5 files changed, 63 insertions, 51 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 4d3fab47e643..dad36a6ab45f 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -188,11 +188,9 @@ int avc_get_hash_stats(char *page)
         for (i = 0; i < AVC_CACHE_SLOTS; i++) {
                 head = &avc_cache.slots[i];
                 if (!hlist_empty(head)) {
-                        struct hlist_node *next;
-
                         slots_used++;
                         chain_len = 0;
-                        hlist_for_each_entry_rcu(node, next, head, list)
+                        hlist_for_each_entry_rcu(node, head, list)
                                 chain_len++;
                         if (chain_len > max_chain_len)
                                 max_chain_len = chain_len;
@@ -241,7 +239,6 @@ static inline int avc_reclaim_node(void)
         int hvalue, try, ecx;
         unsigned long flags;
         struct hlist_head *head;
-        struct hlist_node *next;
         spinlock_t *lock;
 
         for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
@@ -253,7 +250,7 @@ static inline int avc_reclaim_node(void)
                         continue;
 
                 rcu_read_lock();
-                hlist_for_each_entry(node, next, head, list) {
+                hlist_for_each_entry(node, head, list) {
                         avc_node_delete(node);
                         avc_cache_stats_incr(reclaims);
                         ecx++;
@@ -301,11 +298,10 @@ static inline struct avc_node *avc_search_node(u32 ssid, u32 tsid, u16 tclass)
         struct avc_node *node, *ret = NULL;
         int hvalue;
         struct hlist_head *head;
-        struct hlist_node *next;
 
         hvalue = avc_hash(ssid, tsid, tclass);
         head = &avc_cache.slots[hvalue];
-        hlist_for_each_entry_rcu(node, next, head, list) {
+        hlist_for_each_entry_rcu(node, head, list) {
                 if (ssid == node->ae.ssid &&
                     tclass == node->ae.tclass &&
                     tsid == node->ae.tsid) {
@@ -394,7 +390,6 @@ static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_dec
         node = avc_alloc_node();
         if (node) {
                 struct hlist_head *head;
-                struct hlist_node *next;
                 spinlock_t *lock;
 
                 hvalue = avc_hash(ssid, tsid, tclass);
@@ -404,7 +399,7 @@ static struct avc_node *avc_insert(u32 ssid, u32 tsid, u16 tclass, struct av_dec
                 lock = &avc_cache.slots_lock[hvalue];
 
                 spin_lock_irqsave(lock, flag);
-                hlist_for_each_entry(pos, next, head, list) {
+                hlist_for_each_entry(pos, head, list) {
                         if (pos->ae.ssid == ssid &&
                             pos->ae.tsid == tsid &&
                             pos->ae.tclass == tclass) {
@@ -541,7 +536,6 @@ static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass,
         unsigned long flag;
         struct avc_node *pos, *node, *orig = NULL;
         struct hlist_head *head;
-        struct hlist_node *next;
         spinlock_t *lock;
 
         node = avc_alloc_node();
@@ -558,7 +552,7 @@ static int avc_update_node(u32 event, u32 perms, u32 ssid, u32 tsid, u16 tclass,
 
         spin_lock_irqsave(lock, flag);
 
-        hlist_for_each_entry(pos, next, head, list) {
+        hlist_for_each_entry(pos, head, list) {
                 if (ssid == pos->ae.ssid &&
                     tsid == pos->ae.tsid &&
                     tclass == pos->ae.tclass &&
@@ -614,7 +608,6 @@ out:
 static void avc_flush(void)
 {
         struct hlist_head *head;
-        struct hlist_node *next;
         struct avc_node *node;
         spinlock_t *lock;
         unsigned long flag;
@@ -630,7 +623,7 @@ static void avc_flush(void)
                  * prevent RCU grace periods from ending.
                  */
                 rcu_read_lock();
-                hlist_for_each_entry(node, next, head, list)
+                hlist_for_each_entry(node, head, list)
                         avc_node_delete(node);
                 rcu_read_unlock();
                 spin_unlock_irqrestore(lock, flag);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 61a53367d029..2fa28c88900c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1528,7 +1528,7 @@ static int file_has_perm(const struct cred *cred,
                          u32 av)
 {
         struct file_security_struct *fsec = file->f_security;
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct common_audit_data ad;
         u32 sid = cred_sid(cred);
         int rc;
@@ -1957,7 +1957,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
         struct task_security_struct *new_tsec;
         struct inode_security_struct *isec;
         struct common_audit_data ad;
-        struct inode *inode = bprm->file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(bprm->file);
         int rc;
 
         rc = cap_bprm_set_creds(bprm);
@@ -2929,7 +2929,7 @@ static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
 static int selinux_revalidate_file_permission(struct file *file, int mask)
 {
         const struct cred *cred = current_cred();
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
 
         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
@@ -2941,7 +2941,7 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
 
 static int selinux_file_permission(struct file *file, int mask)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct file_security_struct *fsec = file->f_security;
         struct inode_security_struct *isec = inode->i_security;
         u32 sid = current_sid();
@@ -3135,11 +3135,6 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
 
         switch (cmd) {
         case F_SETFL:
-                if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
-                        err = -EINVAL;
-                        break;
-                }
-
                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
                         err = file_has_perm(cred, file, FILE__WRITE);
                         break;
@@ -3162,10 +3157,6 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
         case F_SETLK64:
         case F_SETLKW64:
 #endif
-                if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
-                        err = -EINVAL;
-                        break;
-                }
                 err = file_has_perm(cred, file, FILE__LOCK);
                 break;
         }
@@ -3218,7 +3209,7 @@ static int selinux_file_open(struct file *file, const struct cred *cred)
         struct inode_security_struct *isec;
 
         fsec = file->f_security;
-        isec = file->f_path.dentry->d_inode->i_security;
+        isec = file_inode(file)->i_security;
         /*
          * Save inode label and policy sequence number
          * at open-time so that selinux_file_permission
@@ -4399,6 +4390,24 @@ static void selinux_req_classify_flow(const struct request_sock *req,
         fl->flowi_secid = req->secid;
 }
 
+static int selinux_tun_dev_alloc_security(void **security)
+{
+        struct tun_security_struct *tunsec;
+
+        tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
+        if (!tunsec)
+                return -ENOMEM;
+        tunsec->sid = current_sid();
+
+        *security = tunsec;
+        return 0;
+}
+
+static void selinux_tun_dev_free_security(void *security)
+{
+        kfree(security);
+}
+
 static int selinux_tun_dev_create(void)
 {
         u32 sid = current_sid();
@@ -4414,8 +4423,17 @@ static int selinux_tun_dev_create(void)
                             NULL);
 }
 
-static void selinux_tun_dev_post_create(struct sock *sk)
+static int selinux_tun_dev_attach_queue(void *security)
+{
+        struct tun_security_struct *tunsec = security;
+
+        return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
+                            TUN_SOCKET__ATTACH_QUEUE, NULL);
+}
+
+static int selinux_tun_dev_attach(struct sock *sk, void *security)
 {
+        struct tun_security_struct *tunsec = security;
         struct sk_security_struct *sksec = sk->sk_security;
 
         /* we don't currently perform any NetLabel based labeling here and it
@@ -4425,20 +4443,19 @@ static void selinux_tun_dev_post_create(struct sock *sk)
          * cause confusion to the TUN user that had no idea network labeling
          * protocols were being used */
 
-        /* see the comments in selinux_tun_dev_create() about why we don't use
-         * the sockcreate SID here */
-
-        sksec->sid = current_sid();
+        sksec->sid = tunsec->sid;
         sksec->sclass = SECCLASS_TUN_SOCKET;
+
+        return 0;
 }
 
-static int selinux_tun_dev_attach(struct sock *sk)
+static int selinux_tun_dev_open(void *security)
 {
-        struct sk_security_struct *sksec = sk->sk_security;
+        struct tun_security_struct *tunsec = security;
         u32 sid = current_sid();
         int err;
 
-        err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
+        err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
                            TUN_SOCKET__RELABELFROM, NULL);
         if (err)
                 return err;
@@ -4446,8 +4463,7 @@ static int selinux_tun_dev_attach(struct sock *sk)
                            TUN_SOCKET__RELABELTO, NULL);
         if (err)
                 return err;
-
-        sksec->sid = sid;
+        tunsec->sid = sid;
 
         return 0;
 }
@@ -5642,9 +5658,12 @@ static struct security_operations selinux_ops = {
         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
         .req_classify_flow =            selinux_req_classify_flow,
+        .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
+        .tun_dev_free_security =        selinux_tun_dev_free_security,
         .tun_dev_create =               selinux_tun_dev_create,
-        .tun_dev_post_create =          selinux_tun_dev_post_create,
+        .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
         .tun_dev_attach =               selinux_tun_dev_attach,
+        .tun_dev_open =                 selinux_tun_dev_open,
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index df2de54a958d..14d04e63b1f0 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -150,6 +150,6 @@ struct security_class_mapping secclass_map[] = {
             NULL } },
         { "kernel_service", { "use_as_override", "create_files_as", NULL } },
         { "tun_socket",
-          { COMMON_SOCK_PERMS, NULL } },
+          { COMMON_SOCK_PERMS, "attach_queue", NULL } },
         { NULL }
   };
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 26c7eee1c309..aa47bcabb5f6 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -110,6 +110,10 @@ struct sk_security_struct {
         u16 sclass;                     /* sock security class */
 };
 
+struct tun_security_struct {
+        u32 sid;                        /* SID for the tun device sockets */
+};
+
 struct key_security_struct {
         u32 sid;        /* SID of key */
 };
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 3a6e8731646c..ff427733c290 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -202,7 +202,7 @@ static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
 {
         char tmpbuf[TMPBUFLEN];
         ssize_t length;
-        ino_t ino = filp->f_path.dentry->d_inode->i_ino;
+        ino_t ino = file_inode(filp)->i_ino;
         int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
                 security_get_reject_unknown() : !security_get_allow_unknown();
 
@@ -671,7 +671,7 @@ static ssize_t (*write_op[])(struct file *, char *, size_t) = {
 
 static ssize_t selinux_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 {
-        ino_t ino = file->f_path.dentry->d_inode->i_ino;
+        ino_t ino = file_inode(file)->i_ino;
         char *data;
         ssize_t rv;
 
@@ -1042,8 +1042,7 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
         ssize_t length;
         ssize_t ret;
         int cur_enforcing;
-        struct inode *inode = filep->f_path.dentry->d_inode;
-        unsigned index = inode->i_ino & SEL_INO_MASK;
+        unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
         const char *name = filep->f_path.dentry->d_name.name;
 
         mutex_lock(&sel_mutex);
@@ -1077,8 +1076,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
         char *page = NULL;
         ssize_t length;
         int new_value;
-        struct inode *inode = filep->f_path.dentry->d_inode;
-        unsigned index = inode->i_ino & SEL_INO_MASK;
+        unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
         const char *name = filep->f_path.dentry->d_name.name;
 
         mutex_lock(&sel_mutex);
@@ -1486,13 +1484,11 @@ static int sel_make_avc_files(struct dentry *dir)
 static ssize_t sel_read_initcon(struct file *file, char __user *buf,
                                 size_t count, loff_t *ppos)
 {
-        struct inode *inode;
         char *con;
         u32 sid, len;
         ssize_t ret;
 
-        inode = file->f_path.dentry->d_inode;
-        sid = inode->i_ino&SEL_INO_MASK;
+        sid = file_inode(file)->i_ino&SEL_INO_MASK;
         ret = security_sid_to_context(sid, &con, &len);
         if (ret)
                 return ret;
@@ -1553,7 +1549,7 @@ static inline u32 sel_ino_to_perm(unsigned long ino)
 static ssize_t sel_read_class(struct file *file, char __user *buf,
                                 size_t count, loff_t *ppos)
 {
-        unsigned long ino = file->f_path.dentry->d_inode->i_ino;
+        unsigned long ino = file_inode(file)->i_ino;
         char res[TMPBUFLEN];
         ssize_t len = snprintf(res, sizeof(res), "%d", sel_ino_to_class(ino));
         return simple_read_from_buffer(buf, count, ppos, res, len);
@@ -1567,7 +1563,7 @@ static const struct file_operations sel_class_ops = {
 static ssize_t sel_read_perm(struct file *file, char __user *buf,
                                 size_t count, loff_t *ppos)
 {
-        unsigned long ino = file->f_path.dentry->d_inode->i_ino;
+        unsigned long ino = file_inode(file)->i_ino;
         char res[TMPBUFLEN];
         ssize_t len = snprintf(res, sizeof(res), "%d", sel_ino_to_perm(ino));
         return simple_read_from_buffer(buf, count, ppos, res, len);
@@ -1584,7 +1580,7 @@ static ssize_t sel_read_policycap(struct file *file, char __user *buf,
         int value;
         char tmpbuf[TMPBUFLEN];
         ssize_t length;
-        unsigned long i_ino = file->f_path.dentry->d_inode->i_ino;
+        unsigned long i_ino = file_inode(file)->i_ino;
 
         value = security_policycap_supported(i_ino & SEL_INO_MASK);
         length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);