8 files changed, 33 insertions, 20 deletions

diff --git a/security/Kconfig b/security/Kconfig
index bd72ae623494..e80da955e687 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -39,6 +39,18 @@ config KEYS_DEBUG_PROC_KEYS
 
           If you are unsure as to whether this is required, answer N.
 
+config SECURITY_DMESG_RESTRICT
+        bool "Restrict unprivileged access to the kernel syslog"
+        default n
+        help
+          This enforces restrictions on unprivileged users reading the kernel
+          syslog via dmesg(8).
+
+          If this option is not selected, no restrictions will be enforced
+          unless the dmesg_restrict sysctl is explicitly set to (1).
+
+          If you are unsure how to answer this question, answer N.
+
 config SECURITY
         bool "Enable different security models"
         depends on SYSFS
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index cf1de4462ccd..b7106f192b75 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -922,7 +922,7 @@ static int __init apparmor_init(void)
         error = register_security(&apparmor_ops);
         if (error) {
                 AA_ERROR("Unable to register AppArmor\n");
-                goto register_security_out;
+                goto set_init_cxt_out;
         }
 
         /* Report that AppArmor successfully initialized */
@@ -936,6 +936,9 @@ static int __init apparmor_init(void)
 
         return error;
 
+set_init_cxt_out:
+        aa_free_task_context(current->real_cred->security);
+
 register_security_out:
         aa_free_root_ns();
 
@@ -944,7 +947,6 @@ alloc_out:
 
         apparmor_enabled = 0;
         return error;
-
 }
 
 security_initcall(apparmor_init);
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 52cc865f1464..4f0eadee78b8 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -306,7 +306,7 @@ static struct aa_namespace *alloc_namespace(const char *prefix,
         return ns;
 
 fail_unconfined:
-        kzfree(ns->base.name);
+        kzfree(ns->base.hname);
 fail_ns:
         kzfree(ns);
         return NULL;
diff --git a/security/commoncap.c b/security/commoncap.c
index 5e632b4857e4..04b80f9912bf 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -895,6 +895,8 @@ int cap_syslog(int type, bool from_file)
 {
         if (type != SYSLOG_ACTION_OPEN && from_file)
                 return 0;
+        if (dmesg_restrict && !capable(CAP_SYS_ADMIN))
+                return -EPERM;
         if ((type != SYSLOG_ACTION_READ_ALL &&
              type != SYSLOG_ACTION_SIZE_BUFFER) && !capable(CAP_SYS_ADMIN))
                 return -EPERM;
diff --git a/security/inode.c b/security/inode.c
index cb8f47c66a58..c4df2fbebe6b 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -131,17 +131,17 @@ static int fill_super(struct super_block *sb, void *data, int silent)
         return simple_fill_super(sb, SECURITYFS_MAGIC, files);
 }
 
-static int get_sb(struct file_system_type *fs_type,
+static struct dentry *get_sb(struct file_system_type *fs_type,
                   int flags, const char *dev_name,
-                  void *data, struct vfsmount *mnt)
+                  void *data)
 {
-        return get_sb_single(fs_type, flags, data, fill_super, mnt);
+        return mount_single(fs_type, flags, data, fill_super);
 }
 
 static struct file_system_type fs_type = {
         .owner =        THIS_MODULE,
         .name =         "securityfs",
-        .get_sb =       get_sb,
+        .mount =        get_sb,
         .kill_sb =      kill_litter_super,
 };
 
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index f8e7251ae2c8..504bdd2452bd 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -207,7 +207,7 @@ static int install_process_keyring(void)
         ret = install_process_keyring_to_cred(new);
         if (ret < 0) {
                 abort_creds(new);
-                return ret != -EEXIST ?: 0;
+                return ret != -EEXIST ? ret : 0;
         }
 
         return commit_creds(new);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 55a755c1a1bd..073fd5b0a53a 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -1909,16 +1909,15 @@ err:
         goto out;
 }
 
-static int sel_get_sb(struct file_system_type *fs_type,
-                      int flags, const char *dev_name, void *data,
-                      struct vfsmount *mnt)
+static struct dentry *sel_mount(struct file_system_type *fs_type,
+                      int flags, const char *dev_name, void *data)
 {
-        return get_sb_single(fs_type, flags, data, sel_fill_super, mnt);
+        return mount_single(fs_type, flags, data, sel_fill_super);
 }
 
 static struct file_system_type sel_fs_type = {
         .name           = "selinuxfs",
-        .get_sb         = sel_get_sb,
+        .mount          = sel_mount,
         .kill_sb        = kill_litter_super,
 };
 
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 7512502d0162..dc1fd6239f24 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -1310,27 +1310,25 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent)
 }
 
 /**
- * smk_get_sb - get the smackfs superblock
+ * smk_mount - get the smackfs superblock
  * @fs_type: passed along without comment
  * @flags: passed along without comment
  * @dev_name: passed along without comment
  * @data: passed along without comment
- * @mnt: passed along without comment
  *
  * Just passes everything along.
  *
  * Returns what the lower level code does.
  */
-static int smk_get_sb(struct file_system_type *fs_type,
-                      int flags, const char *dev_name, void *data,
-                      struct vfsmount *mnt)
+static struct dentry *smk_mount(struct file_system_type *fs_type,
+                      int flags, const char *dev_name, void *data)
 {
-        return get_sb_single(fs_type, flags, data, smk_fill_super, mnt);
+        return mount_single(fs_type, flags, data, smk_fill_super);
 }
 
 static struct file_system_type smk_fs_type = {
         .name           = "smackfs",
-        .get_sb         = smk_get_sb,
+        .mount          = smk_mount,
         .kill_sb        = kill_litter_super,
 };