5 files changed, 49 insertions, 143 deletions

diff --git a/fs/Kconfig b/fs/Kconfig
index e54be7058359..ed78d24ee426 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -783,28 +783,6 @@ config SYSFS
 
         Designers of embedded systems may wish to say N here to conserve space.
 
-config DEVPTS_FS_XATTR
-        bool "/dev/pts Extended Attributes"
-        depends on UNIX98_PTYS
-        help
-          Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
-
-          If unsure, say N.
-
-config DEVPTS_FS_SECURITY
-        bool "/dev/pts Security Labels"
-        depends on DEVPTS_FS_XATTR
-        help
-          Security labels support alternative access control models
-          implemented by security modules like SELinux.  This option
-          enables an extended attribute handler for file security
-          labels in the /dev/pts filesystem.
-
-          If you are not using a security module that requires using
-          extended attributes for file security labels, say N.
-
 config TMPFS
         bool "Virtual memory file system support (former shm fs)"
         help
@@ -817,27 +795,6 @@ config TMPFS
 
           See <file:Documentation/filesystems/tmpfs.txt> for details.
 
-config TMPFS_XATTR
-        bool "tmpfs Extended Attributes"
-        depends on TMPFS
-        help
-          Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
-
-          If unsure, say N.
-
-config TMPFS_SECURITY
-        bool "tmpfs Security Labels"
-        depends on TMPFS_XATTR
-        help
-          Security labels support alternative access control models
-          implemented by security modules like SELinux.  This option
-          enables an extended attribute handler for file security
-          labels in the tmpfs filesystem.
-          If you are not using a security module that requires using
-          extended attributes for file security labels, say N.
-
 config HUGETLBFS
         bool "HugeTLB file system support"
         depends X86 || IA64 || PPC64 || SPARC64 || SUPERH || X86_64 || BROKEN
diff --git a/fs/devpts/Makefile b/fs/devpts/Makefile
index 5800df2e50c8..236696efcbac 100644
--- a/fs/devpts/Makefile
+++ b/fs/devpts/Makefile
@@ -5,4 +5,3 @@
 obj-$(CONFIG_UNIX98_PTYS)               += devpts.o
 
 devpts-$(CONFIG_UNIX98_PTYS)            := inode.o
-devpts-$(CONFIG_DEVPTS_FS_SECURITY)     += xattr_security.o
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 1571c8d6c232..f2be44d4491f 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -18,28 +18,9 @@
 #include <linux/mount.h>
 #include <linux/tty.h>
 #include <linux/devpts_fs.h>
-#include <linux/xattr.h>
 
 #define DEVPTS_SUPER_MAGIC 0x1cd1
 
-extern struct xattr_handler devpts_xattr_security_handler;
-
-static struct xattr_handler *devpts_xattr_handlers[] = {
-#ifdef CONFIG_DEVPTS_FS_SECURITY
-        &devpts_xattr_security_handler,
-#endif
-        NULL
-};
-
-static struct inode_operations devpts_file_inode_operations = {
-#ifdef CONFIG_DEVPTS_FS_XATTR
-        .setxattr       = generic_setxattr,
-        .getxattr       = generic_getxattr,
-        .listxattr      = generic_listxattr,
-        .removexattr    = generic_removexattr,
-#endif
-};
-
 static struct vfsmount *devpts_mnt;
 static struct dentry *devpts_root;
 
@@ -102,7 +83,6 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
         s->s_blocksize_bits = 10;
         s->s_magic = DEVPTS_SUPER_MAGIC;
         s->s_op = &devpts_sops;
-        s->s_xattr = devpts_xattr_handlers;
         s->s_time_gran = 1;
 
         inode = new_inode(s);
@@ -175,7 +155,6 @@ int devpts_pty_new(struct tty_struct *tty)
         inode->i_gid = config.setgid ? config.gid : current->fsgid;
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         init_special_inode(inode, S_IFCHR|config.mode, device);
-        inode->i_op = &devpts_file_inode_operations;
         inode->u.generic_ip = tty;
 
         dentry = get_node(number);
diff --git a/fs/devpts/xattr_security.c b/fs/devpts/xattr_security.c
deleted file mode 100644
index 864cb5c79baa..000000000000
--- a/fs/devpts/xattr_security.c
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Security xattr support for devpts.
- *
- * Author: Stephen Smalley <sds@epoch.ncsc.mil>
- * Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2 of the License, or (at your option)
- * any later version.
- */
-#include <linux/string.h>
-#include <linux/fs.h>
-#include <linux/security.h>
-#include <linux/xattr.h>
-
-static size_t
-devpts_xattr_security_list(struct inode *inode, char *list, size_t list_len,
-                           const char *name, size_t name_len)
-{
-        return security_inode_listsecurity(inode, list, list_len);
-}
-
-static int
-devpts_xattr_security_get(struct inode *inode, const char *name,
-                          void *buffer, size_t size)
-{
-        if (strcmp(name, "") == 0)
-                return -EINVAL;
-        return security_inode_getsecurity(inode, name, buffer, size);
-}
-
-static int
-devpts_xattr_security_set(struct inode *inode, const char *name,
-                          const void *value, size_t size, int flags)
-{
-        if (strcmp(name, "") == 0)
-                return -EINVAL;
-        return security_inode_setsecurity(inode, name, value, size, flags);
-}
-
-struct xattr_handler devpts_xattr_security_handler = {
-        .prefix = XATTR_SECURITY_PREFIX,
-        .list   = devpts_xattr_security_list,
-        .get    = devpts_xattr_security_get,
-        .set    = devpts_xattr_security_set,
-};
diff --git a/fs/xattr.c b/fs/xattr.c
index 6acd5c63da91..dc8bc7624f26 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -51,20 +51,29 @@ setxattr(struct dentry *d, char __user *name, void __user *value,
                 }
         }
 
+        down(&d->d_inode->i_sem);
+        error = security_inode_setxattr(d, kname, kvalue, size, flags);
+        if (error)
+                goto out;
         error = -EOPNOTSUPP;
         if (d->d_inode->i_op && d->d_inode->i_op->setxattr) {
-                down(&d->d_inode->i_sem);
-                error = security_inode_setxattr(d, kname, kvalue, size, flags);
-                if (error)
-                        goto out;
-                error = d->d_inode->i_op->setxattr(d, kname, kvalue, size, flags);
+                error = d->d_inode->i_op->setxattr(d, kname, kvalue,
+                                                   size, flags);
                 if (!error) {
                         fsnotify_xattr(d);
-                        security_inode_post_setxattr(d, kname, kvalue, size, flags);
+                        security_inode_post_setxattr(d, kname, kvalue,
+                                                     size, flags);
                 }
-out:
-                up(&d->d_inode->i_sem);
+        } else if (!strncmp(kname, XATTR_SECURITY_PREFIX,
+                            sizeof XATTR_SECURITY_PREFIX - 1)) {
+                const char *suffix = kname + sizeof XATTR_SECURITY_PREFIX - 1;
+                error = security_inode_setsecurity(d->d_inode, suffix, kvalue,
+                                                   size, flags);
+                if (!error)
+                        fsnotify_xattr(d);
         }
+out:
+        up(&d->d_inode->i_sem);
         if (kvalue)
                 kfree(kvalue);
         return error;
@@ -139,20 +148,25 @@ getxattr(struct dentry *d, char __user *name, void __user *value, size_t size)
                         return -ENOMEM;
         }
 
+        error = security_inode_getxattr(d, kname);
+        if (error)
+                goto out;
         error = -EOPNOTSUPP;
-        if (d->d_inode->i_op && d->d_inode->i_op->getxattr) {
-                error = security_inode_getxattr(d, kname);
-                if (error)
-                        goto out;
+        if (d->d_inode->i_op && d->d_inode->i_op->getxattr)
                 error = d->d_inode->i_op->getxattr(d, kname, kvalue, size);
-                if (error > 0) {
-                        if (size && copy_to_user(value, kvalue, error))
-                                error = -EFAULT;
-                } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
-                        /* The file system tried to returned a value bigger
-                           than XATTR_SIZE_MAX bytes. Not possible. */
-                        error = -E2BIG;
-                }
+        else if (!strncmp(kname, XATTR_SECURITY_PREFIX,
+                          sizeof XATTR_SECURITY_PREFIX - 1)) {
+                const char *suffix = kname + sizeof XATTR_SECURITY_PREFIX - 1;
+                error = security_inode_getsecurity(d->d_inode, suffix, kvalue,
+                                                   size);
+        }
+        if (error > 0) {
+                if (size && copy_to_user(value, kvalue, error))
+                        error = -EFAULT;
+        } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
+                /* The file system tried to returned a value bigger
+                   than XATTR_SIZE_MAX bytes. Not possible. */
+                error = -E2BIG;
         }
 out:
         if (kvalue)
@@ -221,20 +235,24 @@ listxattr(struct dentry *d, char __user *list, size_t size)
                         return -ENOMEM;
         }
 
+        error = security_inode_listxattr(d);
+        if (error)
+                goto out;
         error = -EOPNOTSUPP;
         if (d->d_inode->i_op && d->d_inode->i_op->listxattr) {
-                error = security_inode_listxattr(d);
-                if (error)
-                        goto out;
                 error = d->d_inode->i_op->listxattr(d, klist, size);
-                if (error > 0) {
-                        if (size && copy_to_user(list, klist, error))
-                                error = -EFAULT;
-                } else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
-                        /* The file system tried to returned a list bigger
-                           than XATTR_LIST_MAX bytes. Not possible. */
-                        error = -E2BIG;
-                }
+        } else {
+                error = security_inode_listsecurity(d->d_inode, klist, size);
+                if (size && error >= size)
+                        error = -ERANGE;
+        }
+        if (error > 0) {
+                if (size && copy_to_user(list, klist, error))
+                        error = -EFAULT;
+        } else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
+                /* The file system tried to returned a list bigger
+                   than XATTR_LIST_MAX bytes. Not possible. */
+                error = -E2BIG;
         }
 out:
         if (klist)