Merge tag 'v3.15' into next

Linux 3.15

34 files changed, 376 insertions, 235 deletions

diff --git a/security/Makefile b/security/Makefile
index a5918e01a4f7..05f1c934d74b 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -16,14 +16,14 @@ obj-$(CONFIG_MMU)			+= min_addr.o
 # Object file lists
 obj-$(CONFIG_SECURITY)                  += security.o capability.o
 obj-$(CONFIG_SECURITYFS)                += inode.o
-obj-$(CONFIG_SECURITY_SELINUX)          += selinux/built-in.o
-obj-$(CONFIG_SECURITY_SMACK)            += smack/built-in.o
+obj-$(CONFIG_SECURITY_SELINUX)          += selinux/
+obj-$(CONFIG_SECURITY_SMACK)            += smack/
 obj-$(CONFIG_AUDIT)                     += lsm_audit.o
-obj-$(CONFIG_SECURITY_TOMOYO)           += tomoyo/built-in.o
-obj-$(CONFIG_SECURITY_APPARMOR)         += apparmor/built-in.o
-obj-$(CONFIG_SECURITY_YAMA)             += yama/built-in.o
+obj-$(CONFIG_SECURITY_TOMOYO)           += tomoyo/
+obj-$(CONFIG_SECURITY_APPARMOR)         += apparmor/
+obj-$(CONFIG_SECURITY_YAMA)             += yama/
 obj-$(CONFIG_CGROUP_DEVICE)             += device_cgroup.o
 
 # Object integrity file lists
 subdir-$(CONFIG_INTEGRITY)              += integrity
-obj-$(CONFIG_INTEGRITY)                 += integrity/built-in.o
+obj-$(CONFIG_INTEGRITY)                 += integrity/
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
index 8fb1488a3cd4..97130f88838b 100644
--- a/security/apparmor/include/apparmor.h
+++ b/security/apparmor/include/apparmor.h
@@ -66,7 +66,6 @@ extern int apparmor_initialized __initdata;
 char *aa_split_fqname(char *args, char **ns_name);
 void aa_info_message(const char *str);
 void *__aa_kvmalloc(size_t size, gfp_t flags);
-void kvfree(void *buffer);
 
 static inline void *kvmalloc(size_t size)
 {
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 69689922c491..c1827e068454 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -104,17 +104,3 @@ void *__aa_kvmalloc(size_t size, gfp_t flags)
         }
         return buffer;
 }
-
-/**
- * kvfree - free an allocation do by kvmalloc
- * @buffer: buffer to free (MAYBE_NULL)
- *
- * Free a buffer allocated by kvmalloc
- */
-void kvfree(void *buffer)
-{
-        if (is_vmalloc_addr(buffer))
-                vfree(buffer);
-        else
-                kfree(buffer);
-}
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 4257b7e2796b..998100093332 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -751,7 +751,7 @@ module_param_named(enabled, apparmor_enabled, bool, S_IRUGO);
 static int __init apparmor_enabled_setup(char *str)
 {
         unsigned long enabled;
-        int error = strict_strtoul(str, 0, &enabled);
+        int error = kstrtoul(str, 0, &enabled);
         if (!error)
                 apparmor_enabled = enabled ? 1 : 0;
         return 1;
diff --git a/security/capability.c b/security/capability.c
index 21e2b9cae685..ad0d4de69944 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -116,7 +116,7 @@ static int cap_dentry_init_security(struct dentry *dentry, int mode,
                                         struct qstr *name, void **ctx,
                                         u32 *ctxlen)
 {
-        return 0;
+        return -EOPNOTSUPP;
 }
 
 static int cap_inode_alloc_security(struct inode *inode)
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index d3b6d2cd3a06..9134dbf70d3e 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -58,11 +58,9 @@ static inline struct dev_cgroup *css_to_devcgroup(struct cgroup_subsys_state *s)
 
 static inline struct dev_cgroup *task_devcgroup(struct task_struct *task)
 {
-        return css_to_devcgroup(task_css(task, devices_subsys_id));
+        return css_to_devcgroup(task_css(task, devices_cgrp_id));
 }
 
-struct cgroup_subsys devices_subsys;
-
 /*
  * called under devcgroup_mutex
  */
@@ -308,57 +306,138 @@ static int devcgroup_seq_show(struct seq_file *m, void *v)
 }
 
 /**
- * may_access - verifies if a new exception is part of what is allowed
- *              by a dev cgroup based on the default policy +
- *              exceptions. This is used to make sure a child cgroup
- *              won't have more privileges than its parent or to
- *              verify if a certain access is allowed.
- * @dev_cgroup: dev cgroup to be tested against
- * @refex: new exception
- * @behavior: behavior of the exception
+ * match_exception      - iterates the exception list trying to find a complete match
+ * @exceptions: list of exceptions
+ * @type: device type (DEV_BLOCK or DEV_CHAR)
+ * @major: device file major number, ~0 to match all
+ * @minor: device file minor number, ~0 to match all
+ * @access: permission mask (ACC_READ, ACC_WRITE, ACC_MKNOD)
+ *
+ * It is considered a complete match if an exception is found that will
+ * contain the entire range of provided parameters.
+ *
+ * Return: true in case it matches an exception completely
  */
-static bool may_access(struct dev_cgroup *dev_cgroup,
-                       struct dev_exception_item *refex,
-                       enum devcg_behavior behavior)
+static bool match_exception(struct list_head *exceptions, short type,
+                            u32 major, u32 minor, short access)
 {
         struct dev_exception_item *ex;
-        bool match = false;
 
-        rcu_lockdep_assert(rcu_read_lock_held() ||
-                           lockdep_is_held(&devcgroup_mutex),
-                           "device_cgroup::may_access() called without proper synchronization");
+        list_for_each_entry_rcu(ex, exceptions, list) {
+                if ((type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
+                        continue;