12 files changed, 652 insertions, 374 deletions

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index ae8ef88ade3f..bc1e2d854bf6 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2546,18 +2546,17 @@ int __audit_signal_info(int sig, struct task_struct *t)
 
 /**
  * __audit_log_bprm_fcaps - store information about a loading bprm and relevant fcaps
- * @bprm pointer to the bprm being processed
- * @caps the caps read from the disk
+ * @bprm: pointer to the bprm being processed
+ * @new: the proposed new credentials
+ * @old: the old credentials
  *
  * Simply check if the proc already has the caps given by the file and if not
  * store the priv escalation info for later auditing at the end of the syscall
  *
- * this can fail and we don't care.  See the note in audit.h for
- * audit_log_bprm_fcaps() for my explaination....
- *
  * -Eric
  */
-void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_cap_t *pE)
+int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
+                           const struct cred *new, const struct cred *old)
 {
         struct audit_aux_data_bprm_fcaps *ax;
         struct audit_context *context = current->audit_context;
@@ -2566,7 +2565,7 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
 
         ax = kmalloc(sizeof(*ax), GFP_KERNEL);
         if (!ax)
-                return;
+                return -ENOMEM;
 
         ax->d.type = AUDIT_BPRM_FCAPS;
         ax->d.next = context->aux;
@@ -2581,26 +2580,27 @@ void __audit_log_bprm_fcaps(struct linux_binprm *bprm, kernel_cap_t *pP, kernel_
         ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
         ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
 
-        ax->old_pcap.permitted = *pP;
-        ax->old_pcap.inheritable = current->cred->cap_inheritable;
-        ax->old_pcap.effective = *pE;
+        ax->old_pcap.permitted   = old->cap_permitted;
+        ax->old_pcap.inheritable = old->cap_inheritable;
+        ax->old_pcap.effective   = old->cap_effective;
 
-        ax->new_pcap.permitted = current->cred->cap_permitted;
-        ax->new_pcap.inheritable = current->cred->cap_inheritable;
-        ax->new_pcap.effective = current->cred->cap_effective;
+        ax->new_pcap.permitted   = new->cap_permitted;
+        ax->new_pcap.inheritable = new->cap_inheritable;
+        ax->new_pcap.effective   = new->cap_effective;
+        return 0;
 }
 
 /**
  * __audit_log_capset - store information about the arguments to the capset syscall
- * @pid target pid of the capset call
- * @eff effective cap set
- * @inh inheritible cap set
- * @perm permited cap set
+ * @pid: target pid of the capset call
+ * @new: the new credentials
+ * @old: the old (current) credentials
  *
  * Record the aguments userspace sent to sys_capset for later printing by the
  * audit system if applicable
  */
-int __audit_log_capset(pid_t pid, kernel_cap_t *eff, kernel_cap_t *inh, kernel_cap_t *perm)
+int __audit_log_capset(pid_t pid,
+                       const struct cred *new, const struct cred *old)
 {
         struct audit_aux_data_capset *ax;
         struct audit_context *context = current->audit_context;
@@ -2617,9 +2617,9 @@ int __audit_log_capset(pid_t pid, kernel_cap_t *eff, kernel_cap_t *inh, kernel_c
         context->aux = (void *)ax;
 
         ax->pid = pid;
-        ax->cap.effective = *eff;
-        ax->cap.inheritable = *eff;
-        ax->cap.permitted = *perm;
+        ax->cap.effective   = new->cap_effective;
+        ax->cap.inheritable = new->cap_effective;
+        ax->cap.permitted   = new->cap_permitted;
 
         return 0;
 }
diff --git a/kernel/capability.c b/kernel/capability.c
index a404b980b1bd..36b4b4daebec 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -15,12 +15,7 @@
 #include <linux/syscalls.h>
 #include <linux/pid_namespace.h>
 #include <asm/uaccess.h>
-
-/*
- * This lock protects task->cap_* for all tasks including current.
- * Locking rule: acquire this prior to tasklist_lock.
- */
-static DEFINE_SPINLOCK(task_capability_lock);
+#include "cred-internals.h"
 
 /*
  * Leveraged for setting/resetting capabilities
@@ -128,12 +123,11 @@ static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
 }
 
 /*
- * If we have configured with filesystem capability support, then the
- * only thing that can change the capabilities of the current process
- * is the current process. As such, we can't be in this code at the
- * same time as we are in the process of setting capabilities in this
- * process. The net result is that we can limit our use of locks to
- * when we are reading the caps of another process.
+ * The only thing that can change the capabilities of the current
+ * process is the current process. As such, we can't be in this code
+ * at the same time as we are in the process of setting capabilities
+ * in this process. The net result is that we can limit our use of
+ * locks to when we are reading the caps of another process.
  */
 static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
                                      kernel_cap_t *pIp, kernel_cap_t *pPp)
@@ -143,7 +137,6 @@ static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
         if (pid && (pid != task_pid_vnr(current))) {
                 struct task_struct *target;
 
-                spin_lock(&task_capability_lock);
                 read_lock(&tasklist_lock);
 
                 target = find_task_by_vpid(pid);
@@ -153,34 +146,12 @@ static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
                         ret = security_capget(target, pEp, pIp, pPp);
 
                 read_unlock(&tasklist_lock);
-                spin_unlock(&task_capability_lock);
         } else
                 ret = security_capget(current, pEp, pIp, pPp);
 
         return ret;
 }
 
-/*
- * Atomically modify the effective capabilities returning the original
- * value. No permission check is performed here - it is assumed that the
- * caller is permitted to set the desired effective capabilities.
- */
-kernel_cap_t cap_set_effective(const kernel_cap_t pE_new)
-{
-        kernel_cap_t pE_old;
-
-        spin_lock(&task_capability_lock);
-
-        pE_old = current->cred->cap_effective;
-        current->cred->cap_effective = pE_new;
-
-        spin_unlock(&task_capability_lock);
-
-        return pE_old;
-}
-
-EXPORT_SYMBOL(cap_set_effective);
-
 /**
  * sys_capget - get the capabilities of a given process.
  * @header: pointer to struct that contains capability version and
@@ -208,7 +179,6 @@ asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
                 return -EINVAL;
 
         ret = cap_get_target_pid(pid, &pE, &pI, &pP);
-
         if (!ret) {
                 struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
                 unsigned i;
@@ -270,6 +240,7 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
         struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
         unsigned i, tocopy;
         kernel_cap_t inheritable, permitted, effective;
+        struct cred *new;
         int ret;
         pid_t pid;
 
@@ -284,8 +255,8 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
         if (pid != 0 && pid != task_pid_vnr(current))
                 return -EPERM;
 
-        if (copy_from_user(&kdata, data, tocopy
-                           * sizeof(struct __user_cap_data_struct)))
+        if (copy_from_user(&kdata, data,
+                           tocopy * sizeof(struct __user_cap_data_struct)))
                 return -EFAULT;
 
         for (i = 0; i < tocopy; i++) {
@@ -300,24 +271,23 @@ asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
                 i++;
         }
 
-        ret = audit_log_capset(pid, &effective, &inheritable, &permitted);
-        if (ret)
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+
+        ret = security_capset(new, current_cred(),
+                              &effective, &inheritable, &permitted);
+        if (ret < 0)
+                goto error;
+
+        ret = audit_log_capset(pid, new, current_cred());
+        if (ret < 0)
                 return ret;
 
-        /* This lock is required even when filesystem capability support is
-         * configured - it protects the sys_capget() call from returning
-         * incorrect data in the case that the targeted process is not the
-         * current one.
-         */
-        spin_lock(&task_capability_lock);
-
-        ret = security_capset_check(&effective, &inheritable, &permitted);
-        /* Having verified that the proposed changes are legal, we now put them
-         * into effect.
-         */
-        if (!ret)
-                security_capset_set(&effective, &inheritable, &permitted);
-        spin_unlock(&task_capability_lock);
+        return commit_creds(new);
+
+error:
+        abort_creds(new);
         return ret;
 }
 
diff --git a/kernel/cred-internals.h b/kernel/cred-internals.h
new file mode 100644
index 000000000000..2dc4fc2d0bf1
--- /dev/null
+++ b/kernel/cred-internals.h
@@ -0,0 +1,21 @@
+/* Internal credentials stuff
+ *
+ * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+/*
+ * user.c
+ */
+static inline void sched_switch_user(struct task_struct *p)
+{
+#ifdef CONFIG_USER_SCHED
+        sched_move_task(p);
+#endif  /* CONFIG_USER_SCHED */
+}
+
diff --git a/kernel/cred.c b/kernel/cred.c
index ac73e3617684..cb6b5eda978d 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -15,6 +15,10 @@
 #include <linux/keyctl.h>
 #include <linux/init_task.h>
 #include <linux/security.h>
+#include <linux/cn_proc.h>
+#include "cred-internals.h"
+
+static struct kmem_cache *cred_jar;
 
 /*
  * The common credentials for the initial task's thread group
@@ -64,7 +68,7 @@ static void release_tgcred_rcu(struct rcu_head *rcu)
 /*
  * Release a set of thread group credentials.
  */
-static void release_tgcred(struct cred *cred)
+void release_tgcred(struct cred *cred)
 {
 #ifdef CONFIG_KEYS
         struct thread_group_cred *tgcred = cred->tgcred;
@@ -81,79 +85,322 @@ static void put_cred_rcu(struct rcu_head *rcu)
 {
         struct cred *cred = container_of(rcu, struct cred, rcu);
 
-        BUG_ON(atomic_read(&cred->usage) != 0);
+        if (atomic_read(&cred->usage) != 0)
+                panic("CRED: put_cred_rcu() sees %p with usage %d\n",
+                      cred, atomic_read(&cred->usage));
 
+        security_cred_free(cred);
         key_put(cred->thread_keyring);
         key_put(cred->request_key_auth);
         release_tgcred(cred);
         put_group_info(cred->group_info);
         free_uid(cred->user);
-        security_cred_free(cred);
-        kfree(cred);
+        kmem_cache_free(cred_jar, cred);
 }
 
 /**
  * __put_cred - Destroy a set of credentials
- * @sec: The record to release
+ * @cred: The record to release
  *
  * Destroy a set of credentials on which no references remain.
  */
 void __put_cred(struct cred *cred)
 {
+        BUG_ON(atomic_read(&cred->usage) != 0);
+
         call_rcu(&cred->rcu, put_cred_rcu);
 }
 EXPORT_SYMBOL(__put_cred);
 
+/**
+ * prepare_creds - Prepare a new set of credentials for modification
+ *
+ * Prepare a new set of task credentials for modification.  A task's creds
+ * shouldn't generally be modified directly, therefore this function is used to
+ * prepare a new copy, which the caller then modifies and then commits by
+ * calling commit_creds().
+ *
+ * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
+ *
+ * Call commit_creds() or abort_creds() to clean up.
+ */
+struct cred *prepare_creds(void)
+{
+        struct task_struct *task = current;
+        const struct cred *old;
+        struct cred *new;
+
+        BUG_ON(atomic_read(&task->cred->usage) < 1);
+
+        new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
+        if (!new)
+                return NULL;
+
+        old = task->cred;
+        memcpy(new, old, sizeof(struct cred));
+
+        atomic_set(&new->usage, 1);
+        get_group_info(new->group_info);
+        get_uid(new->user);
+
+#ifdef CONFIG_KEYS
+        key_get(new->thread_keyring);
+        key_get(new->request_key_auth);
+        atomic_inc(&new->tgcred->usage);
+#endif
+
+#ifdef CONFIG_SECURITY
+        new->security = NULL;
+#endif
+
+        if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
+                goto error;
+        return new;
+
+error:
+        abort_creds(new);
+        return NULL;
+}
+EXPORT_SYMBOL(prepare_creds);
+
+/*
+ * prepare new credentials for the usermode helper dispatcher
+ */
+struct cred *prepare_usermodehelper_creds(void)
+{
+#ifdef CONFIG_KEYS
+        struct thread_group_cred *tgcred = NULL;
+#endif
+        struct cred *new;
+
+#ifdef CONFIG_KEYS
+        tgcred = kzalloc(sizeof(*new->tgcred), GFP_ATOMIC);
+        if (!tgcred)
+                return NULL;
+#endif
+
+        new = kmem_cache_alloc(cred_jar, GFP_ATOMIC);
+        if (!new)
+                return NULL;
+
+        memcpy(new, &init_cred, sizeof(struct cred));
+
+        atomic_set(&new->usage, 1);
+        get_group_info(new->group_info);
+        get_uid(new->user);
+
+#ifdef CONFIG_KEYS
+        new->thread_keyring = NULL;
+        new->request_key_auth = NULL;
+        new->jit_keyring = KEY_REQKEY_DEFL_DEFAULT;
+
+        atomic_set(&tgcred->usage, 1);
+        spin_lock_init(&tgcred->lock);
+        new->tgcred = tgcred;
+#endif
+
+#ifdef CONFIG_SECURITY
+        new->security = NULL;
+#endif
+        if (security_prepare_creds(new, &init_cred, GFP_ATOMIC) < 0)
+                goto error;
+
+        BUG_ON(atomic_read(&new->usage) != 1);
+        return new;
+
+error:
+        put_cred(new);
+        return NULL;
+}
+
 /*
  * Copy credentials for the new process created by fork()
+ *
+ * We share if we can, but under some circumstances we have to generate a new
+ * set.
  */
 int copy_creds(struct task_struct *p, unsigned long clone_flags)
 {
-        struct cred *pcred;
-        int ret;
+#ifdef CONFIG_KEYS
+        struct thread_group_cred *tgcred;
+#endif
+        struct cred *new;
+
+        mutex_init(&p->cred_exec_mutex);
 
-        pcred = kmemdup(p->cred, sizeof(*p->cred), GFP_KERNEL);
-        if (!pcred)
+        if (
+#ifdef CONFIG_KEYS
+                !p->cred->thread_keyring &&
+#endif
+                clone_flags & CLONE_THREAD
+            ) {
+                get_cred(p->cred);
+                atomic_inc(&p->cred->user->processes);
+                return 0;
+        }
+
+        new = prepare_creds();
+        if (!new)
                 return -ENOMEM;
 
 #ifdef CONFIG_KEYS
-        if (clone_flags & CLONE_THREAD) {
-                atomic_inc(&pcred->tgcred->usage);
-        } else {
-                pcred->tgcred = kmalloc(sizeof(struct cred), GFP_KERNEL);
-                if (!pcred->tgcred) {
-                        kfree(pcred);
+        /* new threads get their own thread keyrings if their parent already
+         * had one */
+        if (new->thread_keyring) {
+                key_put(new->thread_keyring);
+                new->thread_keyring = NULL;
+                if (clone_flags & CLONE_THREAD)
+                        install_thread_keyring_to_cred(new);
+        }
+
+        /* we share the process and session keyrings between all the threads in
+         * a process - this is slightly icky as we violate COW credentials a
+         * bit */
+        if (!(clone_flags & CLONE_THREAD)) {
+                tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
+                if (!tgcred) {
+                        put_cred(new);
                         return -ENOMEM;
                 }
-                atomic_set(&pcred->tgcred->usage, 1);
-                spin_lock_init(&pcred->tgcred->lock);
-                pcred->tgcred->process_keyring = NULL;
-                pcred->tgcred->session_keyring =
-                        key_get(p->cred->tgcred->session_keyring);
+                atomic_set(&tgcred->usage, 1);
+                spin_lock_init(&tgcred->lock);
+                tgcred->process_keyring = NULL;
+                tgcred->session_keyring = key_get(new->tgcred->session_keyring);
+
+                release_tgcred(new);
+                new->tgcred = tgcred;
         }
 #endif
 
-#ifdef CONFIG_SECURITY
-        pcred->security = NULL;
-#endif
+        atomic_inc(&new->user->processes);
+        p->cred = new;
+        return 0;
+}
 
-        ret = security_cred_alloc(pcred);
-        if (ret < 0) {
-                release_tgcred(pcred);
-                kfree(pcred);
-                return ret;
+/**
+ * commit_creds - Install new credentials upon the current task
+ * @new: The credentials to be assigned
+ *
+ * Install a new set of credentials to the current task, using RCU to replace
+ * the old set.
+ *
+ * This function eats the caller's reference to the new credentials.
+ *
+ * Always returns 0 thus allowing this function to be tail-called at the end
+ * of, say, sys_setgid().
+ */
+int commit_creds(struct cred *new)
+{
+        struct task_struct *task = current;
+        const struct cred *old;
+
+        BUG_ON(atomic_read(&new->usage) < 1);
+        BUG_ON(atomic_read(&task->cred->usage) < 1);
+
+        old = task->cred;
+        security_commit_creds(new, old);
+
+        /* dumpability changes */
+        if (old->euid != new->euid ||
+            old->egid != new->egid ||
+            old->fsuid != new->fsuid ||
+            old->fsgid != new->fsgid ||
+            !cap_issubset(new->cap_permitted, old->cap_permitted)) {
+                set_dumpable(task->mm, suid_dumpable);
+                task->pdeath_signal = 0;
+                smp_wmb();
         }
 
-        atomic_set(&pcred->usage, 1);
-        get_group_info(pcred->group_info);
-        get_uid(pcred->user);
-        key_get(pcred->thread_keyring);
-        key_get(pcred->request_key_auth);
+        /* alter the thread keyring */
+        if (new->fsuid != old->fsuid)
+                key_fsuid_changed(task);
+        if (new->fsgid != old->fsgid)
+                key_fsgid_changed(task);
+
+        /* do it
+         * - What if a process setreuid()'s and this brings the
+         *   new uid over his NPROC rlimit?  We can check this now
+         *   cheaply with the new uid cache, so if it matters
+         *   we should be checking for it.  -DaveM
+         */
+        if (new->user != old->user)
+                atomic_inc(&new->user->processes);
+        rcu_assign_pointer(task->cred, new);
+        if (new->user != old->user)
+                atomic_dec(&old->user->processes);
+
+        sched_switch_user(task);
+
+        /* send notifications */
+        if (new->uid   != old->uid  ||
+            new->euid  != old->euid ||
+            new->suid  != old->suid ||
+            new->fsuid != old->fsuid)
+                proc_id_connector(task, PROC_EVENT_UID);
 
-        atomic_inc(&pcred->user->processes);
+        if (new->gid   != old->gid  ||
+            new->egid  != old->egid ||
+            new->sgid  != old->sgid ||
+            new->fsgid != old->fsgid)
+                proc_id_connector(task, PROC_EVENT_GID);
 
-        /* RCU assignment is unneeded here as no-one can have accessed this
-         * pointer yet, barring us */
-        p->cred = pcred;
+        put_cred(old);
         return 0;
 }
+EXPORT_SYMBOL(commit_creds);
+
+/**
+ * abort_creds - Discard a set of credentials and unlock the current task
+ * @new: The credentials that were going to be applied
+ *
+ * Discard a set of credentials that were under construction and unlock the
+ * current task.
+ */
+void abort_creds(struct cred *new)
+{
+        BUG_ON(atomic_read(&new->usage) < 1);
+        put_cred(new);
+}
+EXPORT_SYMBOL(abort_creds);
+
+/**
+ * override_creds - Temporarily override the current process's credentials
+ * @new: The credentials to be assigned
+ *
+ * Install a set of temporary override credentials on the current process,
+ * returning the old set for later reversion.
+ */
+const struct cred *override_creds(const struct cred *new)
+{
+        const struct cred *old = current->cred;
+
+        rcu_assign_pointer(current->cred, get_cred(new));
+        return old;
+}
+EXPORT_SYMBOL(override_creds);
+
+/**
+ * revert_creds - Revert a temporary credentials override
+ * @old: The credentials to be restored
+ *
+ * Revert a temporary set of override credentials to an old set, discarding the
+ * override set.
+ */
+void revert_creds(const struct cred *old)
+{
+        const struct cred *override = current->cred;
+
+        rcu_assign_pointer(current->cred, old);
+        put_cred(override);
+}
+EXPORT_SYMBOL(revert_creds);
+
+/*
+ * initialise the credentials stuff
+ */
+void __init cred_init(void)
+{
+        /* allocate a slab in which we can store credentials */
+        cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred),
+                                     0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+}
diff --git a/kernel/exit.c b/kernel/exit.c
index bbc22530f2c1..c0711da15486 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -47,12 +47,14 @@
 #include <linux/blkdev.h>
 #include <linux/task_io_accounting_ops.h>
 #include <linux/tracehook.h>
+#include <linux/init_task.h>
 #include <trace/sched.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include <asm/pgtable.h>
 #include <asm/mmu_context.h>
+#include "cred-internals.h"
 
 static void exit_mm(struct task_struct * tsk);
 
@@ -338,12 +340,12 @@ static void reparent_to_kthreadd(void)
         /* cpus_allowed? */
         /* rt_priority? */
         /* signals? */
-        security_task_reparent_to_init(current);
         memcpy(current->signal->rlim, init_task.signal->rlim,
                sizeof(current->signal->rlim));
-        atomic_inc(&(INIT_USER->__count));
+
+        atomic_inc(&init_cred.usage);
+        commit_creds(&init_cred);
         write_unlock_irq(&tasklist_lock);
-        switch_uid(INIT_USER);
 }
 
 void __set_special_pids(struct pid *pid)
@@ -1085,7 +1087,6 @@ NORET_TYPE void do_exit(long code)
         check_stack_usage();
         exit_thread();
         cgroup_exit(tsk, 1);
-        exit_keys(tsk);
 
         if (group_dead && tsk->signal->leader)
                 disassociate_ctty(1);
diff --git a/kernel/fork.c b/kernel/fork.c
index ded1972672a3..82a7948a664e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1084,10 +1084,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 goto bad_fork_cleanup_sighand;
         if ((retval = copy_mm(clone_flags, p)))
                 goto bad_fork_cleanup_signal;
-        if ((retval = copy_keys(clone_flags, p)))
-                goto bad_fork_cleanup_mm;
         if ((retval = copy_namespaces(clone_flags, p)))
-                goto bad_fork_cleanup_keys;
+                goto bad_fork_cleanup_mm;
         if ((retval = copy_io(clone_flags, p)))
                 goto bad_fork_cleanup_namespaces;
         retval = copy_thread(0, clone_flags, stack_start, stack_size, p, regs);
@@ -1252,8 +1250,6 @@ bad_fork_cleanup_io:
         put_io_context(p->io_context);
 bad_fork_cleanup_namespaces:
         exit_task_namespaces(p);
-bad_fork_cleanup_keys:
-        exit_keys(p);
 bad_fork_cleanup_mm:
         if (p->mm)
                 mmput(p->mm);
@@ -1281,6 +1277,7 @@ bad_fork_cleanup_cgroup:
 bad_fork_cleanup_put_domain:
         module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:
+        atomic_dec(&p->cred->user->processes);
         put_cred(p->cred);
 bad_fork_free:
         free_task(p);
diff --git a/kernel/kmod.c b/kernel/kmod.c
index f044f8f57703..b46dbb908669 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -118,10 +118,10 @@ EXPORT_SYMBOL(request_module);
 struct subprocess_info {
         struct work_struct work;
         struct completion *complete;
+        struct cred *cred;
         char *path;
         char **argv;
         char **envp;
-        struct key *ring;
         enum umh_wait wait;
         int retval;
         struct file *stdin;
@@ -134,19 +134,20 @@ struct subprocess_info {
 static int ____call_usermodehelper(void *data)
 {
         struct subprocess_info *sub_info = data;
-        struct key *new_session, *old_session;
         int retval;
 
-        /* Unblock all signals and set the session keyring. */
-        new_session = key_get(sub_info->ring);
+        BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
+
+        /* Unblock all signals */
         spin_lock_irq(&current->sighand->siglock);
-        old_session = __install_session_keyring(new_session);
         flush_signal_handlers(current, 1);
         sigemptyset(&current->blocked);
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        key_put(old_session);
+        /* Install the credentials */
+        commit_creds(sub_info->cred);
+        sub_info->cred = NULL;
 
         /* Install input pipe when needed */
         if (sub_info->stdin) {
@@ -185,6 +186,8 @@ void call_usermodehelper_freeinfo(struct subprocess_info *info)
 {
         if (info->cleanup)
                 (*info->cleanup)(info->argv, info->envp);
+        if (info->cred)
+                put_cred(info->cred);
         kfree(info);
 }
 EXPORT_SYMBOL(call_usermodehelper_freeinfo);
@@ -240,6 +243,8 @@ static void __call_usermodehelper(struct work_struct *work)
         pid_t pid;
         enum umh_wait wait = sub_info->wait;
 
+        BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
+
         /* CLONE_VFORK: wait until the usermode helper has execve'd
          * successfully We need the data structures to stay around
          * until that is done.  */
@@ -362,6 +367,9 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
         sub_info->path = path;
         sub_info->argv = argv;
         sub_info->envp = envp;
+        sub_info->cred = prepare_usermodehelper_creds();
+        if (!sub_info->cred)
+                return NULL;
 
   out:
         return sub_info;
@@ -376,7 +384,13 @@ EXPORT_SYMBOL(call_usermodehelper_setup);
 void call_usermodehelper_setkeys(struct subprocess_info *info,
                                  struct key *session_keyring)
 {
-        info->ring = session_keyring;
+#ifdef CONFIG_KEYS
+        struct thread_group_cred *tgcred = info->cred->tgcred;
+        key_put(tgcred->session_keyring);
+        tgcred->session_keyring = key_get(session_keyring);
+#else
+        BUG();
+#endif
 }
 EXPORT_SYMBOL(call_usermodehelper_setkeys);
 
@@ -444,6 +458,8 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
         DECLARE_COMPLETION_ONSTACK(done);
         int retval = 0;
 
+        BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
+
         helper_lock();
         if (sub_info->path[0] == '\0')
                 goto out;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index b9d5f4e4f6a4..f764b8806955 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -171,6 +171,14 @@ int ptrace_attach(struct task_struct *task)
         if (same_thread_group(task, current))
                 goto out;
 
+        /* Protect exec's credential calculations against our interference;
+         * SUID, SGID and LSM creds get determined differently under ptrace.
+         */
+        retval = mutex_lock_interruptible(&current->cred_exec_mutex);
+        if (retval  < 0)
+                goto out;
+
+        retval = -EPERM;
 repeat:
         /*
          * Nasty, nasty.
@@ -210,6 +218,7 @@ repeat:
 bad:
         write_unlock_irqrestore(&tasklist_lock, flags);
         task_unlock(task);
+        mutex_unlock(&current->cred_exec_mutex);
 out:
         return retval;
 }
diff --git a/kernel/signal.c b/kernel/signal.c
index 84989124bafb..2a64304ed54b 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -180,7 +180,7 @@ int next_signal(struct sigpending *pending, sigset_t *mask)
 /*
  * allocate a new signal queue record
  * - this may be called without locks if and only if t == current, otherwise an
- *   appopriate lock must be held to protect t's user_struct
+ *   appopriate lock must be held to stop the target task from exiting
  */
 static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
                                          int override_rlimit)
@@ -194,7 +194,7 @@ static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
          * caller must be holding the RCU readlock (by way of a spinlock) and
          * we use RCU protection here
          */
-        user = __task_cred(t)->user;
+        user = get_uid(__task_cred(t)->user);
         atomic_inc(&user->sigpending);
         if (override_rlimit ||
             atomic_read(&user->sigpending) <=
@@ -202,12 +202,14 @@ static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
                 q = kmem_cache_alloc(sigqueue_cachep, flags);
         if (unlikely(q == NULL)) {
                 atomic_dec(&user->sigpending);
+                free_uid(user);
         } else {
                 INIT_LIST_HEAD(&q->list);
                 q->flags = 0;
-                q->user = get_uid(user);
+                q->user = user;
         }
-        return(q);
+
+        return q;
 }
 
 static void __sigqueue_free(struct sigqueue *q)
diff --git a/kernel/sys.c b/kernel/sys.c
index ccc9eb736d35..ab735040468a 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -180,7 +180,7 @@ asmlinkage long sys_setpriority(int which, int who, int niceval)
                         } while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
                         break;
                 case PRIO_USER:
-                        user = cred->user;
+                        user = (struct user_struct *) cred->user;
                         if (!who)
                                 who = cred->uid;
                         else if ((who != cred->uid) &&
@@ -479,47 +479,48 @@ void ctrl_alt_del(void)
  */
 asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
 {
-        struct cred *cred = current->cred;
-        int old_rgid = cred->gid;
-        int old_egid = cred->egid;
-        int new_rgid = old_rgid;
-        int new_egid = old_egid;
+        const struct cred *old;
+        struct cred *new;
         int retval;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
+
         retval = security_task_setgid(rgid, egid, (gid_t)-1, LSM_SETID_RE);
         if (retval)
-                return retval;
+                goto error;
 
+        retval = -EPERM;
         if (rgid != (gid_t) -1) {
-                if ((old_rgid == rgid) ||
-                    (cred->egid == rgid) ||
+                if (old->gid == rgid ||
+                    old->egid == rgid ||
                     capable(CAP_SETGID))
-                        new_rgid = rgid;
+                        new->gid = rgid;
                 else
-                        return -EPERM;
+                        goto error;
         }
         if (egid != (gid_t) -1) {
-                if ((old_rgid == egid) ||
-                    (cred->egid == egid) ||
-                    (cred->sgid == egid) ||
+                if (old->gid == egid ||
+                    old->egid == egid ||
+                    old->sgid == egid ||
                     capable(CAP_SETGID))
-                        new_egid = egid;
+                        new->egid = egid;
                 else
-                        return -EPERM;
-        }
-        if (new_egid != old_egid) {
-                set_dumpable(current->mm, suid_dumpable);
-                smp_wmb();
+                        goto error;
         }
+
         if (rgid != (gid_t) -1 ||
-            (egid != (gid_t) -1 && egid != old_rgid))
-                cred->sgid = new_egid;
-        cred->fsgid = new_egid;
-        cred->egid = new_egid;
-        cred->gid = new_rgid;
-        key_fsgid_changed(current);
-        proc_id_connector(current, PROC_EVENT_GID);
-        return 0;
+            (egid != (gid_t) -1 && egid != old->gid))
+                new->sgid = new->egid;
+        new->fsgid = new->egid;
+
+        return commit_creds(new);
+
+error:
+        abort_creds(new);
+        return retval;
 }
 
 /*
@@ -529,40 +530,42 @@ asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
  */
 asmlinkage long sys_setgid(gid_t gid)
 {
-        struct cred *cred = current->cred;
-        int old_egid = cred->egid;
+        const struct cred *old;
+        struct cred *new;
         int retval;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
+
         retval = security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_ID);
         if (retval)
-                return retval;
+                goto error;
 
-        if (capable(CAP_SETGID)) {
-                if (old_egid != gid) {
-                        set_dumpable(current->mm, suid_dumpable);
-                        smp_wmb();
-                }
-                cred->gid = cred->egid = cred->sgid = cred->fsgid = gid;
-        } else if ((gid == cred->gid) || (gid == cred->sgid)) {
-                if (old_egid != gid) {
-                        set_dumpable(current->mm, suid_dumpable);
-                        smp_wmb();
-                }
-                cred->egid = cred->fsgid = gid;
-        }
+        retval = -EPERM;
+        if (capable(CAP_SETGID))
+                new->gid = new->egid = new->sgid = new->fsgid = gid;
+        else if (gid == old->gid || gid == old->sgid)
+                new->egid = new->fsgid = gid;
         else
-                return -EPERM;
+                goto error;
 
-        key_fsgid_changed(current);
-        proc_id_connector(current, PROC_EVENT_GID);
-        return 0;
+        return commit_creds(new);
+
+error:
+        abort_creds(new);
+        return retval;
 }
   
-static int set_user(uid_t new_ruid, int dumpclear)
+/*
+ * change the user struct in a credentials set to match the new UID
+ */
+static int set_user(struct cred *new)
 {
         struct user_struct *new_user;
 
-        new_user = alloc_uid(current->nsproxy->user_ns, new_ruid);
+        new_user = alloc_uid(current->nsproxy->user_ns, new->uid);
         if (!new_user)
                 return -EAGAIN;
 
@@ -573,13 +576,8 @@ static int set_user(uid_t new_ruid, int dumpclear)
                 return -EAGAIN;
         }
 
-        switch_uid(new_user);
-
-        if (dumpclear) {
-                set_dumpable(current->mm, suid_dumpable);
-                smp_wmb();
-        }
-        current->cred->uid = new_ruid;
+        free_uid(new->user);
+        new->user = new_user;
         return 0;
 }
 
@@ -600,55 +598,56 @@ static int set_user(uid_t new_ruid, int dumpclear)
  */
 asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
 {
-        struct cred *cred = current->cred;
-        int old_ruid, old_euid, old_suid, new_ruid, new_euid;
+        const struct cred *old;
+        struct cred *new;
         int retval;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
+
         retval = security_task_setuid(ruid, euid, (uid_t)-1, LSM_SETID_RE);
         if (retval)
-                return retval;
-
-        new_ruid = old_ruid = cred->uid;
-        new_euid = old_euid = cred->euid;
-        old_suid = cred->suid;
+                goto error;
 
+        retval = -EPERM;
         if (ruid != (uid_t) -1) {
-                new_ruid = ruid;
-                if ((old_ruid != ruid) &&
-                    (cred->euid != ruid) &&
+                new->uid = ruid;
+                if (old->uid != ruid &&
+                    old->euid != ruid &&
                     !capable(CAP_SETUID))
-                        return -EPERM;
+                        goto error;
         }
 
         if (euid != (uid_t) -1) {
-                new_euid = euid;
-                if ((old_ruid != euid) &&
-                    (cred->euid != euid) &&
-                    (cred->suid != euid) &&
+                new->euid = euid;
+                if (old->uid != euid &&
+                    old->euid != euid &&
+                    old->suid != euid &&
                     !capable(CAP_SETUID))
-                        return -EPERM;
+                        goto error;
         }
 
-        if (new_ruid != old_ruid && set_user(new_ruid, new_euid != old_euid) < 0)
-                return -EAGAIN;
+        retval = -EAGAIN;
+        if (new->uid != old->uid && set_user(new) < 0)
+                goto error;
 
-        if (new_euid != old_euid) {
-                set_dumpable(current->mm, suid_dumpable);
-                smp_wmb();
-        }
-        cred->fsuid = cred->euid = new_euid;
         if (ruid != (uid_t) -1 ||
-            (euid != (uid_t) -1 && euid != old_ruid))
-                cred->suid = cred->euid;
-        cred->fsuid = cred->euid;
-
-        key_fsuid_changed(current);
-        proc_id_connector(current, PROC_EVENT_UID);
+            (euid != (uid_t) -1 && euid != old->uid))
+                new->suid = new->euid;
+        new->fsuid = new->euid;
 
-        return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RE);
-}
+        retval = security_task_fix_setuid(new, old, LSM_SETID_RE);
+        if (retval < 0)
+                goto error;
 
+        return commit_creds(new);
 
+error:
+        abort_creds(new);
+        return retval;
+}
                 
 /*
  * setuid() is implemented like SysV with SAVED_IDS 
@@ -663,37 +662,41 @@ asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
  */
 asmlinkage long sys_setuid(uid_t uid)
 {
-        struct cred *cred = current->cred;
-        int old_euid = cred->euid;
-        int old_ruid, old_suid, new_suid;
+        const struct cred *old;
+        struct cred *new;
         int retval;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
+
         retval = security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_ID);
         if (retval)
-                return retval;
+                goto error;
 
-        old_ruid = cred->uid;
-        old_suid = cred->suid;
-        new_suid = old_suid;
-        
+        retval = -EPERM;
         if (capable(CAP_SETUID)) {
-                if (uid != old_ruid && set_user(uid, old_euid != uid) < 0)
-                        return -EAGAIN;
-                new_suid = uid;
-        } else if ((uid != cred->uid) && (uid != new_suid))
-                return -EPERM;
-
-        if (old_euid != uid) {
-                set_dumpable(current->mm, suid_dumpable);
-                smp_wmb();
+                new->suid = new->uid = uid;
+                if (uid != old->uid && set_user(new) < 0) {
+                        retval = -EAGAIN;
+                        goto error;
+                }
+        } else if (uid != old->uid && uid != new->suid) {
+                goto error;
         }
-        cred->fsuid = cred->euid = uid;
-        cred->suid = new_suid;
 
-        key_fsuid_changed(current);
-        proc_id_connector(current, PROC_EVENT_UID);
+        new->fsuid = new->euid = uid;
+
+        retval = security_task_fix_setuid(new, old, LSM_SETID_ID);
+        if (retval < 0)
+                goto error;
+
+        return commit_creds(new);
 
-        return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_ID);
+error:
+        abort_creds(new);
+        return retval;
 }
 
 
@@ -703,47 +706,53 @@ asmlinkage long sys_setuid(uid_t uid)
  */
 asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
 {
-        struct cred *cred = current->cred;
-        int old_ruid = cred->uid;
-        int old_euid = cred->euid;
-        int old_suid = cred->suid;
+        const struct cred *old;
+        struct cred *new;
         int retval;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+
         retval = security_task_setuid(ruid, euid, suid, LSM_SETID_RES);
         if (retval)
-                return retval;
+                goto error;
+        old = current_cred();
 
+        retval = -EPERM;
         if (!capable(CAP_SETUID)) {
-                if ((ruid != (uid_t) -1) && (ruid != cred->uid) &&
-                    (ruid != cred->euid) && (ruid != cred->suid))
-                        return -EPERM;
-                if ((euid != (uid_t) -1) && (euid != cred->uid) &&
-                    (euid != cred->euid) && (euid != cred->suid))
-                        return -EPERM;
-                if ((suid != (uid_t) -1) && (suid != cred->uid) &&
-                    (suid != cred->euid) && (suid != cred->suid))
-                        return -EPERM;
+                if (ruid != (uid_t) -1 && ruid != old->uid &&
+                    ruid != old->euid  && ruid != old->suid)
+                        goto error;
+                if (euid != (uid_t) -1 && euid != old->uid &&
+                    euid != old->euid  && euid != old->suid)
+                        goto error;
+                if (suid != (uid_t) -1 && suid != old->uid &&
+                    suid != old->euid  && suid != old->suid)
+                        goto error;
         }
+
+        retval = -EAGAIN;
         if (ruid != (uid_t) -1) {
-                if (ruid != cred->uid &&
-                    set_user(ruid, euid != cred->euid) < 0)
-                        return -EAGAIN;
+                new->uid = ruid;
+                if (ruid != old->uid && set_user(new) < 0)
+                        goto error;
         }
-        if (euid != (uid_t) -1) {
-                if (euid != cred->euid) {
-                        set_dumpable(current->mm, suid_dumpable);
-                        smp_wmb();
-                }
-                cred->euid = euid;
-        }
-        cred->fsuid = cred->euid;
+        if (euid != (uid_t) -1)
+                new->euid = euid;
         if (suid != (uid_t) -1)
-                cred->suid = suid;
+                new->suid = suid;
+        new->fsuid = new->euid;
 
-        key_fsuid_changed(current);
-        proc_id_connector(current, PROC_EVENT_UID);
+        retval = security_task_fix_setuid(new, old, LSM_SETID_RES);
+        if (retval < 0)
+                goto error;
 
-        return security_task_post_setuid(old_ruid, old_euid, old_suid, LSM_SETID_RES);
+        return commit_creds(new);
+
+error:
+        abort_creds(new);
+        return retval;
 }
 
 asmlinkage long sys_getresuid(uid_t __user *ruid, uid_t __user *euid, uid_t __user *suid)
@@ -763,40 +772,45 @@ asmlinkage long sys_getresuid(uid_t __user *ruid, uid_t __user *euid, uid_t __us
  */
 asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
 {
-        struct cred *cred = current->cred;
+        const struct cred *old;
+        struct cred *new;
         int retval;
 
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
+
         retval = security_task_setgid(rgid, egid, sgid, LSM_SETID_RES);
         if (retval)
-                return retval;
+                goto error;
 
+        retval = -EPERM;
         if (!capable(CAP_SETGID)) {
-                if ((rgid != (gid_t) -1) && (rgid != cred->gid) &&
-                    (rgid != cred->egid) && (rgid != cred->sgid))
-                        return -EPERM;
-                if ((egid != (gid_t) -1) && (egid != cred->gid) &&
-                    (egid != cred->egid) && (egid != cred->sgid))
-                        return -EPERM;
-                if ((sgid != (gid_t) -1) && (sgid != cred->gid) &&
-                    (sgid != cred->egid) && (sgid != cred->sgid))
-                        return -EPERM;
+                if (rgid != (gid_t) -1 && rgid != old->gid &&
+                    rgid != old->egid  && rgid != old->sgid)
+                        goto error;
+                if (egid != (gid_t) -1 && egid != old->gid &&
+                    egid != old->egid  && egid != old->sgid)
+                        goto error;
+                if (sgid != (gid_t) -1 && sgid != old->gid &&
+                    sgid != old->egid  && sgid != old->sgid)
+                        goto error;
         }
-        if (egid != (gid_t) -1) {
-                if (egid != cred->egid) {
-                        set_dumpable(current->mm, suid_dumpable);
-                        smp_wmb();
-                }
-                cred->egid = egid;
-        }
-        cred->fsgid = cred->egid;
+
         if (rgid != (gid_t) -1)
-                cred->gid = rgid;
+                new->gid = rgid;
+        if (egid != (gid_t) -1)
+                new->egid = egid;
         if (sgid != (gid_t) -1)
-                cred->sgid = sgid;
+                new->sgid = sgid;
+        new->fsgid = new->egid;
 
-        key_fsgid_changed(current);
-        proc_id_connector(current, PROC_EVENT_GID);
-        return 0;
+        return commit_creds(new);
+
+error:
+        abort_creds(new);
+        return retval;
 }
 
 asmlinkage long sys_getresgid(gid_t __user *rgid, gid_t __user *egid, gid_t __user *sgid)
@@ -820,28 +834,35 @@ asmlinkage long sys_getresgid(gid_t __user *rgid, gid_t __user *egid, gid_t __us
  */
 asmlinkage long sys_setfsuid(uid_t uid)
 {
-        struct cred *cred = current->cred;
-        int old_fsuid;
+        const struct cred *old;
+        struct cred *new;
+        uid_t old_fsuid;
+
+        new = prepare_creds();
+        if (!new)
+                return current_fsuid();
+        old = current_cred();
+        old_fsuid = old->fsuid;
 
-        old_fsuid = cred->fsuid;
-        if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS))
-                return old_fsuid;
+        if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
+                goto error;
 
-        if (uid == cred->uid || uid == cred->euid ||
-            uid == cred->suid || uid == cred->fsuid ||
+        if (uid == old->uid  || uid == old->euid  ||
+            uid == old->suid || uid == old->fsuid ||
             capable(CAP_SETUID)) {
                 if (uid != old_fsuid) {
-                        set_dumpable(current->mm, suid_dumpable);
-                        smp_wmb();
+                        new->fsuid = uid;
+                        if (security_task_fix_setuid(new, old, LSM_SETID_FS) == 0)
+                                goto change_okay;
                 }
-                cred->fsuid = uid;
         }
 
-        key_fsuid_changed(current);
-        proc_id_connector(current, PROC_EVENT_UID);
-
-        security_task_post_setuid(old_fsuid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS);
+error:
+        abort_creds(new);
+        return old_fsuid;
 
+change_okay:
+        commit_creds(new);
         return old_fsuid;
 }
 
@@ -850,24 +871,34 @@ asmlinkage long sys_setfsuid(uid_t uid)
  */
 asmlinkage long sys_setfsgid(gid_t gid)
 {
-        struct cred *cred = current->cred;
-        int old_fsgid;
+        const struct cred *old;
+        struct cred *new;
+        gid_t old_fsgid;
+
+        new = prepare_creds();
+        if (!new)
+                return current_fsgid();
+        old = current_cred();
+        old_fsgid = old->fsgid;
 
-        old_fsgid = cred->fsgid;
         if (security_task_setgid(gid, (gid_t)-1, (gid_t)-1, LSM_SETID_FS))
-                return old_fsgid;
+                goto error;
 
-        if (gid == cred->gid || gid == cred->egid ||
-            gid == cred->sgid || gid == cred->fsgid ||
+        if (gid == old->gid  || gid == old->egid  ||
+            gid == old->sgid || gid == old->fsgid ||
             capable(CAP_SETGID)) {
                 if (gid != old_fsgid) {
-                        set_dumpable(current->mm, suid_dumpable);
-                        smp_wmb();
+                        new->fsgid = gid;
+                        goto change_okay;
                 }
-                cred->fsgid = gid;
-                key_fsgid_changed(current);
-                proc_id_connector(current, PROC_EVENT_GID);
         }
+
+error:
+        abort_creds(new);
+        return old_fsgid;
+
+change_okay:
+        commit_creds(new);
         return old_fsgid;
 }
 
@@ -1136,7 +1167,7 @@ EXPORT_SYMBOL(groups_free);
 
 /* export the group_info to a user-space array */
 static int groups_to_user(gid_t __user *grouplist,
-    struct group_info *group_info)
+                          const struct group_info *group_info)
 {
         int i;
         unsigned int count = group_info->ngroups;
@@ -1227,31 +1258,25 @@ int groups_search(const struct group_info *group_info, gid_t grp)
 }
 
 /**
- * set_groups - Change a group subscription in a security record
- * @sec: The security record to alter
- * @group_info: The group list to impose
+ * set_groups - Change a group subscription in a set of credentials
+ * @new: The newly prepared set of credentials to alter
+ * @group_info: The group list to install
  *
- * Validate a group subscription and, if valid, impose it upon a task security
- * record.
+ * Validate a group subscription and, if valid, insert it into a set
+ * of credentials.
  */
-int set_groups(struct cred *cred, struct group_info *group_info)
+int set_groups(struct cred *new, struct group_info *group_info)
 {
         int retval;
-        struct group_info *old_info;
 
         retval = security_task_setgroups(group_info);
         if (retval)
                 return retval;
 
+        put_group_info(new->group_info);
         groups_sort(group_info);
         get_group_info(group_info);
-
-        spin_lock(&cred->lock);
-        old_info = cred->group_info;
-        cred->group_info = group_info;
-        spin_unlock(&cred->lock);
-
-        put_group_info(old_info);
+        new->group_info = group_info;
         return 0;
 }
 
@@ -1266,7 +1291,20 @@ EXPORT_SYMBOL(set_groups);
  */
 int set_current_groups(struct group_info *group_info)
 {
-        return set_groups(current->cred, group_info);
+        struct cred *new;
+        int ret;
+
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+
+        ret = set_groups(new, group_info);
+        if (ret < 0) {
+                abort_creds(new);
+                return ret;
+        }
+
+        return commit_creds(new);
 }
 
 EXPORT_SYMBOL(set_current_groups);
@@ -1666,9 +1704,11 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
         unsigned char comm[sizeof(me->comm)];
         long error;
 
-        if (security_task_prctl(option, arg2, arg3, arg4, arg5, &error))
+        error = security_task_prctl(option, arg2, arg3, arg4, arg5);
+        if (error != -ENOSYS)
                 return error;
 
+        error = 0;
         switch (option) {
                 case PR_SET_PDEATHSIG:
                         if (!valid_signal(arg2)) {
diff --git a/kernel/user.c b/kernel/user.c
index 104d22ac84d5..d476307dd4b0 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -16,6 +16,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/user_namespace.h>
+#include "cred-internals.h"
 
 struct user_namespace init_user_ns = {
         .kref = {
@@ -104,16 +105,10 @@ static int sched_create_user(struct user_struct *up)
         return rc;
 }
 
-static void sched_switch_user(struct task_struct *p)
-{
-        sched_move_task(p);
-}
-
 #else   /* CONFIG_USER_SCHED */
 
 static void sched_destroy_user(struct user_struct *up) { }
 static int sched_create_user(struct user_struct *up) { return 0; }
-static void sched_switch_user(struct task_struct *p) { }
 
 #endif  /* CONFIG_USER_SCHED */
 
@@ -448,36 +443,6 @@ out_unlock:
         return NULL;
 }
 
-void switch_uid(struct user_struct *new_user)
-{
-        struct user_struct *old_user;
-
-        /* What if a process setreuid()'s and this brings the
-         * new uid over his NPROC rlimit?  We can check this now
-         * cheaply with the new uid cache, so if it matters
-         * we should be checking for it.  -DaveM
-         */
-        old_user = current->cred->user;
-        atomic_inc(&new_user->processes);
-        atomic_dec(&old_user->processes);
-        switch_uid_keyring(new_user);
-        current->cred->user = new_user;
-        sched_switch_user(current);
-
-        /*
-         * We need to synchronize with __sigqueue_alloc()
-         * doing a get_uid(p->user).. If that saw the old
-         * user value, we need to wait until it has exited
-         * its critical region before we can free the old
-         * structure.
-         */
-        smp_mb();
-        spin_unlock_wait(&current->sighand->siglock);
-
-        free_uid(old_user);
-        suid_keys(current);
-}
-
 #ifdef CONFIG_USER_NS
 void release_uids(struct user_namespace *ns)
 {
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index f82730adea00..0d9c51d67333 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -19,6 +19,7 @@ static struct user_namespace *clone_user_ns(struct user_namespace *old_ns)
 {
         struct user_namespace *ns;
         struct user_struct *new_user;
+        struct cred *new;
         int n;
 
         ns = kmalloc(sizeof(struct user_namespace), GFP_KERNEL);
@@ -45,7 +46,16 @@ static struct user_namespace *clone_user_ns(struct user_namespace *old_ns)
                 return ERR_PTR(-ENOMEM);
         }
 
-        switch_uid(new_user);
+        /* Install the new user */
+        new = prepare_creds();
+        if (!new) {
+                free_uid(new_user);
+                free_uid(ns->root_user);
+                kfree(ns);
+        }
+        free_uid(new->user);
+        new->user = new_user;
+        commit_creds(new);
         return ns;
 }