12 files changed, 113 insertions, 78 deletions

diff --git a/security/commoncap.c b/security/commoncap.c
index 384379ede4fd..7520361663e8 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -148,7 +148,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 
         if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
             !cap_issubset (new_permitted, current->cap_permitted)) {
-                current->mm->dumpable = suid_dumpable;
+                set_dumpable(current->mm, suid_dumpable);
 
                 if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                         if (!capable(CAP_SETUID)) {
@@ -315,13 +315,13 @@ int cap_syslog (int type)
         return 0;
 }
 
-int cap_vm_enough_memory(long pages)
+int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int cap_sys_admin = 0;
 
         if (cap_capable(current, CAP_SYS_ADMIN) == 0)
                 cap_sys_admin = 1;
-        return __vm_enough_memory(pages, cap_sys_admin);
+        return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 EXPORT_SYMBOL(cap_capable);
diff --git a/security/dummy.c b/security/dummy.c
index d6a112ce2975..853ec2292798 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -108,13 +108,13 @@ static int dummy_settime(struct timespec *ts, struct timezone *tz)
         return 0;
 }
 
-static int dummy_vm_enough_memory(long pages)
+static int dummy_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int cap_sys_admin = 0;
 
         if (dummy_capable(current, CAP_SYS_ADMIN) == 0)
                 cap_sys_admin = 1;
-        return __vm_enough_memory(pages, cap_sys_admin);
+        return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 static int dummy_bprm_alloc_security (struct linux_binprm *bprm)
@@ -130,7 +130,7 @@ static void dummy_bprm_free_security (struct linux_binprm *bprm)
 static void dummy_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 {
         if (bprm->e_uid != current->uid || bprm->e_gid != current->gid) {
-                current->mm->dumpable = suid_dumpable;
+                set_dumpable(current->mm, suid_dumpable);
 
                 if ((unsafe & ~LSM_UNSAFE_PTRACE_CAP) && !capable(CAP_SETUID)) {
                         bprm->e_uid = current->uid;
diff --git a/security/keys/key.c b/security/keys/key.c
index 700400d801dc..01bbc6d9d19b 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -1001,7 +1001,7 @@ void __init key_init(void)
 {
         /* allocate a slab in which we can store keys */
         key_jar = kmem_cache_create("key_jar", sizeof(struct key),
-                        0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+                        0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
 
         /* add the special key types */
         list_add_tail(&key_type_keyring.link, &key_types_list);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index f573ac189a0a..557500110a13 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -108,7 +108,8 @@ static int call_sbin_request_key(struct key *key,
         argv[i] = NULL;
 
         /* do it */
-        ret = call_usermodehelper_keys(argv[0], argv, envp, keyring, 1);
+        ret = call_usermodehelper_keys(argv[0], argv, envp, keyring,
+                                       UMH_WAIT_PROC);
 
 error_link:
         key_put(keyring);
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 78c408fd2b02..0e69adf63bdb 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -239,7 +239,7 @@ void __init avc_init(void)
         atomic_set(&avc_cache.lru_hint, 0);
 
         avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
-                                             0, SLAB_PANIC, NULL, NULL);
+                                             0, SLAB_PANIC, NULL);
 
         audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
 }
@@ -570,10 +570,12 @@ void avc_audit(u32 ssid, u32 tsid,
                 case AVC_AUDIT_DATA_FS:
                         if (a->u.fs.dentry) {
                                 struct dentry *dentry = a->u.fs.dentry;
-                                if (a->u.fs.mnt)
-                                        audit_avc_path(dentry, a->u.fs.mnt);
-                                audit_log_format(ab, " name=");
-                                audit_log_untrustedstring(ab, dentry->d_name.name);
+                                if (a->u.fs.mnt) {
+                                        audit_log_d_path(ab, "path=", dentry, a->u.fs.mnt);
+                                } else {
+                                        audit_log_format(ab, " name=");
+                                        audit_log_untrustedstring(ab, dentry->d_name.name);
+                                }
                                 inode = dentry->d_inode;
                         } else if (a->u.fs.inode) {
                                 struct dentry *dentry;
@@ -624,9 +626,8 @@ void avc_audit(u32 ssid, u32 tsid,
                                 case AF_UNIX:
                                         u = unix_sk(sk);
                                         if (u->dentry) {
-                                                audit_avc_path(u->dentry, u->mnt);
-                                                audit_log_format(ab, " name=");
-                                                audit_log_untrustedstring(ab, u->dentry->d_name.name);
+                                                audit_log_d_path(ab, "path=",
+                                                                 u->dentry, u->mnt);
                                                 break;
                                         }
                                         if (!u->addr)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 520b9998123e..3c3fff33d1ce 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -47,7 +47,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/tty.h>
 #include <net/icmp.h>
-#include <net/ip.h>             /* for sysctl_local_port_range[] */
+#include <net/ip.h>             /* for local_port_range[] */
 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -316,6 +316,7 @@ static inline int inode_doinit(struct inode *inode)
 }
 
 enum {
+        Opt_error = -1,
         Opt_context = 1,
         Opt_fscontext = 2,
         Opt_defcontext = 4,
@@ -327,6 +328,7 @@ static match_table_t tokens = {
         {Opt_fscontext, "fscontext=%s"},
         {Opt_defcontext, "defcontext=%s"},
         {Opt_rootcontext, "rootcontext=%s"},
+        {Opt_error, NULL},
 };
 
 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
@@ -1584,7 +1586,7 @@ static int selinux_syslog(int type)
  * Do not audit the selinux permission check, as this is applied to all
  * processes that allocate mappings.
  */
-static int selinux_vm_enough_memory(long pages)
+static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int rc, cap_sys_admin = 0;
         struct task_security_struct *tsec = current->security;
@@ -1600,7 +1602,7 @@ static int selinux_vm_enough_memory(long pages)
         if (rc == 0)
                 cap_sys_admin = 1;
 
-        return __vm_enough_memory(pages, cap_sys_admin);
+        return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 /* binprm security operations */
@@ -1907,6 +1909,9 @@ static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
                 spin_unlock_irq(&current->sighand->siglock);
         }
 
+        /* Always clear parent death signal on SID transitions. */
+        current->pdeath_signal = 0;
+
         /* Check whether the new SID can inherit resource limits
            from the old SID.  If not, reset all soft limits to
            the lower of the current task's hard limit and the init
@@ -3129,17 +3134,19 @@ static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
 /**
  * selinux_skb_extlbl_sid - Determine the external label of a packet
  * @skb: the packet
- * @base_sid: the SELinux SID to use as a context for MLS only external labels
  * @sid: the packet's SID
  *
  * Description:
  * Check the various different forms of external packet labeling and determine
- * the external SID for the packet.
+ * the external SID for the packet.  If only one form of external labeling is
+ * present then it is used, if both labeled IPsec and NetLabel labels are
+ * present then the SELinux type information is taken from the labeled IPsec
+ * SA and the MLS sensitivity label information is taken from the NetLabel
+ * security attributes.  This bit of "magic" is done in the call to
+ * selinux_netlbl_skbuff_getsid().
  *
  */
-static void selinux_skb_extlbl_sid(struct sk_buff *skb,
-                                   u32 base_sid,
-                                   u32 *sid)
+static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
 {
         u32 xfrm_sid;
         u32 nlbl_sid;
@@ -3147,10 +3154,9 @@ static void selinux_skb_extlbl_sid(struct sk_buff *skb,
         selinux_skb_xfrm_sid(skb, &xfrm_sid);
         if (selinux_netlbl_skbuff_getsid(skb,
                                          (xfrm_sid == SECSID_NULL ?
-                                          base_sid : xfrm_sid),
+                                          SECINITSID_NETMSG : xfrm_sid),
                                          &nlbl_sid) != 0)
                 nlbl_sid = SECSID_NULL;
-
         *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
 }
 
@@ -3226,8 +3232,6 @@ static int selinux_socket_post_create(struct socket *sock, int family,
 /* Range of port numbers used to automatically bind.
    Need to determine whether we should perform a name_bind
    permission check between the socket and the port number. */
-#define ip_local_port_range_0 sysctl_local_port_range[0]
-#define ip_local_port_range_1 sysctl_local_port_range[1]
 
 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {
@@ -3270,20 +3274,27 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                         addrp = (char *)&addr6->sin6_addr.s6_addr;
                 }
 
-                if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
-                           snum > ip_local_port_range_1)) {
-                        err = security_port_sid(sk->sk_family, sk->sk_type,
-                                                sk->sk_protocol, snum, &sid);
-                        if (err)
-                                goto out;
-                        AVC_AUDIT_DATA_INIT(&ad,NET);
-                        ad.u.net.sport = htons(snum);
-                        ad.u.net.family = family;
-                        err = avc_has_perm(isec->sid, sid,
-                                           isec->sclass,
-                                           SOCKET__NAME_BIND, &ad);
-                        if (err)
-                                goto out;
+                if (snum) {
+                        int low, high;
+
+                        inet_get_local_port_range(&low, &high);
+
+                        if (snum < max(PROT_SOCK, low) || snum > high) {
+                                err = security_port_sid(sk->sk_family,
+                                                        sk->sk_type,
+                                                        sk->sk_protocol, snum,
+                                                        &sid);
+                                if (err)
+                                        goto out;
+                                AVC_AUDIT_DATA_INIT(&ad,NET);
+                                ad.u.net.sport = htons(snum);
+                                ad.u.net.family = family;
+                                err = avc_has_perm(isec->sid, sid,
+                                                   isec->sclass,
+                                                   SOCKET__NAME_BIND, &ad);
+                                if (err)
+                                        goto out;
+                        }
                 }
                 
                 switch(isec->sclass) {
@@ -3695,7 +3706,7 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *
         if (sock && sock->sk->sk_family == PF_UNIX)
                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
         else if (skb)
-                selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
+                selinux_skb_extlbl_sid(skb, &peer_secid);
 
         if (peer_secid == SECSID_NULL)
                 err = -EINVAL;
@@ -3756,7 +3767,7 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         u32 newsid;
         u32 peersid;
 
-        selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
+        selinux_skb_extlbl_sid(skb, &peersid);
         if (peersid == SECSID_NULL) {
                 req->secid = sksec->sid;
                 req->peer_secid = SECSID_NULL;
@@ -3794,7 +3805,7 @@ static void selinux_inet_conn_established(struct sock *sk,
 {
         struct sk_security_struct *sksec = sk->sk_security;
 
-        selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
+        selinux_skb_extlbl_sid(skb, &sksec->peer_sid);
 }
 
 static void selinux_req_classify_flow(const struct request_sock *req,
@@ -4657,8 +4668,7 @@ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
 
 static void selinux_release_secctx(char *secdata, u32 seclen)
 {
-        if (secdata)
-                kfree(secdata);
+        kfree(secdata);
 }
 
 #ifdef CONFIG_KEYS
@@ -4912,7 +4922,7 @@ static __init int selinux_init(void)
 
         sel_inode_cache = kmem_cache_create("selinux_inode_security",
                                             sizeof(struct inode_security_struct),
-                                            0, SLAB_PANIC, NULL, NULL);
+                                            0, SLAB_PANIC, NULL);
         avc_init();
 
         original_ops = secondary_ops = security_ops;
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index b10c34e8a743..e87ab948104c 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -20,6 +20,7 @@
 #include <linux/notifier.h>
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
+#include <net/net_namespace.h>
 
 #include "security.h"
 #include "objsec.h"
@@ -234,6 +235,9 @@ static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
 {
         struct net_device *dev = ptr;
 
+        if (dev->nd_net != &init_net)
+                return NOTIFY_DONE;
+
         if (event == NETDEV_DOWN)
                 sel_netif_kill(dev);
 
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index e64eca246f1a..d243ddc723a5 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -155,13 +155,20 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
         int rc;
         struct netlbl_lsm_secattr secattr;
 
+        if (!netlbl_enabled()) {
+                *sid = SECSID_NULL;
+                return 0;
+        }
+
         netlbl_secattr_init(&secattr);
         rc = netlbl_skbuff_getattr(skb, &secattr);
-        if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
-                rc = security_netlbl_secattr_to_sid(&secattr,
-                                                    base_sid,
-                                                    sid);
-        else
+        if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
+                rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);
+                if (rc == 0 &&
+                    (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
+                    (secattr.flags & NETLBL_SECATTR_CACHE))
+                        netlbl_cache_add(skb, &secattr);
+        } else
                 *sid = SECSID_NULL;
         netlbl_secattr_destroy(&secattr);
 
@@ -198,7 +205,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
         if (netlbl_sock_getattr(sk, &secattr) == 0 &&
             secattr.flags != NETLBL_SECATTR_NONE &&
             security_netlbl_secattr_to_sid(&secattr,
-                                           SECINITSID_UNLABELED,
+                                           SECINITSID_NETMSG,
                                            &nlbl_peer_sid) == 0)
                 sksec->peer_sid = nlbl_peer_sid;
         netlbl_secattr_destroy(&secattr);
@@ -295,38 +302,46 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
                                 struct avc_audit_data *ad)
 {
         int rc;
-        u32 netlbl_sid;
-        u32 recv_perm;
+        u32 nlbl_sid;
+        u32 perm;
+        struct netlbl_lsm_secattr secattr;
 
-        rc = selinux_netlbl_skbuff_getsid(skb,
-                                          SECINITSID_UNLABELED,
-                                          &netlbl_sid);
+        if (!netlbl_enabled())
+                return 0;
+
+        netlbl_secattr_init(&secattr);
+        rc = netlbl_skbuff_getattr(skb, &secattr);
+        if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
+                rc = security_netlbl_secattr_to_sid(&secattr,
+                                                    SECINITSID_NETMSG,
+                                                    &nlbl_sid);
+                if (rc == 0 &&
+                    (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
+                    (secattr.flags & NETLBL_SECATTR_CACHE))
+                        netlbl_cache_add(skb, &secattr);
+        } else
+                nlbl_sid = SECINITSID_UNLABELED;
+        netlbl_secattr_destroy(&secattr);
         if (rc != 0)
                 return rc;
 
-        if (netlbl_sid == SECSID_NULL)
-                return 0;
-
         switch (sksec->sclass) {
         case SECCLASS_UDP_SOCKET:
-                recv_perm = UDP_SOCKET__RECVFROM;
+                perm = UDP_SOCKET__RECVFROM;
                 break;
         case SECCLASS_TCP_SOCKET:
-                recv_perm = TCP_SOCKET__RECVFROM;
+                perm = TCP_SOCKET__RECVFROM;
                 break;
         default:
-                recv_perm = RAWIP_SOCKET__RECVFROM;
+                perm = RAWIP_SOCKET__RECVFROM;
         }
 
-        rc = avc_has_perm(sksec->sid,
-                          netlbl_sid,
-                          sksec->sclass,
-                          recv_perm,
-                          ad);
+        rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
         if (rc == 0)
                 return 0;
 
-        netlbl_skbuff_err(skb, rc);
+        if (nlbl_sid != SECINITSID_UNLABELED)
+                netlbl_skbuff_err(skb, rc);
         return rc;
 }
 
diff --git a/security/selinux/netlink.c b/security/selinux/netlink.c
index f49046de63a2..b59871d74dad 100644
--- a/security/selinux/netlink.c
+++ b/security/selinux/netlink.c
@@ -17,6 +17,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/selinux_netlink.h>
+#include <net/net_namespace.h>
 
 static struct sock *selnl;
 
@@ -104,8 +105,8 @@ void selnl_notify_policyload(u32 seqno)
 
 static int __init selnl_init(void)
 {
-        selnl = netlink_kernel_create(NETLINK_SELINUX, SELNLGRP_MAX, NULL, NULL,
-                                      THIS_MODULE);
+        selnl = netlink_kernel_create(&init_net, NETLINK_SELINUX,
+                                      SELNLGRP_MAX, NULL, NULL, THIS_MODULE);
         if (selnl == NULL)
                 panic("SELinux:  Cannot create netlink socket.");
         netlink_set_nonroot(NETLINK_SELINUX, NL_NONROOT_RECV);  
diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
index 3122908afdc1..85705eb289e0 100644
--- a/security/selinux/ss/avtab.c
+++ b/security/selinux/ss/avtab.c
@@ -445,7 +445,7 @@ void avtab_cache_init(void)
 {
         avtab_node_cachep = kmem_cache_create("avtab_node",
                                               sizeof(struct avtab_node),
-                                              0, SLAB_PANIC, NULL, NULL);
+                                              0, SLAB_PANIC, NULL);
 }
 
 void avtab_cache_destroy(void)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index b5f017f07a75..6100fc023055 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -792,7 +792,7 @@ int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid)
  * @scontext: security context
  * @scontext_len: length in bytes
  * @sid: security identifier, SID
- * @def_sid: default SID to assign on errror
+ * @def_sid: default SID to assign on error
  *
  * Obtains a SID associated with the security context that
  * has the string representation specified by @scontext.
@@ -2127,7 +2127,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr,
         *rule = NULL;
 
         if (!ss_initialized)
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 
         switch (field) {
         case AUDIT_SUBJ_USER:
@@ -2417,8 +2417,10 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
 
         cache->type = NETLBL_CACHE_T_MLS;
         if (ebitmap_cpy(&cache->data.mls_label.level[0].cat,
-                        &ctx->range.level[0].cat) != 0)
+                        &ctx->range.level[0].cat) != 0) {
+                kfree(cache);
                 return;
+        }
         cache->data.mls_label.level[1].cat.highbit =
                 cache->data.mls_label.level[0].cat.highbit;
         cache->data.mls_label.level[1].cat.node =
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index bd8d1ef40a90..ba715f40b658 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -216,7 +216,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
                 return -ENOMEM;
 
         *ctxp = ctx = kmalloc(sizeof(*ctx) +
-                              uctx->ctx_len,
+                              uctx->ctx_len + 1,
                               GFP_KERNEL);
 
         if (!ctx)
@@ -229,6 +229,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
         memcpy(ctx->ctx_str,
                uctx+1,
                ctx->ctx_len);
+        ctx->ctx_str[ctx->ctx_len] = 0;
         rc = security_context_to_sid(ctx->ctx_str,
                                      ctx->ctx_len,
                                      &ctx->ctx_sid);