5 files changed, 46 insertions, 6 deletions

diff --git a/security/keys/compat.c b/security/keys/compat.c
index bcdb28533733..e10ec995f275 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -9,7 +9,6 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#include <linux/sched.h>
 #include <linux/syscalls.h>
 #include <linux/keyctl.h>
 #include <linux/compat.h>
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 5bbfdebb7acf..7c687d568221 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -11,7 +11,6 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/seq_file.h>
 #include <linux/err.h>
diff --git a/security/security.c b/security/security.c
index ee4e0701b6e0..fc8601b2b7ac 100644
--- a/security/security.c
+++ b/security/security.c
@@ -15,7 +15,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/security.h>
 
 #define SECURITY_FRAMEWORK_VERSION      "1.0.0"
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 35eb8de892fc..b1ac22d23195 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1077,6 +1077,9 @@ static int inode_has_perm(struct task_struct *tsk,
         struct inode_security_struct *isec;
         struct avc_audit_data ad;
 
+        if (unlikely (IS_PRIVATE (inode)))
+                return 0;
+
         tsec = tsk->security;
         isec = inode->i_security;
 
@@ -1423,6 +1426,47 @@ static int selinux_capable(struct task_struct *tsk, int cap)
         return task_has_capability(tsk,cap);
 }
 
+static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
+{
+        int buflen, rc;
+        char *buffer, *path, *end;
+
+        rc = -ENOMEM;
+        buffer = (char*)__get_free_page(GFP_KERNEL);
+        if (!buffer)
+                goto out;
+
+        buflen = PAGE_SIZE;
+        end = buffer+buflen;
+        *--end = '\0';
+        buflen--;
+        path = end-1;
+        *path = '/';
+        while (table) {
+                const char *name = table->procname;
+                size_t namelen = strlen(name);
+                buflen -= namelen + 1;
+                if (buflen < 0)
+                        goto out_free;
+                end -= namelen;
+                memcpy(end, name, namelen);
+                *--end = '/';
+                path = end;
+                table = table->parent;
+        }
+        buflen -= 4;
+        if (buflen < 0)
+                goto out_free;
+        end -= 4;
+        memcpy(end, "/sys", 4);
+        path = end;
+        rc = security_genfs_sid("proc", path, tclass, sid);
+out_free:
+        free_page((unsigned long)buffer);
+out:
+        return rc;
+}
+
 static int selinux_sysctl(ctl_table *table, int op)
 {
         int error = 0;
@@ -1437,8 +1481,8 @@ static int selinux_sysctl(ctl_table *table, int op)
 
         tsec = current->security;
 
-        rc = selinux_proc_get_sid(table->de, (op == 001) ?
-                                  SECCLASS_DIR : SECCLASS_FILE, &tsid);
+        rc = selinux_sysctl_get_sid(table, (op == 0001) ?
+                                    SECCLASS_DIR : SECCLASS_FILE, &tsid);
         if (rc) {
                 /* Default to the well-defined sysctl SID. */
                 tsid = SECINITSID_SYSCTL;
diff --git a/security/selinux/ss/sidtab.c b/security/selinux/ss/sidtab.c
index 871c33bd0741..d78f9ff30da9 100644
--- a/security/selinux/ss/sidtab.c
+++ b/security/selinux/ss/sidtab.c
@@ -7,7 +7,6 @@
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include "flask.h"
 #include "security.h"
 #include "sidtab.h"