6 files changed, 23 insertions, 7 deletions

diff --git a/security/commoncap.c b/security/commoncap.c
index 399bfdb9e2da..3976613db829 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -279,10 +279,10 @@ static int get_file_caps(struct linux_binprm *bprm)
         struct vfs_cap_data vcaps;
         struct inode *inode;
 
-        if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
-                bprm_clear_caps(bprm);
+        bprm_clear_caps(bprm);
+
+        if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
                 return 0;
-        }
 
         dentry = dget(bprm->file->f_dentry);
         inode = dentry->d_inode;
diff --git a/security/keys/internal.h b/security/keys/internal.h
index b39f5c2e2c4b..239098f0fd76 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -107,6 +107,7 @@ extern key_ref_t search_process_keyrings(struct key_type *type,
 
 extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
 
+extern int install_user_keyrings(struct task_struct *tsk);
 extern int install_thread_keyring(struct task_struct *tsk);
 extern int install_process_keyring(struct task_struct *tsk);
 
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 5be6d018759a..45b240af6dbe 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -40,7 +40,7 @@ struct key_user root_key_user = {
 /*
  * install user and user session keyrings for a particular UID
  */
-static int install_user_keyrings(struct task_struct *tsk)
+int install_user_keyrings(struct task_struct *tsk)
 {
         struct user_struct *user = tsk->user;
         struct key *uid_keyring, *session_keyring;
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index ba32ca6469bd..abea08f87fe2 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -74,6 +74,10 @@ static int call_sbin_request_key(struct key_construction *cons,
 
         kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
 
+        ret = install_user_keyrings(tsk);
+        if (ret < 0)
+                goto error_alloc;
+
         /* allocate a new session keyring */
         sprintf(desc, "_req.%u", key->serial);
 
diff --git a/security/security.c b/security/security.c
index 255b08559b2b..c0acfa7177e5 100644
--- a/security/security.c
+++ b/security/security.c
@@ -198,14 +198,23 @@ int security_settime(struct timespec *ts, struct timezone *tz)
 
 int security_vm_enough_memory(long pages)
 {
+        WARN_ON(current->mm == NULL);
         return security_ops->vm_enough_memory(current->mm, pages);
 }
 
 int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
 {
+        WARN_ON(mm == NULL);
         return security_ops->vm_enough_memory(mm, pages);
 }
 
+int security_vm_enough_memory_kern(long pages)
+{
+        /* If current->mm is a kernel thread then we will pass NULL,
+           for this specific case that is fine */
+        return security_ops->vm_enough_memory(current->mm, pages);
+}
+
 int security_bprm_alloc(struct linux_binprm *bprm)
 {
         return security_ops->bprm_alloc_security(bprm);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3e3fde7c1d2b..f85597a4d733 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2126,14 +2126,16 @@ static inline void flush_unauthorized_files(struct files_struct *files)
         tty = get_current_tty();
         if (tty) {
                 file_list_lock();
-                file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
-                if (file) {
+                if (!list_empty(&tty->tty_files)) {
+                        struct inode *inode;
+
                         /* Revalidate access to controlling tty.
                            Use inode_has_perm on the tty inode directly rather
                            than using file_has_perm, as this particular open
                            file may belong to another process and we are only
                            interested in the inode-based check here. */
-                        struct inode *inode = file->f_path.dentry->d_inode;
+                        file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
+                        inode = file->f_path.dentry->d_inode;
                         if (inode_has_perm(current, inode,
                                            FILE__READ | FILE__WRITE, NULL)) {
                                 drop_tty = 1;