,
         /* concoct a default session keyring */
         sprintf(buf, "_uid_ses.%u", user->uid);
 
-        session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0, NULL);
+        session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx,
+                                        KEY_ALLOC_IN_QUOTA, NULL);
         if (IS_ERR(session_keyring)) {
                 ret = PTR_ERR(session_keyring);
                 goto error;
@@ -87,8 +88,8 @@ int alloc_uid_keyring(struct user_struct *user,
          * keyring */
         sprintf(buf, "_uid.%u", user->uid);
 
-        uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0,
-                                    session_keyring);
+        uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx,
+                                    KEY_ALLOC_IN_QUOTA, session_keyring);
         if (IS_ERR(uid_keyring)) {
                 key_put(session_keyring);
                 ret = PTR_ERR(uid_keyring);
@@ -144,7 +145,8 @@ int install_thread_keyring(struct task_struct *tsk)
 
         sprintf(buf, "_tid.%u", tsk->pid);
 
-        keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
+        keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
+                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
         if (IS_ERR(keyring)) {
                 ret = PTR_ERR(keyring);
                 goto error;
@@ -178,7 +180,8 @@ int install_process_keyring(struct task_struct *tsk)
         if (!tsk->signal->process_keyring) {
                 sprintf(buf, "_pid.%u", tsk->tgid);
 
-                keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
+                keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
+                                        KEY_ALLOC_QUOTA_OVERRUN, NULL);
                 if (IS_ERR(keyring)) {
                         ret = PTR_ERR(keyring);
                         goto error;
@@ -209,6 +212,7 @@ error:
 static int install_session_keyring(struct task_struct *tsk,
                                    struct key *keyring)
 {
+        unsigned long flags;
         struct key *old;
         char buf[20];
 
@@ -218,7 +222,12 @@ static int install_session_keyring(struct task_struct *tsk,
         if (!keyring) {
                 sprintf(buf, "_ses.%u", tsk->tgid);
 
-                keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
+                flags = KEY_ALLOC_QUOTA_OVERRUN;
+                if (tsk->signal->session_keyring)
+                        flags = KEY_ALLOC_IN_QUOTA;
+
+                keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
+                                        flags, NULL);
                 if (IS_ERR(keyring))
                         return PTR_ERR(keyring);
         }
@@ -728,7 +737,8 @@ long join_session_keyring(const char *name)
         keyring = find_keyring_by_name(name, 0);
         if (PTR_ERR(keyring) == -ENOKEY) {
                 /* not found - try and create a new one */
-                keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk, 0, NULL);
+                keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk,
+                                        KEY_ALLOC_IN_QUOTA, NULL);
                 if (IS_ERR(keyring)) {
                         ret = PTR_ERR(keyring);
                         goto error2;
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index eab66a06ca53..58d1efd4fc2c 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -48,8 +48,8 @@ static int call_sbin_request_key(struct key *key,
         /* allocate a new session keyring */
         sprintf(desc, "_req.%u", key->serial);
 
-        keyring = keyring_alloc(desc, current->fsuid, current->fsgid,
-                                current, 1, NULL);
+        keyring = keyring_alloc(desc, current->fsuid, current->fsgid, current,
+                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
         if (IS_ERR(keyring)) {
                 ret = PTR_ERR(keyring);
                 goto error_alloc;
@@ -126,7 +126,8 @@ error_alloc:
  */
 static struct key *__request_key_construction(struct key_type *type,
                                               const char *description,
-                                              const char *callout_info)
+                                              const char *callout_info,
+                                              unsigned long flags)
 {
         request_key_actor_t actor;
         struct key_construction cons;
@@ -134,12 +135,12 @@ static struct key *__request_key_construction(struct key_type *type,
         struct key *key, *authkey;
         int ret, negated;
 
-        kenter("%s,%s,%s", type->name, description, callout_info);
+        kenter("%s,%s,%s,%lx", type->name, description, callout_info, flags);
 
         /* create a key and add it to the queue */
         key = key_alloc(type, description,
-                        current->fsuid, current->fsgid,
-                        current, KEY_POS_ALL, 0);
+                        current->fsuid, current->fsgid, current, KEY_POS_ALL,
+                        flags);
         if (IS_ERR(key))
                 goto alloc_failed;
 
@@ -258,15 +259,16 @@ alloc_failed:
 static struct key *request_key_construction(struct key_type *type,
                                             const char *description,
                                             struct key_user *user,
-                                            const char *callout_info)
+                                            const char *callout_info,
+                                            unsigned long flags)
 {
         struct key_construction *pcons;
         struct key *key, *ckey;
 
         DECLARE_WAITQUEUE(myself, current);
 
-        kenter("%s,%s,{%d},%s",
-               type->name, description, user->uid, callout_info);
+        kenter("%s,%s,{%d},%s,%lx",
+               type->name, description, user->uid, callout_info, flags);
 
         /* see if there's such a key under construction already */
         down_write(&key_construction_sem);
@@ -282,7 +284,8 @@ static struct key *request_key_construction(struct key_type *type,
         }
 
         /* see about getting userspace to construct the key */
-        key = __request_key_construction(type, description, callout_info);
+        key = __request_key_construction(type, description, callout_info,
+                                         flags);
  error:
         kleave(" = %p", key);
         return key;
@@ -389,14 +392,15 @@ static void request_key_link(struct key *key, struct key *dest_keyring)
 struct key *request_key_and_link(struct key_type *type,
                                  const char *description,
                                  const char *callout_info,
-                                 struct key *dest_keyring)
+                                 struct key *dest_keyring,
+                                 unsigned long flags)
 {
         struct key_user *user;
         struct key *key;
         key_ref_t key_ref;
 
-        kenter("%s,%s,%s,%p",
-               type->name, description, callout_info, dest_keyring);
+        kenter("%s,%s,%s,%p,%lx",
+               type->name, description, callout_info, dest_keyring, flags);
 
         /* search all the process keyrings for a key */
         key_ref = search_process_keyrings(type, description, type->match,
@@ -429,7 +433,8 @@ struct key *request_key_and_link(struct key_type *type,
                         /* ask userspace (returns NULL if it waited on a key
                          * being constructed) */
                         key = request_key_construction(type, description,
-                                                       user, callout_info);
+                                                       user, callout_info,
+                                                       flags);
                         if (key)
                                 break;
 
@@ -485,7 +490,8 @@ struct key *request_key(struct key_type *type,
                         const char *description,
                         const char *callout_info)
 {
-        return request_key_and_link(type, description, callout_info, NULL);
+        return request_key_and_link(type, description, callout_info, NULL,
+                                    KEY_ALLOC_IN_QUOTA);
 
 } /* end request_key() */
 
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index cb9817ced3fd..cbf58a91b00a 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -187,7 +187,7 @@ struct key *request_key_auth_new(struct key *target, const char *callout_info)
         authkey = key_alloc(&key_type_request_key_auth, desc,
                             current->fsuid, current->fsgid, current,
                             KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
-                            KEY_USR_VIEW, 1);
+                            KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
         if (IS_ERR(authkey)) {
                 ret = PTR_ERR(authkey);
                 goto error_alloc;
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 8e71895b97a7..5bbfdebb7acf 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -28,6 +28,7 @@ struct key_type key_type_user = {
         .instantiate    = user_instantiate,
         .update         = user_update,
         .match          = user_match,
+        .revoke         = user_revoke,
         .destroy        = user_destroy,
         .describe       = user_describe,
         .read           = user_read,
@@ -67,6 +68,7 @@ error:
         return ret;
 
 } /* end user_instantiate() */
+
 EXPORT_SYMBOL_GPL(user_instantiate);
 
 /*****************************************************************************/
@@ -141,7 +143,28 @@ EXPORT_SYMBOL_GPL(user_match);
 
 /*****************************************************************************/
 /*
- * dispose of the data dangling from the corpse of a user
+ * dispose of the links from a revoked keyring
+ * - called with the key sem write-locked
+ */
+void user_revoke(struct key *key)
+{
+        struct user_key_payload *upayload = key->payload.data;
+
+        /* clear the quota */
+        key_payload_reserve(key, 0);
+
+        if (upayload) {
+                rcu_assign_pointer(key->payload.data, NULL);
+                call_rcu(&upayload->rcu, user_update_rcu_disposal);
+        }
+
+} /* end user_revoke() */
+
+EXPORT_SYMBOL(user_revoke);
+
+/*****************************************************************************/
+/*
+ * dispose of the data dangling from the corpse of a user key
  */
 void user_destroy(struct key *key)
 {
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 79c16e31c884..28832e689800 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1099,6 +1099,17 @@ static int may_create(struct inode *dir,
                             FILESYSTEM__ASSOCIATE, &ad);
 }
 
+/* Check whether a task can create a key. */
+static int may_create_key(u32 ksid,
+                          struct task_struct *ctx)
+{
+        struct task_security_struct *tsec;
+
+        tsec = ctx->security;
+
+        return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
+}
+
 #define MAY_LINK   0
 #define MAY_UNLINK 1
 #define MAY_RMDIR  2
@@ -1521,8 +1532,10 @@ static int selinux_bprm_set_security(struct linux_binprm *bprm)
         /* Default to the current task SID. */
         bsec->sid = tsec->sid;
 
-        /* Reset create SID on execve. */
+        /* Reset fs, key, and sock SIDs on execve. */
         tsec->create_sid = 0;
+        tsec->keycreate_sid = 0;
+        tsec->sockcreate_sid = 0;
 
         if (tsec->exec_sid) {
                 newsid = tsec->exec_sid;
@@ -2574,9 +2587,11 @@ static int selinux_task_alloc_security(struct task_struct *tsk)
         tsec2->osid = tsec1->osid;
         tsec2->sid = tsec1->sid;
 
-        /* Retain the exec and create SIDs across fork */
+        /* Retain the exec, fs, key, and sock SIDs across fork */
         tsec2->exec_sid = tsec1->exec_sid;
         tsec2->create_sid = tsec1->create_sid;
+        tsec2->keycreate_sid = tsec1->keycreate_sid;
+        tsec2->sockcreate_sid = tsec1->sockcreate_sid;
 
         /* Retain ptracer SID across fork, if any.
            This will be reset by the ptrace hook upon any
@@ -2926,12 +2941,14 @@ static int selinux_socket_create(int family, int type,
 {
         int err = 0;
         struct task_security_struct *tsec;
+        u32 newsid;
 
         if (kern)
                 goto out;
 
         tsec = current->security;
-        err = avc_has_perm(tsec->sid, tsec->sid,
+        newsid = tsec->sockcreate_sid ? : tsec->sid;
+        err = avc_has_perm(tsec->sid, newsid,
                            socket_type_to_security_class(family, type,
                            protocol), SOCKET__CREATE, NULL);
 
@@ -2944,12 +2961,14 @@ static void selinux_socket_post_create(struct socket *sock, int family,
 {
         struct inode_security_struct *isec;
         struct task_security_struct *tsec;
+        u32 newsid;
 
         isec = SOCK_INODE(sock)->i_security;
 
         tsec = current->security;
+        newsid = tsec->sockcreate_sid ? : tsec->sid;
         isec->sclass = socket_type_to_security_class(family, type, protocol);
-        isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
+        isec->sid = kern ? SECINITSID_KERNEL : newsid;
         isec->initialized = 1;
 
         return;
@@ -4150,6 +4169,10 @@ static int selinux_getprocattr(struct task_struct *p,
                 sid = tsec->exec_sid;
         else if (!strcmp(name, "fscreate"))
                 sid = tsec->create_sid;
+        else if (!strcmp(name, "keycreate"))
+                sid = tsec->keycreate_sid;
+        else if (!strcmp(name, "sockcreate"))
+                sid = tsec->sockcreate_sid;
         else
                 return -EINVAL;
 
@@ -4182,6 +4205,10 @@ static int selinux_setprocattr(struct task_struct *p,
                 error = task_has_perm(current, p, PROCESS__SETEXEC);
         else if (!strcmp(name, "fscreate"))
                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
+        else if (!strcmp(name, "keycreate"))
+                error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
+        else if (!strcmp(name, "sockcreate"))
+                error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
         else if (!strcmp(name, "current"))
                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
         else
@@ -4211,6 +4238,13 @@ static int selinux_setprocattr(struct task_struct *p,
                 tsec->exec_sid = sid;
         else if (!strcmp(name, "fscreate"))
                 tsec->create_sid = sid;
+        else if (!strcmp(name, "keycreate")) {
+                error = may_create_key(sid, p);
+                if (error)
+                        return error;
+                tsec->keycreate_sid = sid;
+        } else if (!strcmp(name, "sockcreate"))
+                tsec->sockcreate_sid = sid;
         else if (!strcmp(name, "current")) {
                 struct av_decision avd;
 
@@ -4264,7 +4298,8 @@ static int selinux_setprocattr(struct task_struct *p,
 
 #ifdef CONFIG_KEYS
 
-static int selinux_key_alloc(struct key *k, struct task_struct *tsk)
+static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
+                             unsigned long flags)
 {
         struct task_security_struct *tsec = tsk->security;
         struct key_security_struct *ksec;
@@ -4274,7 +4309,10 @@ static int selinux_key_alloc(struct key *k, struct task_struct *tsk)
                 return -ENOMEM;
 
         ksec->obj = k;
-        ksec->sid = tsec->sid;
+        if (tsec->keycreate_sid)
+                ksec->sid = tsec->keycreate_sid;
+        else
+                ksec->sid = tsec->sid;
         k->security = ksec;
 
         return 0;
@@ -4513,8 +4551,10 @@ static __init int selinux_init(void)
 
 #ifdef CONFIG_KEYS
         /* Add security information to initial keyrings */
-        security_key_alloc(&root_user_keyring, current);
-        security_key_alloc(&root_session_keyring, current);
+        selinux_key_alloc(&root_user_keyring, current,
+                          KEY_ALLOC_NOT_IN_QUOTA);
+        selinux_key_alloc(&root_session_keyring, current,
+                          KEY_ALLOC_NOT_IN_QUOTA);
 #endif
 
         return 0;
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index bc020bde6c86..7c9b58380833 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -72,6 +72,8 @@
    S_(SECCLASS_PROCESS, PROCESS__EXECMEM, "execmem")
    S_(SECCLASS_PROCESS, PROCESS__EXECSTACK, "execstack")
    S_(SECCLASS_PROCESS, PROCESS__EXECHEAP, "execheap")
+   S_(SECCLASS_PROCESS, PROCESS__SETKEYCREATE, "setkeycreate")
+   S_(SECCLASS_PROCESS, PROCESS__SETSOCKCREATE, "setsockcreate")
    S_(SECCLASS_MSGQ, MSGQ__ENQUEUE, "enqueue")
    S_(SECCLASS_MSG, MSG__SEND, "send")
    S_(SECCLASS_MSG, MSG__RECEIVE, "receive")
@@ -248,3 +250,4 @@
    S_(SECCLASS_KEY, KEY__SEARCH, "search")
    S_(SECCLASS_KEY, KEY__LINK, "link")
    S_(SECCLASS_KEY, KEY__SETATTR, "setattr")
+   S_(SECCLASS_KEY, KEY__CREATE, "create")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index 1205227a3a33..69fd4b48202c 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -467,6 +467,8 @@
 #define PROCESS__EXECMEM                          0x02000000UL
 #define PROCESS__EXECSTACK                        0x04000000UL
 #define PROCESS__EXECHEAP                         0x08000000UL
+#define PROCESS__SETKEYCREATE                     0x10000000UL
+#define PROCESS__SETSOCKCREATE                    0x20000000UL
 
 #define IPC__CREATE                               0x00000001UL
 #define IPC__DESTROY                              0x00000002UL
@@ -966,4 +968,4 @@
 #define KEY__SEARCH                               0x00000008UL
 #define KEY__LINK                                 0x00000010UL
 #define KEY__SETATTR                              0x00000020UL
-
+#define KEY__CREATE                               0x00000040UL
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 8f5547ad1856..cf54a304169a 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -32,6 +32,8 @@ struct task_security_struct {
         u32 sid;             /* current SID */
         u32 exec_sid;        /* exec SID */
         u32 create_sid;      /* fscreate SID */
+        u32 keycreate_sid;   /* keycreate SID */
+        u32 sockcreate_sid;  /* fscreate SID */
         u32 ptrace_sid;      /* SID of ptrace parent */
 };