1 files changed, 509 insertions, 164 deletions

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index c448d57ae2b7..9831a39c11f6 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3,12 +3,14 @@
  *
  *  This file contains the smack hook function implementations.
  *
- *  Author:
+ *  Authors:
  *      Casey Schaufler <casey@schaufler-ca.com>
+ *      Jarkko Sakkinen <ext-jarkko.2.sakkinen@nokia.com>
  *
  *  Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
  *  Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
  *                Paul Moore <paul.moore@hp.com>
+ *  Copyright (C) 2010 Nokia Corporation
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License version 2,
@@ -31,10 +33,14 @@
 #include <net/cipso_ipv4.h>
 #include <linux/audit.h>
 #include <linux/magic.h>
+#include <linux/dcache.h>
 #include "smack.h"
 
 #define task_security(task)     (task_cred_xxx((task), security))
 
+#define TRANS_TRUE      "TRUE"
+#define TRANS_TRUE_SIZE 4
+
 /**
  * smk_fetch - Fetch the smack label from a file.
  * @ip: a pointer to the inode
@@ -43,7 +49,7 @@
  * Returns a pointer to the master list entry for the Smack label
  * or NULL if there was no label to fetch.
  */
-static char *smk_fetch(struct inode *ip, struct dentry *dp)
+static char *smk_fetch(const char *name, struct inode *ip, struct dentry *dp)
 {
         int rc;
         char in[SMK_LABELLEN];
@@ -51,7 +57,7 @@ static char *smk_fetch(struct inode *ip, struct dentry *dp)
         if (ip->i_op->getxattr == NULL)
                 return NULL;
 
-        rc = ip->i_op->getxattr(dp, XATTR_NAME_SMACK, in, SMK_LABELLEN);
+        rc = ip->i_op->getxattr(dp, name, in, SMK_LABELLEN);
         if (rc < 0)
                 return NULL;
 
@@ -79,6 +85,56 @@ struct inode_smack *new_inode_smack(char *smack)
         return isp;
 }
 
+/**
+ * new_task_smack - allocate a task security blob
+ * @smack: a pointer to the Smack label to use in the blob
+ *
+ * Returns the new blob or NULL if there's no memory available
+ */
+static struct task_smack *new_task_smack(char *task, char *forked, gfp_t gfp)
+{
+        struct task_smack *tsp;
+
+        tsp = kzalloc(sizeof(struct task_smack), gfp);
+        if (tsp == NULL)
+                return NULL;
+
+        tsp->smk_task = task;
+        tsp->smk_forked = forked;
+        INIT_LIST_HEAD(&tsp->smk_rules);
+        mutex_init(&tsp->smk_rules_lock);
+
+        return tsp;
+}
+
+/**
+ * smk_copy_rules - copy a rule set
+ * @nhead - new rules header pointer
+ * @ohead - old rules header pointer
+ *
+ * Returns 0 on success, -ENOMEM on error
+ */
+static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
+                                gfp_t gfp)
+{
+        struct smack_rule *nrp;
+        struct smack_rule *orp;
+        int rc = 0;
+
+        INIT_LIST_HEAD(nhead);
+
+        list_for_each_entry_rcu(orp, ohead, list) {
+                nrp = kzalloc(sizeof(struct smack_rule), gfp);
+                if (nrp == NULL) {
+                        rc = -ENOMEM;
+                        break;
+                }
+                *nrp = *orp;
+                list_add_rcu(&nrp->list, nhead);
+        }
+        return rc;
+}
+
 /*
  * LSM hooks.
  * We he, that is fun!
@@ -97,23 +153,17 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
 {
         int rc;
         struct smk_audit_info ad;
-        char *sp, *tsp;
+        char *tsp;
 
         rc = cap_ptrace_access_check(ctp, mode);
         if (rc != 0)
                 return rc;
 
-        sp = current_security();
-        tsp = task_security(ctp);
+        tsp = smk_of_task(task_security(ctp));
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
         smk_ad_setfield_u_tsk(&ad, ctp);
 
-        /* we won't log here, because rc can be overriden */
-        rc = smk_access(sp, tsp, MAY_READWRITE, NULL);
-        if (rc != 0 && capable(CAP_MAC_OVERRIDE))
-                rc = 0;
-
-        smack_log(sp, tsp, MAY_READWRITE, rc, &ad);
+        rc = smk_curacc(tsp, MAY_READWRITE, &ad);
         return rc;
 }
 
@@ -129,23 +179,17 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
 {
         int rc;
         struct smk_audit_info ad;
-        char *sp, *tsp;
+        char *tsp;
 
         rc = cap_ptrace_traceme(ptp);
         if (rc != 0)
                 return rc;
 
+        tsp = smk_of_task(task_security(ptp));
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
         smk_ad_setfield_u_tsk(&ad, ptp);
 
-        sp = current_security();
-        tsp = task_security(ptp);
-        /* we won't log here, because rc can be overriden */
-        rc = smk_access(tsp, sp, MAY_READWRITE, NULL);
-        if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE))
-                rc = 0;
-
-        smack_log(tsp, sp, MAY_READWRITE, rc, &ad);
+        rc = smk_curacc(tsp, MAY_READWRITE, &ad);
         return rc;
 }
 
@@ -157,14 +201,10 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
  *
  * Returns 0 on success, error code otherwise.
  */
-static int smack_syslog(int type, bool from_file)
+static int smack_syslog(int typefrom_file)
 {
-        int rc;
-        char *sp = current_security();
-
-        rc = cap_syslog(type, from_file);
-        if (rc != 0)
-                return rc;
+        int rc = 0;
+        char *sp = smk_of_current();
 
         if (capable(CAP_MAC_OVERRIDE))
                 return 0;
@@ -343,7 +383,7 @@ static int smack_sb_statfs(struct dentry *dentry)
         int rc;
         struct smk_audit_info ad;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
         rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
@@ -367,7 +407,7 @@ static int smack_sb_mount(char *dev_name, struct path *path,
         struct superblock_smack *sbp = path->mnt->mnt_sb->s_security;
         struct smk_audit_info ad;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
         smk_ad_setfield_u_fs_path(&ad, *path);
 
         return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
@@ -385,16 +425,53 @@ static int smack_sb_umount(struct vfsmount *mnt, int flags)
 {
         struct superblock_smack *sbp;
         struct smk_audit_info ad;
+        struct path path;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
-        smk_ad_setfield_u_fs_path_dentry(&ad, mnt->mnt_root);
-        smk_ad_setfield_u_fs_path_mnt(&ad, mnt);
+        path.dentry = mnt->mnt_root;
+        path.mnt = mnt;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
+        smk_ad_setfield_u_fs_path(&ad, path);
 
         sbp = mnt->mnt_sb->s_security;
         return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
 }
 
 /*
+ * BPRM hooks
+ */
+
+static int smack_bprm_set_creds(struct linux_binprm *bprm)
+{
+        struct task_smack *tsp = bprm->cred->security;
+        struct inode_smack *isp;
+        struct dentry *dp;
+        int rc;
+
+        rc = cap_bprm_set_creds(bprm);
+        if (rc != 0)
+                return rc;
+
+        if (bprm->cred_prepared)
+                return 0;
+
+        if (bprm->file == NULL || bprm->file->f_dentry == NULL)
+                return 0;
+
+        dp = bprm->file->f_dentry;
+
+        if (dp->d_inode == NULL)
+                return 0;
+
+        isp = dp->d_inode->i_security;
+
+        if (isp->smk_task != NULL)
+                tsp->smk_task = isp->smk_task;
+
+        return 0;
+}
+
+/*
  * Inode hooks
  */
 
@@ -406,7 +483,7 @@ static int smack_sb_umount(struct vfsmount *mnt, int flags)
  */
 static int smack_inode_alloc_security(struct inode *inode)
 {
-        inode->i_security = new_inode_smack(current_security());
+        inode->i_security = new_inode_smack(smk_of_current());
         if (inode->i_security == NULL)
                 return -ENOMEM;
         return 0;
@@ -428,6 +505,7 @@ static void smack_inode_free_security(struct inode *inode)
  * smack_inode_init_security - copy out the smack from an inode
  * @inode: the inode
  * @dir: unused
+ * @qstr: unused
  * @name: where to put the attribute name
  * @value: where to put the attribute value
  * @len: where to put the length of the attribute
@@ -435,9 +513,12 @@ static void smack_inode_free_security(struct inode *inode)
  * Returns 0 if it all works out, -ENOMEM if there's no memory
  */
 static int smack_inode_init_security(struct inode *inode, struct inode *dir,
-                                     char **name, void **value, size_t *len)
+                                     const struct qstr *qstr, char **name,
+                                     void **value, size_t *len)
 {
         char *isp = smk_of_inode(inode);
+        char *dsp = smk_of_inode(dir);
+        int may;
 
         if (name) {
                 *name = kstrdup(XATTR_SMACK_SUFFIX, GFP_KERNEL);
@@ -446,6 +527,19 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
         }
 
         if (value) {
+                rcu_read_lock();
+                may = smk_access_entry(smk_of_current(), dsp, &smack_rule_list);
+                rcu_read_unlock();
+
+                /*
+                 * If the access rule allows transmutation and
+                 * the directory requests transmutation then
+                 * by all means transmute.
+                 */
+                if (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
+                    smk_inode_transmutable(dir))
+                        isp = dsp;
+
                 *value = kstrdup(isp, GFP_KERNEL);
                 if (*value == NULL)
                         return -ENOMEM;
@@ -472,7 +566,7 @@ static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
         struct smk_audit_info ad;
         int rc;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
 
         isp = smk_of_inode(old_dentry->d_inode);
@@ -501,7 +595,7 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
         struct smk_audit_info ad;
         int rc;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
         /*
@@ -532,7 +626,7 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
         struct smk_audit_info ad;
         int rc;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
         /*
@@ -572,7 +666,7 @@ static int smack_inode_rename(struct inode *old_inode,
         char *isp;
         struct smk_audit_info ad;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
 
         isp = smk_of_inode(old_dentry->d_inode);
@@ -595,7 +689,7 @@ static int smack_inode_rename(struct inode *old_inode,
  *
  * Returns 0 if access is permitted, -EACCES otherwise
  */
-static int smack_inode_permission(struct inode *inode, int mask)
+static int smack_inode_permission(struct inode *inode, int mask, unsigned flags)
 {
         struct smk_audit_info ad;
 
@@ -605,7 +699,11 @@ static int smack_inode_permission(struct inode *inode, int mask)
          */
         if (mask == 0)
                 return 0;
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+
+        /* May be droppable after audit */
+        if (flags & IPERM_FLAG_RCU)
+                return -ECHILD;
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
         smk_ad_setfield_u_fs_inode(&ad, inode);
         return smk_curacc(smk_of_inode(inode), mask, &ad);
 }
@@ -625,7 +723,7 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
          */
         if (iattr->ia_valid & ATTR_FORCE)
                 return 0;
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
         return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
@@ -641,10 +739,13 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
 static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 {
         struct smk_audit_info ad;
+        struct path path;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
-        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
-        smk_ad_setfield_u_fs_path_mnt(&ad, mnt);
+        path.dentry = dentry;
+        path.mnt = mnt;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
+        smk_ad_setfield_u_fs_path(&ad, path);
         return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
 }
 
@@ -668,7 +769,9 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
 
         if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
             strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
-            strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
+            strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
+            strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
+            strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
                 if (!capable(CAP_MAC_ADMIN))
                         rc = -EPERM;
                 /*
@@ -678,10 +781,16 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
                 if (size == 0 || size >= SMK_LABELLEN ||
                     smk_import(value, size) == NULL)
                         rc = -EINVAL;
+        } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
+                if (!capable(CAP_MAC_ADMIN))
+                        rc = -EPERM;
+                if (size != TRANS_TRUE_SIZE ||
+                    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
+                        rc = -EINVAL;
         } else
                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
         if (rc == 0)
@@ -704,26 +813,29 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
                                       const void *value, size_t size, int flags)
 {
-        struct inode_smack *isp;
         char *nsp;
+        struct inode_smack *isp = dentry->d_inode->i_security;
 
-        /*
-         * Not SMACK
-         */
-        if (strcmp(name, XATTR_NAME_SMACK))
-                return;
-
-        isp = dentry->d_inode->i_security;
-
-        /*
-         * No locking is done here. This is a pointer
-         * assignment.
-         */
-        nsp = smk_import(value, size);
-        if (nsp != NULL)
-                isp->smk_inode = nsp;
-        else
-                isp->smk_inode = smack_known_invalid.smk_known;
+        if (strcmp(name, XATTR_NAME_SMACK) == 0) {
+                nsp = smk_import(value, size);
+                if (nsp != NULL)
+                        isp->smk_inode = nsp;
+                else
+                        isp->smk_inode = smack_known_invalid.smk_known;
+        } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
+                nsp = smk_import(value, size);
+                if (nsp != NULL)
+                        isp->smk_task = nsp;
+                else
+                        isp->smk_task = smack_known_invalid.smk_known;
+        } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
+                nsp = smk_import(value, size);
+                if (nsp != NULL)
+                        isp->smk_mmap = nsp;
+                else
+                        isp->smk_mmap = smack_known_invalid.smk_known;
+        } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
+                isp->smk_flags |= SMK_INODE_TRANSMUTE;
 
         return;
 }
@@ -739,7 +851,7 @@ static int smack_inode_getxattr(struct dentry *dentry, const char *name)
 {
         struct smk_audit_info ad;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
         return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
@@ -756,22 +868,32 @@ static int smack_inode_getxattr(struct dentry *dentry, const char *name)
  */
 static int smack_inode_removexattr(struct dentry *dentry, const char *name)
 {
+        struct inode_smack *isp;
         struct smk_audit_info ad;
         int rc = 0;
 
         if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
             strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
-            strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
+            strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
+            strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
+            strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
+            strcmp(name, XATTR_NAME_SMACKMMAP)) {
                 if (!capable(CAP_MAC_ADMIN))
                         rc = -EPERM;
         } else
                 rc = cap_inode_removexattr(dentry, name);
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
         smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
         if (rc == 0)
                 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
 
+        if (rc == 0) {
+                isp = dentry->d_inode->i_security;
+                isp->smk_task = NULL;
+                isp->smk_mmap = NULL;
+        }
+
         return rc;
 }
 
@@ -899,7 +1021,7 @@ static int smack_file_permission(struct file *file, int mask)
  */
 static int smack_file_alloc_security(struct file *file)
 {
-        file->f_security = current_security();
+        file->f_security = smk_of_current();
         return 0;
 }
 
@@ -931,7 +1053,7 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
         int rc = 0;
         struct smk_audit_info ad;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
         smk_ad_setfield_u_fs_path(&ad, file->f_path);
 
         if (_IOC_DIR(cmd) & _IOC_WRITE)
@@ -954,8 +1076,8 @@ static int smack_file_lock(struct file *file, unsigned int cmd)
 {
         struct smk_audit_info ad;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
-        smk_ad_setfield_u_fs_path_dentry(&ad, file->f_path.dentry);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
+        smk_ad_setfield_u_fs_path(&ad, file->f_path);
         return smk_curacc(file->f_security, MAY_WRITE, &ad);
 }
 
@@ -973,7 +1095,7 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
         struct smk_audit_info ad;
         int rc;
 
-        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
         smk_ad_setfield_u_fs_path(&ad, file->f_path);
 
         switch (cmd) {
@@ -1001,6 +1123,126 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
 }
 
 /**
+ * smack_file_mmap :
+ * Check permissions for a mmap operation.  The @file may be NULL, e.g.
+ * if mapping anonymous memory.
+ * @file contains the file structure for file to map (may be NULL).
+ * @reqprot contains the protection requested by the application.
+ * @prot contains the protection that will be applied by the kernel.
+ * @flags contains the operational flags.
+ * Return 0 if permission is granted.
+ */
+static int smack_file_mmap(struct file *file,
+                           unsigned long reqprot, unsigned long prot,
+                           unsigned long flags, unsigned long addr,
+                           unsigned long addr_only)
+{
+        struct smack_rule *srp;
+        struct task_smack *tsp;
+        char *sp;
+        char *msmack;
+        char *osmack;
+        struct inode_smack *isp;
+        struct dentry *dp;
+        int may;
+        int mmay;
+        int tmay;
+        int rc;
+
+        /* do DAC check on address space usage */
+        rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
+        if (rc || addr_only)
+                return rc;
+
+        if (file == NULL || file->f_dentry == NULL)
+                return 0;
+
+        dp = file->f_dentry;
+
+        if (dp->d_inode == NULL)
+                return 0;
+
+        isp = dp->d_inode->i_security;
+        if (isp->smk_mmap == NULL)
+                return 0;
+        msmack = isp->smk_mmap;
+
+        tsp = current_security();
+        sp = smk_of_current();
+        rc = 0;
+
+        rcu_read_lock();
+        /*
+         * For each Smack rule associated with the subject
+         * label verify that the SMACK64MMAP also has access
+         * to that rule's object label.
+         *
+         * Because neither of the labels comes
+         * from the networking code it is sufficient
+         * to compare pointers.
+         */
+        list_for_each_entry_rcu(srp, &smack_rule_list, list) {
+                if (srp->smk_subject != sp)
+                        continue;
+
+                osmack = srp->smk_object;
+                /*
+                 * Matching labels always allows access.
+                 */
+                if (msmack == osmack)
+                        continue;
+                /*
+                 * If there is a matching local rule take
+                 * that into account as well.
+                 */
+                may = smk_access_entry(srp->smk_subject, osmack,
+                                        &tsp->smk_rules);
+                if (may == -ENOENT)
+                        may = srp->smk_access;
+                else
+                        may &= srp->smk_access;
+                /*
+                 * If may is zero the SMACK64MMAP subject can't
+                 * possibly have less access.
+                 */
+                if (may == 0)
+                        continue;
+
+                /*
+                 * Fetch the global list entry.
+                 * If there isn't one a SMACK64MMAP subject
+                 * can't have as much access as current.
+                 */
+                mmay = smk_access_entry(msmack, osmack, &smack_rule_list);
+                if (mmay == -ENOENT) {
+                        rc = -EACCES;
+                        break;
+                }
+                /*
+                 * If there is a local entry it modifies the
+                 * potential access, too.
+                 */
+                tmay = smk_access_entry(msmack, osmack, &tsp->smk_rules);
+                if (tmay != -ENOENT)
+                        mmay &= tmay;
+
+                /*
+                 * If there is any access available to current that is
+                 * not available to a SMACK64MMAP subject
+                 * deny access.
+                 */
+                if ((may | mmay) != mmay) {
+                        rc = -EACCES;
+                        break;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return rc;
+}
+
+/**
  * smack_file_set_fowner - set the file security blob value
  * @file: object in question
  *
@@ -1009,7 +1251,7 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
  */
 static int smack_file_set_fowner(struct file *file)
 {
-        file->f_security = current_security();
+        file->f_security = smk_of_current();
         return 0;
 }
 
@@ -1029,13 +1271,14 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
 {
         struct file *file;
         int rc;
-        char *tsp = tsk->cred->security;
+        char *tsp = smk_of_task(tsk->cred->security);
         struct smk_audit_info ad;
 
         /*
          * struct fown_struct is never outside the context of a struct file
          */
         file = container_of(fown, struct file, f_owner);
+
         /* we don't log here as rc can be overriden */
         rc = smk_access(file->f_security, tsp, MAY_WRITE, NULL);
         if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
@@ -1086,7 +1329,14 @@ static int smack_file_receive(struct file *file)
  */
 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
 {
-        cred->security = NULL;
+        struct task_smack *tsp;
+
+        tsp = new_task_smack(NULL, NULL, gfp);
+        if (tsp == NULL)
+                return -ENOMEM;
+
+        cred->security = tsp;
+
         return 0;
 }
 
@@ -1095,13 +1345,24 @@ static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
  * smack_cred_free - "free" task-level security credentials
  * @cred: the credentials in question
  *
- * Smack isn't using copies of blobs. Everyone
- * points to an immutable list. The blobs never go away.
- * There is no leak here.
  */
 static void smack_cred_free(struct cred *cred)
 {
+        struct task_smack *tsp = cred->security;
+        struct smack_rule *rp;
+        struct list_head *l;
+        struct list_head *n;
+
+        if (tsp == NULL)
+                return;
         cred->security = NULL;
+
+        list_for_each_safe(l, n, &tsp->smk_rules) {
+                rp = list_entry(l, struct smack_rule, list);
+                list_del(&rp->list);
+                kfree(rp);
+        }
+        kfree(tsp);
 }
 
 /**
@@ -1115,7 +1376,19 @@ static void smack_cred_free(struct cred *cred)
 static int smack_cred_prepare(struct cred *new, const struct cred *old,
                               gfp_t gfp)
 {
-        new->security = old->security;
+        struct task_smack *old_tsp = old->security;
+        struct task_smack *new_tsp;
+        int rc;
+
+        new_tsp = new_task_smack(old_tsp->smk_task, old_tsp->smk_task, gfp);
+        if (new_tsp == NULL)
+                return -ENOMEM;
+
+        rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp);
+        if (rc != 0)
+                return rc;
+
+        new->security = new_tsp;
         return 0;
 }
 
@@ -1128,7 +1401,16 @@ static int smack_cred_prepare(struct cred *new, const struct cred *old,
  */
 static void smack_cred_transfer(struct cred *new, const struct cred *old)
 {
-        new->security = old->security;
+        struct task_smack *old_tsp = old->security;
+        struct task_smack *new_tsp = new->security;
+
+        new_tsp->smk_task = old_tsp->smk_task;
+        new_tsp->smk_forked = old_tsp->smk_task;
+        mutex_init(&new_tsp->smk_rules_lock);
+        INIT_LIST_HEAD(&new_tsp->smk_rules);
+
+
+        /* cbs copy rule list */
 }
 
 /**
@@ -1140,12 +1422,13 @@ static void smack_cred_transfer(struct cred *new, const struct cred *old)
  */
 static int smack_kernel_act_as(struct cred *new, u32 secid)
 {
+        struct task_smack *new_tsp = new->security;
         char *smack = smack_from_secid(secid);
 
         if (smack == NULL)
                 return -EINVAL;
 
-        new->security = smack;
+        new_tsp->smk_task = smack;
         return 0;
 }
 
@@ -1161,8 +1444,10 @@ static int smack_kernel_create_files_as(struct cred *new,
                                         struct inode *inode)
 {
         struct inode_smack *isp = inode->i_security;
+        struct task_smack *tsp = new->security;
 
-        new->security = isp->smk_inode;
+        tsp->smk_forked = isp->smk_inode;
+        tsp->smk_task = isp->smk_inode;
         return 0;
 }
 
@@ -1179,7 +1464,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access)
 
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
         smk_ad_setfield_u_tsk(&ad, p);
-        return smk_curacc(task_security(p), access, &ad);
+        return smk_curacc(smk_of_task(task_security(p)), access, &ad);
 }
 
 /**
@@ -1225,7 +1510,7 @@ static int smack_task_getsid(struct task_struct *p)
  */
 static void smack_task_getsecid(struct task_struct *p, u32 *secid)
 {
-        *secid = smack_to_secid(task_security(p));
+        *secid = smack_to_secid(smk_of_task(task_security(p)));
 }
 
 /**
@@ -1281,12 +1566,11 @@ static int smack_task_getioprio(struct task_struct *p)
  *
  * Return 0 if read access is permitted
  */
-static int smack_task_setscheduler(struct task_struct *p, int policy,
-                                   struct sched_param *lp)
+static int smack_task_setscheduler(struct task_struct *p)
 {
         int rc;
 
-        rc = cap_task_setscheduler(p, policy, lp);
+        rc = cap_task_setscheduler(p);
         if (rc == 0)
                 rc = smk_curacc_on_task(p, MAY_WRITE);
         return rc;
@@ -1338,14 +1622,15 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
          * can write the receiver.
          */
         if (secid == 0)
-                return smk_curacc(task_security(p), MAY_WRITE, &ad);
+                return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE,
+                                  &ad);
         /*
          * If the secid isn't 0 we're dealing with some USB IO
          * specific behavior. This is not clean. For one thing
          * we can't take privilege into account.
          */
-        return smk_access(smack_from_secid(secid), task_security(p),
-                          MAY_WRITE, &ad);
+        return smk_access(smack_from_secid(secid),
+                          smk_of_task(task_security(p)), MAY_WRITE, &ad);
 }
 
 /**
@@ -1357,12 +1642,12 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
 static int smack_task_wait(struct task_struct *p)
 {
         struct smk_audit_info ad;
-        char *sp = current_security();
-        char *tsp = task_security(p);
+        char *sp = smk_of_current();
+        char *tsp = smk_of_forked(task_security(p));
         int rc;
 
         /* we don't log here, we can be overriden */
-        rc = smk_access(sp, tsp, MAY_WRITE, NULL);
+        rc = smk_access(tsp, sp, MAY_WRITE, NULL);
         if (rc == 0)
                 goto out_log;
 
@@ -1383,7 +1668,7 @@ static int smack_task_wait(struct task_struct *p)
  out_log:
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
         smk_ad_setfield_u_tsk(&ad, p);
-        smack_log(sp, tsp, MAY_WRITE, rc, &ad);
+        smack_log(tsp, sp, MAY_WRITE, rc, &ad);
         return rc;
 }
 
@@ -1397,7 +1682,7 @@ static int smack_task_wait(struct task_struct *p)
 static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
 {
         struct inode_smack *isp = inode->i_security;
-        isp->smk_inode = task_security(p);
+        isp->smk_inode = smk_of_task(task_security(p));
 }
 
 /*
@@ -1416,7 +1701,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
  */
 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
 {
-        char *csp = current_security();
+        char *csp = smk_of_current();
         struct socket_smack *ssp;
 
         ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
@@ -1519,7 +1804,7 @@ static void smack_set_catset(char *catset, struct netlbl_lsm_secattr *sap)
  * Casey says that CIPSO is good enough for now.
  * It can be used to effect.
  * It can also be abused to effect when necessary.
- * Appologies to the TSIG group in general and GW in particular.
+ * Apologies to the TSIG group in general and GW in particular.
  */
 static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp)
 {
@@ -1672,10 +1957,13 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
                 ssp->smk_in = sp;
         else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
                 ssp->smk_out = sp;
-                rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
-                if (rc != 0)
-                        printk(KERN_WARNING "Smack: \"%s\" netlbl error %d.\n",
-                               __func__, -rc);
+                if (sock->sk->sk_family != PF_UNIX) {
+                        rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
+                        if (rc != 0)
+                                printk(KERN_WARNING
+                                        "Smack: \"%s\" netlbl error %d.\n",
+                                        __func__, -rc);
+                }
         } else
                 return -EOPNOTSUPP;
 
@@ -1754,7 +2042,7 @@ static int smack_flags_to_may(int flags)
  */
 static int smack_msg_msg_alloc_security(struct msg_msg *msg)
 {
-        msg->security = current_security();
+        msg->security = smk_of_current();
         return 0;
 }
 
@@ -1790,7 +2078,7 @@ static int smack_shm_alloc_security(struct shmid_kernel *shp)
 {
         struct kern_ipc_perm *isp = &shp->shm_perm;
 
-        isp->security = current_security();
+        isp->security = smk_of_current();
         return 0;
 }
 
@@ -1913,7 +2201,7 @@ static int smack_sem_alloc_security(struct sem_array *sma)
 {
         struct kern_ipc_perm *isp = &sma->sem_perm;
 
-        isp->security = current_security();
+        isp->security = smk_of_current();
         return 0;
 }
 
@@ -2031,7 +2319,7 @@ static int smack_msg_queue_alloc_security(struct msg_queue *msq)
 {
         struct kern_ipc_perm *kisp = &msq->q_perm;
 
-        kisp->security = current_security();
+        kisp->security = smk_of_current();
         return 0;
 }
 
@@ -2203,9 +2491,11 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
         struct super_block *sbp;
         struct superblock_smack *sbsp;
         struct inode_smack *isp;
-        char *csp = current_security();
+        char *csp = smk_of_current();
         char *fetched;
         char *final;
+        char trattr[TRANS_TRUE_SIZE];
+        int transflag = 0;
         struct dentry *dp;
 
         if (inode == NULL)
@@ -2250,7 +2540,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
         switch (sbp->s_magic) {
         case SMACK_MAGIC:
                 /*
-                 * Casey says that it's a little embarassing
+                 * Casey says that it's a little embarrassing
                  * that the smack file system doesn't do
                  * extended attributes.
                  */
@@ -2272,9 +2562,10 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
                 break;
         case SOCKFS_MAGIC:
                 /*
-                 * Casey says sockets get the smack of the task.
+                 * Socket access is controlled by the socket
+                 * structures associated with the task involved.
                  */
-                final = csp;
+                final = smack_known_star.smk_known;
                 break;
         case PROC_SUPER_MAGIC:
                 /*
@@ -2301,7 +2592,16 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
                 /*
                  * This isn't an understood special case.
                  * Get the value from the xattr.
-                 *
+                 */
+
+                /*
+                 * UNIX domain sockets use lower level socket data.
+                 */
+                if (S_ISSOCK(inode->i_mode)) {
+                        final = smack_known_star.smk_known;
+                        break;
+                }
+                /*
                  * No xattr support means, alas, no SMACK label.
                  * Use the aforeapplied default.
                  * It would be curious if the label of the task
@@ -2313,9 +2613,22 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
                  * Get the dentry for xattr.
                  */
                 dp = dget(opt_dentry);
-                fetched = smk_fetch(inode, dp);
-                if (fetched != NULL)
+                fetched = smk_fetch(XATTR_NAME_SMACK, inode, dp);
+                if (fetched != NULL) {
                         final = fetched;
+                        if (S_ISDIR(inode->i_mode)) {
+                                trattr[0] = '\0';
+                                inode->i_op->getxattr(dp,
+                                        XATTR_NAME_SMACKTRANSMUTE,
+                                        trattr, TRANS_TRUE_SIZE);
+                                if (strncmp(trattr, TRANS_TRUE,
+                                            TRANS_TRUE_SIZE) == 0)
+                                        transflag = SMK_INODE_TRANSMUTE;
+                        }
+                }
+                isp->smk_task = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
+                isp->smk_mmap = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
+
                 dput(dp);
                 break;
         }
@@ -2325,7 +2638,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
         else
                 isp->smk_inode = final;
 
-        isp->smk_flags |= SMK_INODE_INSTANT;
+        isp->smk_flags |= (SMK_INODE_INSTANT | transflag);
 
 unlockandout:
         mutex_unlock(&isp->smk_lock);
@@ -2350,7 +2663,7 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
         if (strcmp(name, "current") != 0)
                 return -EINVAL;
 
-        cp = kstrdup(task_security(p), GFP_KERNEL);
+        cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL);
         if (cp == NULL)
                 return -ENOMEM;
 
@@ -2374,6 +2687,9 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
 static int smack_setprocattr(struct task_struct *p, char *name,
                              void *value, size_t size)
 {
+        int rc;
+        struct task_smack *tsp;
+        struct task_smack *oldtsp;
         struct cred *new;
         char *newsmack;
 
@@ -2403,34 +2719,49 @@ static int smack_setprocattr(struct task_struct *p, char *name,
         if (newsmack == smack_known_web.smk_known)
                 return -EPERM;
 
+        oldtsp = p->cred->security;
         new = prepare_creds();
         if (new == NULL)
                 return -ENOMEM;
-        new->security = newsmack;
+
+        tsp = new_task_smack(newsmack, oldtsp->smk_forked, GFP_KERNEL);
+        if (tsp == NULL) {
+                kfree(new);
+                return -ENOMEM;
+        }
+        rc = smk_copy_rules(&tsp->smk_rules, &oldtsp->smk_rules, GFP_KERNEL);
+        if (rc != 0)
+                return rc;
+
+        new->security = tsp;
         commit_creds(new);
         return size;
 }
 
 /**
  * smack_unix_stream_connect - Smack access on UDS
- * @sock: one socket
- * @other: the other socket
+ * @sock: one sock
+ * @other: the other sock
  * @newsk: unused
  *
  * Return 0 if a subject with the smack of sock could access
  * an object with the smack of other, otherwise an error code
  */
-static int smack_unix_stream_connect(struct socket *sock,
-                                     struct socket *other, struct sock *newsk)
+static int smack_unix_stream_connect(struct sock *sock,
+                                     struct sock *other, struct sock *newsk)
 {
-        struct inode *sp = SOCK_INODE(sock);
-        struct inode *op = SOCK_INODE(other);
+        struct socket_smack *ssp = sock->sk_security;
+        struct socket_smack *osp = other->sk_security;
         struct smk_audit_info ad;
+        int rc = 0;
 
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
-        smk_ad_setfield_u_net_sk(&ad, other->sk);
-        return smk_access(smk_of_inode(sp), smk_of_inode(op),
-                                 MAY_READWRITE, &ad);
+        smk_ad_setfield_u_net_sk(&ad, other);
+
+        if (!capable(CAP_MAC_OVERRIDE))
+                rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
+
+        return rc;
 }
 
 /**
@@ -2443,13 +2774,18 @@ static int smack_unix_stream_connect(struct socket *sock,
  */
 static int smack_unix_may_send(struct socket *sock, struct socket *other)
 {
-        struct inode *sp = SOCK_INODE(sock);
-        struct inode *op = SOCK_INODE(other);
+        struct socket_smack *ssp = sock->sk->sk_security;
+        struct socket_smack *osp = other->sk->sk_security;
         struct smk_audit_info ad;
+        int rc = 0;
 
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
         smk_ad_setfield_u_net_sk(&ad, other->sk);
-        return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_WRITE, &ad);
+
+        if (!capable(CAP_MAC_OVERRIDE))
+                rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
+
+        return rc;
 }
 
 /**
@@ -2634,7 +2970,7 @@ static int smack_socket_getpeersec_stream(struct socket *sock,
 
 /**
  * smack_socket_getpeersec_dgram - pull in packet label
- * @sock: the socket
+ * @sock: the peer socket
  * @skb: packet data
  * @secid: pointer to where to put the secid of the packet
  *
@@ -2645,41 +2981,39 @@ static int smack_socket_getpeersec_dgram(struct socket *sock,
 
 {
         struct netlbl_lsm_secattr secattr;
-        struct sock *sk;
+        struct socket_smack *sp;
         char smack[SMK_LABELLEN];
-        int family = PF_INET;
-        u32 s;
+        int family = PF_UNSPEC;
+        u32 s = 0;      /* 0 is the invalid secid */
         int rc;
 
-        /*
-         * Only works for families with packets.
-         */
-        if (sock != NULL) {
-                sk = sock->sk;
-                if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
-                        return 0;
-                family = sk->sk_family;
+        if (skb != NULL) {
+                if (skb->protocol == htons(ETH_P_IP))
+                        family = PF_INET;
+                else if (skb->protocol == htons(ETH_P_IPV6))
+                        family = PF_INET6;
         }
-        /*
-         * Translate what netlabel gave us.
-         */
-        netlbl_secattr_init(&secattr);
-        rc = netlbl_skbuff_getattr(skb, family, &secattr);
-        if (rc == 0)
-                smack_from_secattr(&secattr, smack);
-        netlbl_secattr_destroy(&secattr);
+        if (family == PF_UNSPEC && sock != NULL)
+                family = sock->sk->sk_family;
 
-        /*
-         * Give up if we couldn't get anything
-         */
-        if (rc != 0)
-                return rc;
-
-        s = smack_to_secid(smack);
+        if (family == PF_UNIX) {
+                sp = sock->sk->sk_security;
+                s = smack_to_secid(sp->smk_out);
+        } else if (family == PF_INET || family == PF_INET6) {
+                /*
+                 * Translate what netlabel gave us.
+                 */
+                netlbl_secattr_init(&secattr);
+                rc = netlbl_skbuff_getattr(skb, family, &secattr);
+                if (rc == 0) {
+                        smack_from_secattr(&secattr, smack);
+                        s = smack_to_secid(smack);
+                }
+                netlbl_secattr_destroy(&secattr);
+        }
+        *secid = s;
         if (s == 0)
                 return -EINVAL;
-
-        *secid = s;
         return 0;
 }
 
@@ -2700,7 +3034,7 @@ static void smack_sock_graft(struct sock *sk, struct socket *parent)
                 return;
 
         ssp = sk->sk_security;
-        ssp->smk_in = ssp->smk_out = current_security();
+        ssp->smk_in = ssp->smk_out = smk_of_current();
         /* cssp->smk_packet is already set in smack_inet_csk_clone() */
 }
 
@@ -2760,7 +3094,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         /*
          * We need to decide if we want to label the incoming connection here
          * if we do we only need to label the request_sock and the stack will
-         * propogate the wire-label to the sock when it is created.
+         * propagate the wire-label to the sock when it is created.
          */
         hdr = ip_hdr(skb);
         addr.sin_addr.s_addr = hdr->saddr;
@@ -2821,7 +3155,7 @@ static void smack_inet_csk_clone(struct sock *sk,
 static int smack_key_alloc(struct key *key, const struct cred *cred,
                            unsigned long flags)
 {
-        key->security = cred->security;
+        key->security = smk_of_task(cred->security);
         return 0;
 }
 
@@ -2850,6 +3184,7 @@ static int smack_key_permission(key_ref_t key_ref,
 {
         struct key *keyp;
         struct smk_audit_info ad;
+        char *tsp = smk_of_task(cred->security);
 
         keyp = key_ref_to_ptr(key_ref);
         if (keyp == NULL)
@@ -2863,14 +3198,14 @@ static int smack_key_permission(key_ref_t key_ref,
         /*
          * This should not occur
          */
-        if (cred->security == NULL)
+        if (tsp == NULL)
                 return -EACCES;
 #ifdef CONFIG_AUDIT
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
         ad.a.u.key_struct.key = keyp->serial;
         ad.a.u.key_struct.key_desc = keyp->description;
 #endif
-        return smk_access(cred->security, keyp->security,
+        return smk_access(tsp, keyp->security,
                                  MAY_READWRITE, &ad);
 }
 #endif /* CONFIG_KEYS */
@@ -3005,7 +3340,8 @@ static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 {
         char *sp = smack_from_secid(secid);
 
-        *secdata = sp;
+        if (secdata)
+                *secdata = sp;
         *seclen = strlen(sp);
         return 0;
 }
@@ -3071,6 +3407,8 @@ struct security_operations smack_ops = {
         .sb_mount =                     smack_sb_mount,
         .sb_umount =                    smack_sb_umount,
 
+        .bprm_set_creds =               smack_bprm_set_creds,
+
         .inode_alloc_security =         smack_inode_alloc_security,
         .inode_free_security =          smack_inode_free_security,
         .inode_init_security =          smack_inode_init_security,
@@ -3096,6 +3434,7 @@ struct security_operations smack_ops = {
         .file_ioctl =                   smack_file_ioctl,
         .file_lock =                    smack_file_lock,
         .file_fcntl =                   smack_file_fcntl,
+        .file_mmap =                    smack_file_mmap,
         .file_set_fowner =              smack_file_set_fowner,
         .file_send_sigiotask =          smack_file_send_sigiotask,
         .file_receive =                 smack_file_receive,
@@ -3207,17 +3546,23 @@ static __init void init_smack_know_list(void)
 static __init int smack_init(void)
 {
         struct cred *cred;
+        struct task_smack *tsp;
 
         if (!security_module_enable(&smack_ops))
                 return 0;
 
+        tsp = new_task_smack(smack_known_floor.smk_known,
+                                smack_known_floor.smk_known, GFP_KERNEL);
+        if (tsp == NULL)
+                return -ENOMEM;
+
         printk(KERN_INFO "Smack:  Initializing.\n");
 
         /*
          * Set the security state for the initial task.
          */
         cred = (struct cred *) current->cred;
-        cred->security = &smack_known_floor.smk_known;
+        cred->security = tsp;
 
         /* initialize the smack_know_list */
         init_smack_know_list();