2 files changed, 67 insertions, 163 deletions

diff --git a/security/dummy.c b/security/dummy.c
index 6ff887586479..9623a61dfc76 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -258,16 +258,16 @@ static void dummy_inode_free_security (struct inode *inode)
         return;
 }
 
-static int dummy_inode_create (struct inode *inode, struct dentry *dentry,
-                               int mask)
+static int dummy_inode_init_security (struct inode *inode, struct inode *dir,
+                                      char **name, void **value, size_t *len)
 {
-        return 0;
+        return -EOPNOTSUPP;
 }
 
-static void dummy_inode_post_create (struct inode *inode, struct dentry *dentry,
-                                     int mask)
+static int dummy_inode_create (struct inode *inode, struct dentry *dentry,
+                               int mask)
 {
-        return;
+        return 0;
 }
 
 static int dummy_inode_link (struct dentry *old_dentry, struct inode *inode,
@@ -276,13 +276,6 @@ static int dummy_inode_link (struct dentry *old_dentry, struct inode *inode,
         return 0;
 }
 
-static void dummy_inode_post_link (struct dentry *old_dentry,
-                                   struct inode *inode,
-                                   struct dentry *new_dentry)
-{
-        return;
-}
-
 static int dummy_inode_unlink (struct inode *inode, struct dentry *dentry)
 {
         return 0;
@@ -294,24 +287,12 @@ static int dummy_inode_symlink (struct inode *inode, struct dentry *dentry,
         return 0;
 }
 
-static void dummy_inode_post_symlink (struct inode *inode,
-                                      struct dentry *dentry, const char *name)
-{
-        return;
-}
-
 static int dummy_inode_mkdir (struct inode *inode, struct dentry *dentry,
                               int mask)
 {
         return 0;
 }
 
-static void dummy_inode_post_mkdir (struct inode *inode, struct dentry *dentry,
-                                    int mask)
-{
-        return;
-}
-
 static int dummy_inode_rmdir (struct inode *inode, struct dentry *dentry)
 {
         return 0;
@@ -323,12 +304,6 @@ static int dummy_inode_mknod (struct inode *inode, struct dentry *dentry,
         return 0;
 }
 
-static void dummy_inode_post_mknod (struct inode *inode, struct dentry *dentry,
-                                    int mode, dev_t dev)
-{
-        return;
-}
-
 static int dummy_inode_rename (struct inode *old_inode,
                                struct dentry *old_dentry,
                                struct inode *new_inode,
@@ -337,14 +312,6 @@ static int dummy_inode_rename (struct inode *old_inode,
         return 0;
 }
 
-static void dummy_inode_post_rename (struct inode *old_inode,
-                                     struct dentry *old_dentry,
-                                     struct inode *new_inode,
-                                     struct dentry *new_dentry)
-{
-        return;
-}
-
 static int dummy_inode_readlink (struct dentry *dentry)
 {
         return 0;
@@ -886,20 +853,15 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, sb_post_pivotroot);
         set_to_dummy_if_null(ops, inode_alloc_security);
         set_to_dummy_if_null(ops, inode_free_security);
+        set_to_dummy_if_null(ops, inode_init_security);
         set_to_dummy_if_null(ops, inode_create);
-        set_to_dummy_if_null(ops, inode_post_create);
         set_to_dummy_if_null(ops, inode_link);
-        set_to_dummy_if_null(ops, inode_post_link);
         set_to_dummy_if_null(ops, inode_unlink);
         set_to_dummy_if_null(ops, inode_symlink);
-        set_to_dummy_if_null(ops, inode_post_symlink);
         set_to_dummy_if_null(ops, inode_mkdir);
-        set_to_dummy_if_null(ops, inode_post_mkdir);
         set_to_dummy_if_null(ops, inode_rmdir);
         set_to_dummy_if_null(ops, inode_mknod);
-        set_to_dummy_if_null(ops, inode_post_mknod);
         set_to_dummy_if_null(ops, inode_rename);
-        set_to_dummy_if_null(ops, inode_post_rename);
         set_to_dummy_if_null(ops, inode_readlink);
         set_to_dummy_if_null(ops, inode_follow_link);
         set_to_dummy_if_null(ops, inode_permission);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8641f8894b4c..f40c8221ec1b 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1265,85 +1265,6 @@ static int inode_security_set_sid(struct inode *inode, u32 sid)
         return 0;
 }
 
-/* Set the security attributes on a newly created file. */
-static int post_create(struct inode *dir,
-                       struct dentry *dentry)
-{
-
-        struct task_security_struct *tsec;
-        struct inode *inode;
-        struct inode_security_struct *dsec;
-        struct superblock_security_struct *sbsec;
-        u32 newsid;
-        char *context;
-        unsigned int len;
-        int rc;
-
-        tsec = current->security;
-        dsec = dir->i_security;
-        sbsec = dir->i_sb->s_security;
-
-        inode = dentry->d_inode;
-        if (!inode) {
-                /* Some file system types (e.g. NFS) may not instantiate
-                   a dentry for all create operations (e.g. symlink),
-                   so we have to check to see if the inode is non-NULL. */
-                printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
-                       "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
-                return 0;
-        }
-
-        if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
-                newsid = tsec->create_sid;
-        } else {
-                rc = security_transition_sid(tsec->sid, dsec->sid,
-                                             inode_mode_to_security_class(inode->i_mode),
-                                             &newsid);
-                if (rc) {
-                        printk(KERN_WARNING "post_create:  "
-                               "security_transition_sid failed, rc=%d (dev=%s "
-                               "ino=%ld)\n",
-                               -rc, inode->i_sb->s_id, inode->i_ino);
-                        return rc;
-                }
-        }
-
-        rc = inode_security_set_sid(inode, newsid);
-        if (rc) {
-                printk(KERN_WARNING "post_create:  inode_security_set_sid "
-                       "failed, rc=%d (dev=%s ino=%ld)\n",
-                       -rc, inode->i_sb->s_id, inode->i_ino);
-                return rc;
-        }
-
-        if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
-            inode->i_op->setxattr) {
-                /* Use extended attributes. */
-                rc = security_sid_to_context(newsid, &context, &len);
-                if (rc) {
-                        printk(KERN_WARNING "post_create:  sid_to_context "
-                               "failed, rc=%d (dev=%s ino=%ld)\n",
-                               -rc, inode->i_sb->s_id, inode->i_ino);
-                        return rc;
-                }
-                down(&inode->i_sem);
-                rc = inode->i_op->setxattr(dentry,
-                                           XATTR_NAME_SELINUX,
-                                           context, len, 0);
-                up(&inode->i_sem);
-                kfree(context);
-                if (rc < 0) {
-                        printk(KERN_WARNING "post_create:  setxattr failed, "
-                               "rc=%d (dev=%s ino=%ld)\n",
-                               -rc, inode->i_sb->s_id, inode->i_ino);
-                        return rc;
-                }
-        }
-
-        return 0;
-}
-
-
 /* Hook functions begin here. */
 
 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
@@ -1673,6 +1594,7 @@ static inline void flush_unauthorized_files(struct files_struct * files)
         struct avc_audit_data ad;
         struct file *file, *devnull = NULL;
         struct tty_struct *tty = current->signal->tty;
+        struct fdtable *fdt;
         long j = -1;
 
         if (tty) {
@@ -1706,9 +1628,10 @@ static inline void flush_unauthorized_files(struct files_struct * files)
 
                 j++;
                 i = j * __NFDBITS;
-                if (i >= files->max_fds || i >= files->max_fdset)
+                fdt = files_fdtable(files);
+                if (i >= fdt->max_fds || i >= fdt->max_fdset)
                         break;
-                set = files->open_fds->fds_bits[j];
+                set = fdt->open_fds->fds_bits[j];
                 if (!set)
                         continue;
                 spin_unlock(&files->file_lock);
@@ -1729,7 +1652,7 @@ static inline void flush_unauthorized_files(struct files_struct * files)
                                                 continue;
                                         }
                                         if (devnull) {
-                                                atomic_inc(&devnull->f_count);
+                                                rcuref_inc(&devnull->f_count);
                                         } else {
                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
                                                 if (!devnull) {
@@ -2018,14 +1941,64 @@ static void selinux_inode_free_security(struct inode *inode)
         inode_free_security(inode);
 }
 
-static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
+static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
+                                       char **name, void **value,
+                                       size_t *len)
 {
-        return may_create(dir, dentry, SECCLASS_FILE);
+        struct task_security_struct *tsec;
+        struct inode_security_struct *dsec;
+        struct superblock_security_struct *sbsec;
+        struct inode_security_struct *isec;
+        u32 newsid, clen;
+        int rc;
+        char *namep = NULL, *context;
+
+        tsec = current->security;
+        dsec = dir->i_security;
+        sbsec = dir->i_sb->s_security;
+        isec = inode->i_security;
+
+        if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
+                newsid = tsec->create_sid;
+        } else {
+                rc = security_transition_sid(tsec->sid, dsec->sid,
+                                             inode_mode_to_security_class(inode->i_mode),
+                                             &newsid);
+                if (rc) {
+                        printk(KERN_WARNING "%s:  "
+                               "security_transition_sid failed, rc=%d (dev=%s "
+                               "ino=%ld)\n",
+                               __FUNCTION__,
+                               -rc, inode->i_sb->s_id, inode->i_ino);
+                        return rc;
+                }
+        }
+
+        inode_security_set_sid(inode, newsid);
+
+        if (name) {
+                namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
+                if (!namep)
+                        return -ENOMEM;
+                *name = namep;
+        }
+
+        if (value && len) {
+                rc = security_sid_to_context(newsid, &context, &clen);
+                if (rc) {
+                        kfree(namep);
+                        return rc;
+                }
+                *value = context;
+                *len = clen;
+        }
+
+        return 0;
 }
 
-static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
+static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
 {
-        post_create(dir, dentry);
+        return may_create(dir, dentry, SECCLASS_FILE);
 }
 
 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
@@ -2038,11 +2011,6 @@ static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, stru
         return may_link(dir, old_dentry, MAY_LINK);
 }
 
-static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
-{
-        return;
-}
-
 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
 {
         int rc;
@@ -2058,21 +2026,11 @@ static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const
         return may_create(dir, dentry, SECCLASS_LNK_FILE);
 }
 
-static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
-{
-        post_create(dir, dentry);
-}
-
 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
 {
         return may_create(dir, dentry, SECCLASS_DIR);
 }
 
-static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
-{
-        post_create(dir, dentry);
-}
-
 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
 {
         return may_link(dir, dentry, MAY_RMDIR);
@@ -2089,23 +2047,12 @@ static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mod
         return may_create(dir, dentry, inode_mode_to_security_class(mode));
 }
 
-static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
-{
-        post_create(dir, dentry);
-}
-
 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
                                 struct inode *new_inode, struct dentry *new_dentry)
 {
         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
 }
 
-static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
-                                      struct inode *new_inode, struct dentry *new_dentry)
-{
-        return;
-}
-
 static int selinux_inode_readlink(struct dentry *dentry)
 {
         return dentry_has_perm(current, NULL, dentry, FILE__READ);
@@ -4298,20 +4245,15 @@ static struct security_operations selinux_ops = {
 
         .inode_alloc_security =         selinux_inode_alloc_security,
         .inode_free_security =          selinux_inode_free_security,
+        .inode_init_security =          selinux_inode_init_security,
         .inode_create =                 selinux_inode_create,
-        .inode_post_create =            selinux_inode_post_create,
         .inode_link =                   selinux_inode_link,
-        .inode_post_link =              selinux_inode_post_link,
         .inode_unlink =                 selinux_inode_unlink,
         .inode_symlink =                selinux_inode_symlink,
-        .inode_post_symlink =           selinux_inode_post_symlink,
         .inode_mkdir =                  selinux_inode_mkdir,
-        .inode_post_mkdir =             selinux_inode_post_mkdir,
         .inode_rmdir =                  selinux_inode_rmdir,
         .inode_mknod =                  selinux_inode_mknod,
-        .inode_post_mknod =             selinux_inode_post_mknod,
         .inode_rename =                 selinux_inode_rename,
-        .inode_post_rename =            selinux_inode_post_rename,
         .inode_readlink =               selinux_inode_readlink,
         .inode_follow_link =            selinux_inode_follow_link,
         .inode_permission =             selinux_inode_permission,