26 files changed, 1971 insertions, 1487 deletions
diff --git a/security/capability.c b/security/capability.c
index 245874819036..b9e391425e6f 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -32,24 +32,19 @@ static int cap_quota_on(struct dentry *dentry)
        return 0;
 }
-static int cap_bprm_alloc_security(struct linux_binprm *bprm)
+static int cap_bprm_check_security (struct linux_binprm *bprm)
 {
        return 0;
 }
-static void cap_bprm_free_security(struct linux_binprm *bprm)
+static void cap_bprm_committing_creds(struct linux_binprm *bprm)
 {
 }
-static void cap_bprm_post_apply_creds(struct linux_binprm *bprm)
+static void cap_bprm_committed_creds(struct linux_binprm *bprm)
 {
 }
-static int cap_bprm_check_security(struct linux_binprm *bprm)
-{
-        return 0;
-}
 static int cap_sb_alloc_security(struct super_block *sb)
 {
        return 0;
@@ -330,7 +325,7 @@ static int cap_file_receive(struct file *file)
        return 0;
 }
-static int cap_dentry_open(struct file *file)
+static int cap_dentry_open(struct file *file, const struct cred *cred)
 {
        return 0;
 }
@@ -340,15 +335,29 @@ static int cap_task_create(unsigned long clone_flags)
        return 0;
 }
-static int cap_task_alloc_security(struct task_struct *p)
+static void cap_cred_free(struct cred *cred)
+{
+}
+static int cap_cred_prepare(struct cred *new, const struct cred *old, gfp_t gfp)
 {
        return 0;
 }
-static void cap_task_free_security(struct task_struct *p)
+static void cap_cred_commit(struct cred *new, const struct cred *old)
 {
 }
+static int cap_kernel_act_as(struct cred *new, u32 secid)
+{
+        return 0;
+}
+static int cap_kernel_create_files_as(struct cred *new, struct inode *inode)
+{
+        return 0;
+}
 static int cap_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
 {
        return 0;
@@ -750,7 +759,7 @@ static void cap_release_secctx(char *secdata, u32 seclen)
 }
 #ifdef CONFIG_KEYS
-static int cap_key_alloc(struct key *key, struct task_struct *ctx,
+static int cap_key_alloc(struct key *key, const struct cred *cred,
                         unsigned long flags)
 {
        return 0;
@@ -760,7 +769,7 @@ static void cap_key_free(struct key *key)
 {
 }
-static int cap_key_permission(key_ref_t key_ref, struct task_struct *context,
+static int cap_key_permission(key_ref_t key_ref, const struct cred *cred,
                              key_perm_t perm)
 {
        return 0;
@@ -814,8 +823,7 @@ void security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, ptrace_may_access);
        set_to_cap_if_null(ops, ptrace_traceme);
        set_to_cap_if_null(ops, capget);
-        set_to_cap_if_null(ops, capset_check);
+        set_to_cap_if_null(ops, capset);
-        set_to_cap_if_null(ops, capset_set);
        set_to_cap_if_null(ops, acct);
        set_to_cap_if_null(ops, capable);
        set_to_cap_if_null(ops, quotactl);
@@ -824,11 +832,9 @@ void security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, syslog);
        set_to_cap_if_null(ops, settime);
        set_to_cap_if_null(ops, vm_enough_memory);
-        set_to_cap_if_null(ops, bprm_alloc_security);
+        set_to_cap_if_null(ops, bprm_set_creds);
-        set_to_cap_if_null(ops, bprm_free_security);
+        set_to_cap_if_null(ops, bprm_committing_creds);
-        set_to_cap_if_null(ops, bprm_apply_creds);
+        set_to_cap_if_null(ops, bprm_committed_creds);
-        set_to_cap_if_null(ops, bprm_post_apply_creds);
-        set_to_cap_if_null(ops, bprm_set_security);
        set_to_cap_if_null(ops, bprm_check_security);
        set_to_cap_if_null(ops, bprm_secureexec);
        set_to_cap_if_null(ops, sb_alloc_security);
@@ -890,10 +896,13 @@ void security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, file_receive);
        set_to_cap_if_null(ops, dentry_open);
        set_to_cap_if_null(ops, task_create);
-        set_to_cap_if_null(ops, task_alloc_security);
+        set_to_cap_if_null(ops, cred_free);
-        set_to_cap_if_null(ops, task_free_security);
+        set_to_cap_if_null(ops, cred_prepare);
+        set_to_cap_if_null(ops, cred_commit);
+        set_to_cap_if_null(ops, kernel_act_as);
+        set_to_cap_if_null(ops, kernel_create_files_as);
        set_to_cap_if_null(ops, task_setuid);
-        set_to_cap_if_null(ops, task_post_setuid);
+        set_to_cap_if_null(ops, task_fix_setuid);
        set_to_cap_if_null(ops, task_setgid);
        set_to_cap_if_null(ops, task_setpgid);
        set_to_cap_if_null(ops, task_getpgid);
@@ -910,7 +919,6 @@ void security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, task_wait);
        set_to_cap_if_null(ops, task_kill);
        set_to_cap_if_null(ops, task_prctl);
-        set_to_cap_if_null(ops, task_reparent_to_init);
        set_to_cap_if_null(ops, task_to_inode);
        set_to_cap_if_null(ops, ipc_permission);
        set_to_cap_if_null(ops, ipc_getsecid);
diff --git a/security/commoncap.c b/security/commoncap.c
index 3976613db829..19cb398431ee 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -8,6 +8,7 @@
 */
 #include <linux/capability.h>
+#include <linux/audit.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -29,7 +30,7 @@
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
-        NETLINK_CB(skb).eff_cap = current->cap_effective;
+        NETLINK_CB(skb).eff_cap = current_cap();
        return 0;
 }
@@ -39,23 +40,41 @@ int cap_netlink_recv(struct sk_buff *skb, int cap)
                return -EPERM;
        return 0;
 }
 EXPORT_SYMBOL(cap_netlink_recv);
-/*
+/**
+ * cap_capable - Determine whether a task has a particular effective capability
+ * @tsk: The task to query
+ * @cap: The capability to check for
+ * @audit: Whether to write an audit message or not
+ *
+ * Determine whether the nominated task has the specified capability amongst
+ * its effective set, returning 0 if it does, -ve if it does not.
+ *
 * NOTE WELL: cap_capable() cannot be used like the kernel's capable()
- * function.  That is, it has the reverse semantics: cap_capable()
+ * function.  That is, it has the reverse semantics: cap_capable() returns 0
- * returns 0 when a task has a capability, but the kernel's capable()
+ * when a task has a capability, but the kernel's capable() returns 1 for this
- * returns 1 for this case.
+ * case.
 */
-int cap_capable (struct task_struct *tsk, int cap)
+int cap_capable(struct task_struct *tsk, int cap, int audit)
 {
+        __u32 cap_raised;
        /* Derived from include/linux/sched.h:capable. */
-        if (cap_raised(tsk->cap_effective, cap))
+        rcu_read_lock();
-                return 0;
+        cap_raised = cap_raised(__task_cred(tsk)->cap_effective, cap);
-        return -EPERM;
+        rcu_read_unlock();
+        return cap_raised ? 0 : -EPERM;
 }
+/**
+ * cap_settime - Determine whether the current process may set the system clock
+ * @ts: The time to set
+ * @tz: The timezone to set
+ *
+ * Determine whether the current process may set the system clock and timezone
+ * information, returning 0 if permission granted, -ve if denied.
+ */
 int cap_settime(struct timespec *ts, struct timezone *tz)
 {
        if (!capable(CAP_SYS_TIME))
@@ -63,121 +82,157 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
        return 0;
 }
+/**
+ * cap_ptrace_may_access - Determine whether the current process may access
+ *                         another
+ * @child: The process to be accessed
+ * @mode: The mode of attachment.
+ *
+ * Determine whether a process may access another, returning 0 if permission
+ * granted, -ve if denied.
+ */
 int cap_ptrace_may_access(struct task_struct *child, unsigned int mode)
 {
-        /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
+        int ret = 0;
-        if (cap_issubset(child->cap_permitted, current->cap_permitted))
-                return 0;
+        rcu_read_lock();
-        if (capable(CAP_SYS_PTRACE))
+        if (!cap_issubset(__task_cred(child)->cap_permitted,
-                return 0;
+                          current_cred()->cap_permitted) &&
-        return -EPERM;
+            !capable(CAP_SYS_PTRACE))
+                ret = -EPERM;
+        rcu_read_unlock();
+        return ret;
 }
+/**
+ * cap_ptrace_traceme - Determine whether another process may trace the current
+ * @parent: The task proposed to be the tracer
+ *
+ * Determine whether the nominated task is permitted to trace the current
+ * process, returning 0 if permission is granted, -ve if denied.
+ */
 int cap_ptrace_traceme(struct task_struct *parent)
 {
-        /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
+        int ret = 0;
-        if (cap_issubset(current->cap_permitted, parent->cap_permitted))
-                return 0;
+        rcu_read_lock();
-        if (has_capability(parent, CAP_SYS_PTRACE))
+        if (!cap_issubset(current_cred()->cap_permitted,
-                return 0;
+                          __task_cred(parent)->cap_permitted) &&
-        return -EPERM;
+            !has_capability(parent, CAP_SYS_PTRACE))
+                ret = -EPERM;
+        rcu_read_unlock();
+        return ret;
 }
-int cap_capget (struct task_struct *target, kernel_cap_t *effective,
+/**
-                kernel_cap_t *inheritable, kernel_cap_t *permitted)
+ * cap_capget - Retrieve a task's capability sets
+ * @target: The task from which to retrieve the capability sets
+ * @effective: The place to record the effective set
+ * @inheritable: The place to record the inheritable set
+ * @permitted: The place to record the permitted set
+ *
+ * This function retrieves the capabilities of the nominated task and returns
+ * them to the caller.
+ */
+int cap_capget(struct task_struct *target, kernel_cap_t *effective,
+               kernel_cap_t *inheritable, kernel_cap_t *permitted)
 {
+        const struct cred *cred;
        /* Derived from kernel/capability.c:sys_capget. */
-        *effective = target->cap_effective;
+        rcu_read_lock();
-        *inheritable = target->cap_inheritable;
+        cred = __task_cred(target);
-        *permitted = target->cap_permitted;
+        *effective   = cred->cap_effective;
+        *inheritable = cred->cap_inheritable;
+        *permitted   = cred->cap_permitted;
+        rcu_read_unlock();
        return 0;
 }
-#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+/*
+ * Determine whether the inheritable capabilities are limited to the old
-static inline int cap_block_setpcap(struct task_struct *target)
+ * permitted set.  Returns 1 if they are limited, 0 if they are not.
-{
+ */
-        /*
-         * No support for remote process capability manipulation with
-         * filesystem capability support.
-         */
-        return (target != current);
-}
 static inline int cap_inh_is_capped(void)
 {
-        /*
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
-         * Return 1 if changes to the inheritable set are limited
-         * to the old permitted set. That is, if the current task
-         * does *not* possess the CAP_SETPCAP capability.
-         */
-        return (cap_capable(current, CAP_SETPCAP) != 0);
-}
-static inline int cap_limit_ptraced_target(void) { return 1; }
-#else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
-static inline int cap_block_setpcap(struct task_struct *t) { return 0; }
+        /* they are so limited unless the current task has the CAP_SETPCAP
-static inline int cap_inh_is_capped(void) { return 1; }
+         * capability
-static inline int cap_limit_ptraced_target(void)
+         */
-{
+        if (cap_capable(current, CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
-        return !capable(CAP_SETPCAP);
+                return 0;
+#endif
+        return 1;
 }
-#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
+/**
+ * cap_capset - Validate and apply proposed changes to current's capabilities
-int cap_capset_check (struct task_struct *target, kernel_cap_t *effective,
+ * @new: The proposed new credentials; alterations should be made here
-                      kernel_cap_t *inheritable, kernel_cap_t *permitted)
+ * @old: The current task's current credentials
-{
+ * @effective: A pointer to the proposed new effective capabilities set
-        if (cap_block_setpcap(target)) {
+ * @inheritable: A pointer to the proposed new inheritable capabilities set
-                return -EPERM;
+ * @permitted: A pointer to the proposed new permitted capabilities set
-        }
+ *
-        if (cap_inh_is_capped()
+ * This function validates and applies a proposed mass change to the current
-            && !cap_issubset(*inheritable,
+ * process's capability sets.  The changes are made to the proposed new
-                             cap_combine(target->cap_inheritable,
+ * credentials, and assuming no error, will be committed by the caller of LSM.
-                                         current->cap_permitted))) {
+ */
+int cap_capset(struct cred *new,
+               const struct cred *old,
+               const kernel_cap_t *effective,
+               const kernel_cap_t *inheritable,
+               const kernel_cap_t *permitted)
+{
+        if (cap_inh_is_capped() &&
+            !cap_issubset(*inheritable,
+                          cap_combine(old->cap_inheritable,
+                                      old->cap_permitted)))
                /* incapable of using this inheritable set */
                return -EPERM;
-        }
        if (!cap_issubset(*inheritable,
-                           cap_combine(target->cap_inheritable,
+                          cap_combine(old->cap_inheritable,
-                                       current->cap_bset))) {
+                                      old->cap_bset)))
                /* no new pI capabilities outside bounding set */
                return -EPERM;
-        }
        /* verify restrictions on target's new Permitted set */
-        if (!cap_issubset (*permitted,
+        if (!cap_issubset(*permitted, old->cap_permitted))
-                           cap_combine (target->cap_permitted,
-                                        current->cap_permitted))) {
                return -EPERM;
-        }
        /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
-        if (!cap_issubset (*effective, *permitted)) {
+        if (!cap_issubset(*effective, *permitted))
                return -EPERM;
-        }
+        new->cap_effective   = *effective;
+        new->cap_inheritable = *inheritable;
+        new->cap_permitted   = *permitted;
        return 0;
 }
-void cap_capset_set (struct task_struct *target, kernel_cap_t *effective,
+/*
-                     kernel_cap_t *inheritable, kernel_cap_t *permitted)
+ * Clear proposed capability sets for execve().
-{
+ */
-        target->cap_effective = *effective;
-        target->cap_inheritable = *inheritable;
-        target->cap_permitted = *permitted;
-}
 static inline void bprm_clear_caps(struct linux_binprm *bprm)
 {
-        cap_clear(bprm->cap_post_exec_permitted);
+        cap_clear(bprm->cred->cap_permitted);
        bprm->cap_effective = false;
 }
 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+/**
+ * cap_inode_need_killpriv - Determine if inode change affects privileges
+ * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
+ *
+ * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
+ * affects the security markings on that inode, and if it is, should
+ * inode_killpriv() be invoked or the change rejected?
+ *
+ * Returns 0 if granted; +ve if granted, but inode_killpriv() is required; and
+ * -ve to deny the change.
+ */
 int cap_inode_need_killpriv(struct dentry *dentry)
 {
        struct inode *inode = dentry->d_inode;
@@ -192,6 +247,14 @@ int cap_inode_need_killpriv(struct dentry *dentry)
        return 1;
 }
+/**
+ * cap_inode_killpriv - Erase the security markings on an inode
+ * @dentry: The inode/dentry to alter
+ *
+ * Erase the privilege-enhancing security markings on an inode.
+ *
+ * Returns 0 if successful, -ve on error.
+ */
 int cap_inode_killpriv(struct dentry *dentry)
 {
        struct inode *inode = dentry->d_inode;
@@ -202,19 +265,75 @@ int cap_inode_killpriv(struct dentry *dentry)
        return inode->i_op->removexattr(dentry, XATTR_NAME_CAPS);
 }
-static inline int cap_from_disk(struct vfs_cap_data *caps,
+/*
-                                struct linux_binprm *bprm, unsigned size)
+ * Calculate the new process capability sets from the capability sets attached
+ * to a file.
+ */
+static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
+                                          struct linux_binprm *bprm,
+                                          bool *effective)
 {
+        struct cred *new = bprm->cred;
+        unsigned i;
+        int ret = 0;
+        if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
+                *effective = true;
+        CAP_FOR_EACH_U32(i) {
+                __u32 permitted = caps->permitted.cap[i];
+                __u32 inheritable = caps->inheritable.cap[i];
+                /*
+                 * pP' = (X & fP) | (pI & fI)
+                 */
+                new->cap_permitted.cap[i] =
+                        (new->cap_bset.cap[i] & permitted) |
+                        (new->cap_inheritable.cap[i] & inheritable);
+                if (permitted & ~new->cap_permitted.cap[i])
+                        /* insufficient to execute correctly */
+                        ret = -EPERM;
+        }
+        /*
+         * For legacy apps, with no internal support for recognizing they
+         * do not have enough capabilities, we return an error if they are
+         * missing some "forced" (aka file-permitted) capabilities.
+         */
+        return *effective ? ret : 0;
+}
+/*
+ * Extract the on-exec-apply capability sets for an executable file.
+ */
+int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
+{
+        struct inode *inode = dentry->d_inode;
        __u32 magic_etc;
        unsigned tocopy, i;
-        int ret;
+        int size;
+        struct vfs_cap_data caps;
+        memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
+        if (!inode || !inode->i_op || !inode->i_op->getxattr)
+                return -ENODATA;
+        size = inode->i_op->getxattr((struct dentry *)dentry, XATTR_NAME_CAPS, &caps,
+                                   XATTR_CAPS_SZ);
+        if (size == -ENODATA || size == -EOPNOTSUPP)
+                /* no data, that's ok */
+                return -ENODATA;
+        if (size < 0)
+                return size;
        if (size < sizeof(magic_etc))
                return -EINVAL;
-        magic_etc = le32_to_cpu(caps->magic_etc);
+        cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps.magic_etc);
-        switch ((magic_etc & VFS_CAP_REVISION_MASK)) {
+        switch (magic_etc & VFS_CAP_REVISION_MASK) {
        case VFS_CAP_REVISION_1:
                if (size != XATTR_CAPS_SZ_1)
                        return -EINVAL;
@@ -229,77 +348,48 @@ static inline int cap_from_disk(struct vfs_cap_data *caps,
                return -EINVAL;
        }
-        if (magic_etc & VFS_CAP_FLAGS_EFFECTIVE) {
-                bprm->cap_effective = true;
-        } else {
-                bprm->cap_effective = false;
-        }
-        ret = 0;
        CAP_FOR_EACH_U32(i) {
-                __u32 value_cpu;
+                if (i >= tocopy)
+                        break;
-                if (i >= tocopy) {
+                cpu_caps->permitted.cap[i] = le32_to_cpu(caps.data[i].permitted);
-                        /*
+                cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
-                         * Legacy capability sets have no upper bits
-                         */
-                        bprm->cap_post_exec_permitted.cap[i] = 0;
-                        continue;
-                }
-                /*
-                 * pP' = (X & fP) | (pI & fI)
-                 */
-                value_cpu = le32_to_cpu(caps->data[i].permitted);
-                bprm->cap_post_exec_permitted.cap[i] =
-                        (current->cap_bset.cap[i] & value_cpu) |
-                        (current->cap_inheritable.cap[i] &
-                                le32_to_cpu(caps->data[i].inheritable));
-                if (value_cpu & ~bprm->cap_post_exec_permitted.cap[i]) {
-                        /*
-                         * insufficient to execute correctly
-                         */
-                        ret = -EPERM;
-                }
        }
-        /*
+        return 0;
-         * For legacy apps, with no internal support for recognizing they
-         * do not have enough capabilities, we return an error if they are
-         * missing some "forced" (aka file-permitted) capabilities.
-         */
-        return bprm->cap_effective ? ret : 0;
 }
-/* Locate any VFS capabilities: */
+/*
-static int get_file_caps(struct linux_binprm *bprm)
+ * Attempt to get the on-exec apply capability sets for an executable file from
+ * its xattrs and, if present, apply them to the proposed credentials being
+ * constructed by execve().
+ */
+static int get_file_caps(struct linux_binprm *bprm, bool *effective)
 {
        struct dentry *dentry;
        int rc = 0;
-        struct vfs_cap_data vcaps;
+        struct cpu_vfs_cap_data vcaps;
-        struct inode *inode;
        bprm_clear_caps(bprm);
+        if (!file_caps_enabled)
+                return 0;
        if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
                return 0;
        dentry = dget(bprm->file->f_dentry);
-        inode = dentry->d_inode;
-        if (!inode->i_op || !inode->i_op->getxattr)
-                goto out;
-        rc = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, &vcaps,
+        rc = get_vfs_caps_from_disk(dentry, &vcaps);
-                                   XATTR_CAPS_SZ);
+        if (rc < 0) {
-        if (rc == -ENODATA || rc == -EOPNOTSUPP) {
+                if (rc == -EINVAL)
-                /* no data, that's ok */
+                        printk(KERN_NOTICE "%s: get_vfs_caps_from_disk returned %d for %s\n",
-                rc = 0;
+                                __func__, rc, bprm->filename);
+                else if (rc == -ENODATA)
+                        rc = 0;
                goto out;
        }
-        if (rc < 0)
-                goto out;
-        rc = cap_from_disk(&vcaps, bprm, rc);
+        rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective);
        if (rc == -EINVAL)
                printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
                       __func__, rc, bprm->filename);
@@ -323,18 +413,51 @@ int cap_inode_killpriv(struct dentry *dentry)
        return 0;
 }
-static inline int get_file_caps(struct linux_binprm *bprm)
+static inline int get_file_caps(struct linux_binprm *bprm, bool *effective)
 {
        bprm_clear_caps(bprm);
        return 0;
 }
 #endif
-int cap_bprm_set_security (struct linux_binprm *bprm)
+/*
+ * Determine whether a exec'ing process's new permitted capabilities should be
+ * limited to just what it already has.
+ *
+ * This prevents processes that are being ptraced from gaining access to
+ * CAP_SETPCAP, unless the process they're tracing already has it, and the
+ * binary they're executing has filecaps that elevate it.
+ *
+ *  Returns 1 if they should be limited, 0 if they are not.
+ */
+static inline int cap_limit_ptraced_target(void)
 {
+#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
+        if (capable(CAP_SETPCAP))
+                return 0;
+#endif
+        return 1;
+}
+/**
+ * cap_bprm_set_creds - Set up the proposed credentials for execve().
+ * @bprm: The execution parameters, including the proposed creds
+ *
+ * Set up the proposed credentials for a new execution context being
+ * constructed by execve().  The proposed creds in @bprm->cred is altered,
+ * which won't take effect immediately.  Returns 0 if successful, -ve on error.
+ */
+int cap_bprm_set_creds(struct linux_binprm *bprm)
+{
+        const struct cred *old = current_cred();
+        struct cred *new = bprm->cred;
+        bool effective;
        int ret;
-        ret = get_file_caps(bprm);
+        effective = false;
+        ret = get_file_caps(bprm, &effective);
+        if (ret < 0)
+                return ret;
        if (!issecure(SECURE_NOROOT)) {
                /*
@@ -342,75 +465,113 @@ int cap_bprm_set_security (struct linux_binprm *bprm)
                 * executables under compatibility mode, we override the
                 * capability sets for the file.
                 *
-                 * If only the real uid is 0, we do not set the effective
+                 * If only the real uid is 0, we do not set the effective bit.
-                 * bit.
                 */
-                if (bprm->e_uid == 0 || current->uid == 0) {
+                if (new->euid == 0 || new->uid == 0) {
                        /* pP' = (cap_bset & ~0) | (pI & ~0) */
-                        bprm->cap_post_exec_permitted = cap_combine(
+                        new->cap_permitted = cap_combine(old->cap_bset,
-                                current->cap_bset, current->cap_inheritable
+                                                         old->cap_inheritable);
-                                );
-                        bprm->cap_effective = (bprm->e_uid == 0);
-                        ret = 0;
                }
+                if (new->euid == 0)
+                        effective = true;
        }
-        return ret;
+        /* Don't let someone trace a set[ug]id/setpcap binary with the revised
-}
+         * credentials unless they have the appropriate permit
+         */
-void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
+        if ((new->euid != old->uid ||
-{
+             new->egid != old->gid ||
-        if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
+             !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
-            !cap_issubset(bprm->cap_post_exec_permitted,
+            bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
-                          current->cap_permitted)) {
+                /* downgrade; they get no more than they had, and maybe less */
-                set_dumpable(current->mm, suid_dumpable);
+                if (!capable(CAP_SETUID)) {
-                current->pdeath_signal = 0;
+                        new->euid = new->uid;
+                        new->egid = new->gid;
-                if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
-                        if (!capable(CAP_SETUID)) {
-                                bprm->e_uid = current->uid;
-                                bprm->e_gid = current->gid;
-                        }
-                        if (cap_limit_ptraced_target()) {
-                                bprm->cap_post_exec_permitted = cap_intersect(
-                                        bprm->cap_post_exec_permitted,
-                                        current->cap_permitted);
-                        }
                }
+                if (cap_limit_ptraced_target())
+                        new->cap_permitted = cap_intersect(new->cap_permitted,
+                                                           old->cap_permitted);
        }
-        current->suid = current->euid = current->fsuid = bprm->e_uid;
+        new->suid = new->fsuid = new->euid;
-        current->sgid = current->egid = current->fsgid = bprm->e_gid;
+        new->sgid = new->fsgid = new->egid;
-        /* For init, we want to retain the capabilities set
+        /* For init, we want to retain the capabilities set in the initial
-         * in the init_task struct. Thus we skip the usual
+         * task.  Thus we skip the usual capability rules
-         * capability rules */
+         */
        if (!is_global_init(current)) {
-                current->cap_permitted = bprm->cap_post_exec_permitted;
+                if (effective)
-                if (bprm->cap_effective)
+                        new->cap_effective = new->cap_permitted;
-                        current->cap_effective = bprm->cap_post_exec_permitted;
                else
-                        cap_clear(current->cap_effective);
+                        cap_clear(new->cap_effective);
        }
+        bprm->cap_effective = effective;
-        /* AUD: Audit candidate if current->cap_effective is set */
+        /*
+         * Audit candidate if current->cap_effective is set
+         *
+         * We do not bother to audit if 3 things are true:
+         *   1) cap_effective has all caps
+         *   2) we are root
+         *   3) root is supposed to have all caps (SECURE_NOROOT)
+         * Since this is just a normal root execing a process.
+         *
+         * Number 1 above might fail if you don't have a full bset, but I think
+         * that is interesting information to audit.
+         */
+        if (!cap_isclear(new->cap_effective)) {
+                if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
+                    new->euid != 0 || new->uid != 0 ||
+                    issecure(SECURE_NOROOT)) {
+                        ret = audit_log_bprm_fcaps(bprm, new, old);
+                        if (ret < 0)
+                                return ret;
+                }
+        }
-        current->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
+        new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
+        return 0;
 }
-int cap_bprm_secureexec (struct linux_binprm *bprm)
+/**
+ * cap_bprm_secureexec - Determine whether a secure execution is required
+ * @bprm: The execution parameters
+ *
+ * Determine whether a secure execution is required, return 1 if it is, and 0
+ * if it is not.
+ *
+ * The credentials have been committed by this point, and so are no longer
+ * available through @bprm->cred.
+ */
+int cap_bprm_secureexec(struct linux_binprm *bprm)
 {
-        if (current->uid != 0) {
+        const struct cred *cred = current_cred();
+        if (cred->uid != 0) {
                if (bprm->cap_effective)
                        return 1;
-                if (!cap_isclear(bprm->cap_post_exec_permitted))
+                if (!cap_isclear(cred->cap_permitted))
                        return 1;
        }
-        return (current->euid != current->uid ||
+        return (cred->euid != cred->uid ||
-                current->egid != current->gid);
+                cred->egid != cred->gid);
 }
+/**
+ * cap_inode_setxattr - Determine whether an xattr may be altered
+ * @dentry: The inode/dentry being altered
+ * @name: The name of the xattr to be changed
+ * @value: The value that the xattr will be changed to
+ * @size: The size of value
+ * @flags: The replacement flag
+ *
+ * Determine whether an xattr may be altered or set on an inode, returning 0 if
+ * permission is granted, -ve if denied.
+ *
+ * This is used to make sure security xattrs don't get updated or set by those
+ * who aren't privileged to do so.
+ */
 int cap_inode_setxattr(struct dentry *dentry, const char *name,
                       const void *value, size_t size, int flags)
 {
@@ -418,28 +579,42 @@ int cap_inode_setxattr(struct dentry *dentry, const char *name,
                if (!capable(CAP_SETFCAP))
                        return -EPERM;
                return 0;
-        } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
+        }
+        if (!strncmp(name, XATTR_SECURITY_PREFIX,
                     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
            !capable(CAP_SYS_ADMIN))
                return -EPERM;
        return 0;
 }
+/**
+ * cap_inode_removexattr - Determine whether an xattr may be removed
+ * @dentry: The inode/dentry being altered
+ * @name: The name of the xattr to be changed
+ *
+ * Determine whether an xattr may be removed from an inode, returning 0 if
+ * permission is granted, -ve if denied.
+ *
+ * This is used to make sure security xattrs don't get removed by those who
+ * aren't privileged to remove them.
+ */
 int cap_inode_removexattr(struct dentry *dentry, const char *name)
 {
        if (!strcmp(name, XATTR_NAME_CAPS)) {
                if (!capable(CAP_SETFCAP))
                        return -EPERM;
                return 0;
-        } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
+        }
+        if (!strncmp(name, XATTR_SECURITY_PREFIX,
                     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
            !capable(CAP_SYS_ADMIN))
                return -EPERM;
        return 0;
 }
-/* moved from kernel/sys.c. */
+/*
-/* 
 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
 * a process after a call to setuid, setreuid, or setresuid.
 *
@@ -453,10 +628,10 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
 *  3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
 *  capabilities are set to the permitted capabilities.
 *
- *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should 
+ *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
 *  never happen.
 *
- *  -astor 
+ *  -astor
 *
 * cevans - New behaviour, Oct '99
 * A process may, via prctl(), elect to keep its capabilities when it
@@ -468,61 +643,60 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
 * files..
 * Thanks to Olaf Kirch and Peter Benie for spotting this.
 */
-static inline void cap_emulate_setxuid (int old_ruid, int old_euid,
+static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
-                                        int old_suid)
 {
-        if ((old_ruid == 0 || old_euid == 0 || old_suid == 0) &&
+        if ((old->uid == 0 || old->euid == 0 || old->suid == 0) &&
-            (current->uid != 0 && current->euid != 0 && current->suid != 0) &&
+            (new->uid != 0 && new->euid != 0 && new->suid != 0) &&
            !issecure(SECURE_KEEP_CAPS)) {
-                cap_clear (current->cap_permitted);
+                cap_clear(new->cap_permitted);
-                cap_clear (current->cap_effective);
+                cap_clear(new->cap_effective);
-        }
-        if (old_euid == 0 && current->euid != 0) {
-                cap_clear (current->cap_effective);
-        }
-        if (old_euid != 0 && current->euid == 0) {
-                current->cap_effective = current->cap_permitted;
        }
+        if (old->euid == 0 && new->euid != 0)
+                cap_clear(new->cap_effective);
+        if (old->euid != 0 && new->euid == 0)
+                new->cap_effective = new->cap_permitted;
 }
-int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
+/**
-                          int flags)
+ * cap_task_fix_setuid - Fix up the results of setuid() call
+ * @new: The proposed credentials
+ * @old: The current task's current credentials
+ * @flags: Indications of what has changed
+ *
+ * Fix up the results of setuid() call before the credential changes are
+ * actually applied, returning 0 to grant the changes, -ve to deny them.
+ */
+int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
 {
        switch (flags) {
        case LSM_SETID_RE:
        case LSM_SETID_ID:
        case LSM_SETID_RES:
-                /* Copied from kernel/sys.c:setreuid/setuid/setresuid. */
+                /* juggle the capabilities to follow [RES]UID changes unless
-                if (!issecure (SECURE_NO_SETUID_FIXUP)) {
+                 * otherwise suppressed */
-                        cap_emulate_setxuid (old_ruid, old_euid, old_suid);
+                if (!issecure(SECURE_NO_SETUID_FIXUP))
-                }
+                        cap_emulate_setxuid(new, old);
                break;
-        case LSM_SETID_FS:
-                {
-                        uid_t old_fsuid = old_ruid;
-                        /* Copied from kernel/sys.c:setfsuid. */
+        case LSM_SETID_FS:
+                /* juggle the capabilties to follow FSUID changes, unless
-                        /*
+                 * otherwise suppressed
-                         * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
+                 *
-                         *          if not, we might be a bit too harsh here.
+                 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
-                         */
+                 *          if not, we might be a bit too harsh here.
+                 */
-                        if (!issecure (SECURE_NO_SETUID_FIXUP)) {
+                if (!issecure(SECURE_NO_SETUID_FIXUP)) {
-                                if (old_fsuid == 0 && current->fsuid != 0) {
+                        if (old->fsuid == 0 && new->fsuid != 0)
-                                        current->cap_effective =
+                                new->cap_effective =
-                                                cap_drop_fs_set(
+                                        cap_drop_fs_set(new->cap_effective);
-                                                    current->cap_effective);
-                                }
+                        if (old->fsuid != 0 && new->fsuid == 0)
-                                if (old_fsuid != 0 && current->fsuid == 0) {
+                                new->cap_effective =
-                                        current->cap_effective =
+                                        cap_raise_fs_set(new->cap_effective,
-                                                cap_raise_fs_set(
+                                                         new->cap_permitted);
-                                                    current->cap_effective,
-                                                    current->cap_permitted);
-                                }
-                        }
-                        break;
                }
+                break;
        default:
                return -EINVAL;
        }
@@ -543,42 +717,71 @@ int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
 */
 static int cap_safe_nice(struct task_struct *p)
 {
-        if (!cap_issubset(p->cap_permitted, current->cap_permitted) &&
+        int is_subset;
-            !capable(CAP_SYS_NICE))
+        rcu_read_lock();
+        is_subset = cap_issubset(__task_cred(p)->cap_permitted,
+                                 current_cred()->cap_permitted);
+        rcu_read_unlock();
+        if (!is_subset && !capable(CAP_SYS_NICE))
                return -EPERM;
        return 0;
 }
-int cap_task_setscheduler (struct task_struct *p, int policy,
+/**
+ * cap_task_setscheduler - Detemine if scheduler policy change is permitted
+ * @p: The task to affect
+ * @policy: The policy to effect
+ * @lp: The parameters to the scheduling policy
+ *
+ * Detemine if the requested scheduler policy change is permitted for the
+ * specified task, returning 0 if permission is granted, -ve if denied.
+ */
+int cap_task_setscheduler(struct task_struct *p, int policy,
                           struct sched_param *lp)
 {
        return cap_safe_nice(p);
 }
-int cap_task_setioprio (struct task_struct *p, int ioprio)
+/**
+ * cap_task_ioprio - Detemine if I/O priority change is permitted
+ * @p: The task to affect
+ * @ioprio: The I/O priority to set
+ *
+ * Detemine if the requested I/O priority change is permitted for the specified
+ * task, returning 0 if permission is granted, -ve if denied.
+ */
+int cap_task_setioprio(struct task_struct *p, int ioprio)
 {
        return cap_safe_nice(p);
 }
-int cap_task_setnice (struct task_struct *p, int nice)
+/**
+ * cap_task_ioprio - Detemine if task priority change is permitted
+ * @p: The task to affect
+ * @nice: The nice value to set
+ *
+ * Detemine if the requested task priority change is permitted for the
+ * specified task, returning 0 if permission is granted, -ve if denied.
+ */
+int cap_task_setnice(struct task_struct *p, int nice)
 {
        return cap_safe_nice(p);
 }
 /*
- * called from kernel/sys.c for prctl(PR_CABSET_DROP)
+ * Implement PR_CAPBSET_DROP.  Attempt to remove the specified capability from
- * done without task_capability_lock() because it introduces
+ * the current task's bounding set.  Returns 0 on success, -ve on error.
- * no new races - i.e. only another task doing capget() on
- * this task could get inconsistent info.  There can be no
- * racing writer bc a task can only change its own caps.
 */
-static long cap_prctl_drop(unsigned long cap)
+static long cap_prctl_drop(struct cred *new, unsigned long cap)
 {
        if (!capable(CAP_SETPCAP))
                return -EPERM;
        if (!cap_valid(cap))
                return -EINVAL;
-        cap_lower(current->cap_bset, cap);
+        cap_lower(new->cap_bset, cap);
        return 0;
 }
@@ -598,22 +801,42 @@ int cap_task_setnice (struct task_struct *p, int nice)
 }
 #endif
+/**
+ * cap_task_prctl - Implement process control functions for this security module
+ * @option: The process control function requested
+ * @arg2, @arg3, @arg4, @arg5: The argument data for this function
+ *
+ * Allow process control functions (sys_prctl()) to alter capabilities; may
+ * also deny access to other functions not otherwise implemented here.
+ *
+ * Returns 0 or +ve on success, -ENOSYS if this function is not implemented
+ * here, other -ve on error.  If -ENOSYS is returned, sys_prctl() and other LSM
+ * modules will consider performing the function.
+ */
 int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-                   unsigned long arg4, unsigned long arg5, long *rc_p)
+                   unsigned long arg4, unsigned long arg5)
 {
+        struct cred *new;
        long error = 0;
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
        switch (option) {
        case PR_CAPBSET_READ:
+                error = -EINVAL;
                if (!cap_valid(arg2))
-                        error = -EINVAL;
+                        goto error;
-                else
+                error = !!cap_raised(new->cap_bset, arg2);
-                        error = !!cap_raised(current->cap_bset, arg2);
+                goto no_change;
-                break;
 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
        case PR_CAPBSET_DROP:
-                error = cap_prctl_drop(arg2);
+                error = cap_prctl_drop(new, arg2);
-                break;
+                if (error < 0)
+                        goto error;
+                goto changed;
        /*
         * The next four prctl's remain to assist with transitioning a
@@ -635,12 +858,12 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
         * capability-based-privilege environment.
         */
        case PR_SET_SECUREBITS:
-                if ((((current->securebits & SECURE_ALL_LOCKS) >> 1)
+                error = -EPERM;
-                     & (current->securebits ^ arg2))                  /*[1]*/
+                if ((((new->securebits & SECURE_ALL_LOCKS) >> 1)
-                    || ((current->securebits & SECURE_ALL_LOCKS
+                     & (new->securebits ^ arg2))                        /*[1]*/
-                         & ~arg2))                                    /*[2]*/
+                    || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
-                    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
+                    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
-                    || (cap_capable(current, CAP_SETPCAP) != 0)) {    /*[4]*/
+                    || (cap_capable(current, CAP_SETPCAP, SECURITY_CAP_AUDIT) != 0) /*[4]*/
                        /*
                         * [1] no changing of bits that are locked
                         * [2] no unlocking of locks
@@ -648,65 +871,80 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                         * [4] doing anything requires privilege (go read about
                         *     the "sendmail capabilities bug")
                         */
-                        error = -EPERM;  /* cannot change a locked bit */
+                    )
-                } else {
+                        /* cannot change a locked bit */
-                        current->securebits = arg2;
+                        goto error;
-                }
+                new->securebits = arg2;
-                break;
+                goto changed;
        case PR_GET_SECUREBITS:
-                error = current->securebits;
+                error = new->securebits;
-                break;
+                goto no_change;
 #endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
        case PR_GET_KEEPCAPS:
                if (issecure(SECURE_KEEP_CAPS))
                        error = 1;
-                break;
+                goto no_change;
        case PR_SET_KEEPCAPS:
+                error = -EINVAL;
                if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
-                        error = -EINVAL;
+                        goto error;
-                else if (issecure(SECURE_KEEP_CAPS_LOCKED))
+                error = -EPERM;
-                        error = -EPERM;
+                if (issecure(SECURE_KEEP_CAPS_LOCKED))
-                else if (arg2)
+                        goto error;
-                        current->securebits |= issecure_mask(SECURE_KEEP_CAPS);
+                if (arg2)
+                        new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
                else
-                        current->securebits &=
+                        new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
-                                ~issecure_mask(SECURE_KEEP_CAPS);
+                goto changed;
-                break;
        default:
                /* No functionality available - continue with default */
-                return 0;
+                error = -ENOSYS;
+                goto error;
        }
        /* Functionality provided */
-        *rc_p = error;
+changed:
-        return 1;
+        return commit_creds(new);
-}
-void cap_task_reparent_to_init (struct task_struct *p)
+no_change:
-{
+        error = 0;
-        cap_set_init_eff(p->cap_effective);
+error:
-        cap_clear(p->cap_inheritable);
+        abort_creds(new);
-        cap_set_full(p->cap_permitted);
+        return error;
-        p->securebits = SECUREBITS_DEFAULT;
-        return;
 }
-int cap_syslog (int type)
+/**
+ * cap_syslog - Determine whether syslog function is permitted
+ * @type: Function requested
+ *
+ * Determine whether the current process is permitted to use a particular
+ * syslog function, returning 0 if permission is granted, -ve if not.
+ */
+int cap_syslog(int type)
 {
        if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
                return -EPERM;
        return 0;
 }
+/**
+ * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
+ * @mm: The VM space in which the new mapping is to be made
+ * @pages: The size of the mapping
+ *
+ * Determine whether the allocation of a new virtual mapping by the current
+ * task is permitted, returning 0 if permission is granted, -ve if not.
+ */
 int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
        int cap_sys_admin = 0;
-        if (cap_capable(current, CAP_SYS_ADMIN) == 0)
+        if (cap_capable(current, CAP_SYS_ADMIN, SECURITY_CAP_NOAUDIT) == 0)
                cap_sys_admin = 1;
        return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 239098f0fd76..81932abefe7b 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -12,8 +12,8 @@
 #ifndef _INTERNAL_H
 #define _INTERNAL_H
+#include <linux/sched.h>
 #include <linux/key-type.h>
-#include <linux/key-ui.h>
 static inline __attribute__((format(printf, 1, 2)))
 void no_printk(const char *fmt, ...)
@@ -26,7 +26,7 @@ void no_printk(const char *fmt, ...)
 #define kleave(FMT, ...) \
        printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
 #define kdebug(FMT, ...) \
-        printk(KERN_DEBUG "xxx" FMT"yyy\n", ##__VA_ARGS__)
+        printk(KERN_DEBUG "   "FMT"\n", ##__VA_ARGS__)
 #else
 #define kenter(FMT, ...) \
        no_printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__)
@@ -82,6 +82,9 @@ extern struct mutex key_construction_mutex;
 extern wait_queue_head_t request_key_conswq;
+extern struct key_type *key_type_lookup(const char *type);
+extern void key_type_put(struct key_type *ktype);
 extern int __key_link(struct key *keyring, struct key *key);
 extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
@@ -95,7 +98,7 @@ extern struct key *keyring_search_instkey(struct key *keyring,
 typedef int (*key_match_func_t)(const struct key *, const void *);
 extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
-                                    struct task_struct *tsk,
+                                    const struct cred *cred,
                                    struct key_type *type,
                                    const void *description,
                                    key_match_func_t match);
@@ -103,13 +106,13 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 extern key_ref_t search_process_keyrings(struct key_type *type,
                                         const void *description,
                                         key_match_func_t match,
-                                         struct task_struct *tsk);
+                                         const struct cred *cred);
 extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
-extern int install_user_keyrings(struct task_struct *tsk);
+extern int install_user_keyrings(void);
-extern int install_thread_keyring(struct task_struct *tsk);
+extern int install_thread_keyring_to_cred(struct cred *);
-extern int install_process_keyring(struct task_struct *tsk);
+extern int install_process_keyring_to_cred(struct cred *);
 extern struct key *request_key_and_link(struct key_type *type,
                                        const char *description,
@@ -119,12 +122,39 @@ extern struct key *request_key_and_link(struct key_type *type,
                                        struct key *dest_keyring,
                                        unsigned long flags);
+extern key_ref_t lookup_user_key(key_serial_t id, int create, int partial,
+                                 key_perm_t perm);
+extern long join_session_keyring(const char *name);
+/*
+ * check to see whether permission is granted to use a key in the desired way
+ */
+extern int key_task_permission(const key_ref_t key_ref,
+                               const struct cred *cred,
+                               key_perm_t perm);
+static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
+{
+        return key_task_permission(key_ref, current_cred(), perm);
+}
+/* required permissions */
+#define KEY_VIEW        0x01    /* require permission to view attributes */
+#define KEY_READ        0x02    /* require permission to read content */
+#define KEY_WRITE       0x04    /* require permission to update / modify */
+#define KEY_SEARCH      0x08    /* require permission to search (keyring) or find (key) */
+#define KEY_LINK        0x10    /* require permission to link */
+#define KEY_SETATTR     0x20    /* require permission to change attributes */
+#define KEY_ALL         0x3f    /* all the above permissions */
 /*
 * request_key authorisation
 */
 struct request_key_auth {
        struct key              *target_key;
-        struct task_struct      *context;
+        struct key              *dest_keyring;
+        const struct cred       *cred;
        void                    *callout_info;
        size_t                  callout_len;
        pid_t                   pid;
@@ -133,7 +163,8 @@ struct request_key_auth {
 extern struct key_type key_type_request_key_auth;
 extern struct key *request_key_auth_new(struct key *target,
                                        const void *callout_info,
-                                        size_t callout_len);
+                                        size_t callout_len,
+                                        struct key *dest_keyring);
 extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
diff --git a/security/keys/key.c b/security/keys/key.c
index 14948cf83ef6..f76c8a546fd3 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -218,7 +218,7 @@ serial_exists:
 *   instantiate the key or discard it before returning
 */
 struct key *key_alloc(struct key_type *type, const char *desc,
-                      uid_t uid, gid_t gid, struct task_struct *ctx,
+                      uid_t uid, gid_t gid, const struct cred *cred,
                      key_perm_t perm, unsigned long flags)
 {
        struct key_user *user = NULL;
@@ -294,7 +294,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 #endif
        /* let the security module know about the key */
-        ret = security_key_alloc(key, ctx, flags);
+        ret = security_key_alloc(key, cred, flags);
        if (ret < 0)
                goto security_error;
@@ -391,7 +391,7 @@ static int __key_instantiate_and_link(struct key *key,
                                      const void *data,
                                      size_t datalen,
                                      struct key *keyring,
-                                      struct key *instkey)
+                                      struct key *authkey)
 {
        int ret, awaken;
@@ -421,8 +421,8 @@ static int __key_instantiate_and_link(struct key *key,
                                ret = __key_link(keyring, key);
                        /* disable the authorisation key */
-                        if (instkey)
+                        if (authkey)
-                                key_revoke(instkey);
+                                key_revoke(authkey);
                }
        }
@@ -444,14 +444,14 @@ int key_instantiate_and_link(struct key *key,
                             const void *data,
                             size_t datalen,
                             struct key *keyring,
-                             struct key *instkey)
+                             struct key *authkey)
 {
        int ret;
        if (keyring)
                down_write(&keyring->sem);
-        ret = __key_instantiate_and_link(key, data, datalen, keyring, instkey);
+        ret = __key_instantiate_and_link(key, data, datalen, keyring, authkey);
        if (keyring)
                up_write(&keyring->sem);
@@ -469,7 +469,7 @@ EXPORT_SYMBOL(key_instantiate_and_link);
 int key_negate_and_link(struct key *key,
                        unsigned timeout,
                        struct key *keyring,
-                        struct key *instkey)
+                        struct key *authkey)
 {
        struct timespec now;
        int ret, awaken;
@@ -504,8 +504,8 @@ int key_negate_and_link(struct key *key,
                        ret = __key_link(keyring, key);
                /* disable the authorisation key */
-                if (instkey)
+                if (authkey)
-                        key_revoke(instkey);
+                        key_revoke(authkey);
        }
        mutex_unlock(&key_construction_mutex);
@@ -743,6 +743,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                               key_perm_t perm,
                               unsigned long flags)
 {
+        const struct cred *cred = current_cred();
        struct key_type *ktype;
        struct key *keyring, *key = NULL;
        key_ref_t key_ref;
@@ -802,8 +803,8 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
        }
        /* allocate a new key */
-        key = key_alloc(ktype, description, current->fsuid, current->fsgid,
+        key = key_alloc(ktype, description, cred->fsuid, cred->fsgid, cred,
-                        current, perm, flags);
+                        perm, flags);
        if (IS_ERR(key)) {
                key_ref = ERR_CAST(key);
                goto error_3;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index acc9c89e40a8..7c72baa02f2e 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -103,7 +103,7 @@ asmlinkage long sys_add_key(const char __user *_type,
        }
        /* find the target keyring (which must be writable) */
-        keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+        keyring_ref = lookup_user_key(ringid, 1, 0, KEY_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error3;
@@ -185,7 +185,7 @@ asmlinkage long sys_request_key(const char __user *_type,
        /* get the destination keyring if specified */
        dest_ref = NULL;
        if (destringid) {
-                dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
+                dest_ref = lookup_user_key(destringid, 1, 0, KEY_WRITE);
                if (IS_ERR(dest_ref)) {
                        ret = PTR_ERR(dest_ref);
                        goto error3;
@@ -235,7 +235,7 @@ long keyctl_get_keyring_ID(key_serial_t id, int create)
        key_ref_t key_ref;
        long ret;
-        key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
+        key_ref = lookup_user_key(id, create, 0, KEY_SEARCH);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
@@ -308,7 +308,7 @@ long keyctl_update_key(key_serial_t id,
        }
        /* find the target key (which must be writable) */
-        key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
+        key_ref = lookup_user_key(id, 0, 0, KEY_WRITE);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error2;
@@ -336,7 +336,7 @@ long keyctl_revoke_key(key_serial_t id)
        key_ref_t key_ref;
        long ret;
-        key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
+        key_ref = lookup_user_key(id, 0, 0, KEY_WRITE);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
@@ -362,7 +362,7 @@ long keyctl_keyring_clear(key_serial_t ringid)
        key_ref_t keyring_ref;
        long ret;
-        keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+        keyring_ref = lookup_user_key(ringid, 1, 0, KEY_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error;
@@ -388,13 +388,13 @@ long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
        key_ref_t keyring_ref, key_ref;
        long ret;
-        keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+        keyring_ref = lookup_user_key(ringid, 1, 0, KEY_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error;
        }
-        key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
+        key_ref = lookup_user_key(id, 1, 0, KEY_LINK);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error2;
@@ -422,13 +422,13 @@ long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
        key_ref_t keyring_ref, key_ref;
        long ret;
-        keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
+        keyring_ref = lookup_user_key(ringid, 0, 0, KEY_WRITE);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error;
        }
-        key_ref = lookup_user_key(NULL, id, 0, 0, 0);
+        key_ref = lookup_user_key(id, 0, 0, 0);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error2;
@@ -464,7 +464,7 @@ long keyctl_describe_key(key_serial_t keyid,
        char *tmpbuf;
        long ret;
-        key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
+        key_ref = lookup_user_key(keyid, 0, 1, KEY_VIEW);
        if (IS_ERR(key_ref)) {
                /* viewing a key under construction is permitted if we have the
                 * authorisation token handy */
@@ -472,7 +472,7 @@ long keyctl_describe_key(key_serial_t keyid,
                        instkey = key_get_instantiation_authkey(keyid);
                        if (!IS_ERR(instkey)) {
                                key_put(instkey);
-                                key_ref = lookup_user_key(NULL, keyid,
+                                key_ref = lookup_user_key(keyid,
                                                          0, 1, 0);
                                if (!IS_ERR(key_ref))
                                        goto okay;
@@ -557,7 +557,7 @@ long keyctl_keyring_search(key_serial_t ringid,
        }
        /* get the keyring at which to begin the search */
-        keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
+        keyring_ref = lookup_user_key(ringid, 0, 0, KEY_SEARCH);
        if (IS_ERR(keyring_ref)) {
                ret = PTR_ERR(keyring_ref);
                goto error2;
@@ -566,7 +566,7 @@ long keyctl_keyring_search(key_serial_t ringid,
        /* get the destination keyring if specified */
        dest_ref = NULL;
        if (destringid) {
-                dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
+                dest_ref = lookup_user_key(destringid, 1, 0, KEY_WRITE);
                if (IS_ERR(dest_ref)) {
                        ret = PTR_ERR(dest_ref);
                        goto error3;
@@ -636,7 +636,7 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
        long ret;
        /* find the key first */
-        key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
+        key_ref = lookup_user_key(keyid, 0, 0, 0);
        if (IS_ERR(key_ref)) {
                ret = -ENOKEY;
                goto error;
@@ -699,7 +699,7 @@ long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
        if (uid == (uid_t) -1 && gid == (gid_t) -1)
                goto error;
-        key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
+        key_ref = lookup_user_key(id, 1, 1, KEY_SETATTR);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
@@ -804,7 +804,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
        if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
                goto error;
-        key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
+        key_ref = lookup_user_key(id, 1, 1, KEY_SETATTR);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
@@ -817,7 +817,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
        down_write(&key->sem);
        /* if we're not the sysadmin, we can only change a key that we own */
-        if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) {
+        if (capable(CAP_SYS_ADMIN) || key->uid == current_fsuid()) {
                key->perm = perm;
                ret = 0;
        }
@@ -829,6 +829,60 @@ error:
 } /* end keyctl_setperm_key() */
+/*
+ * get the destination keyring for instantiation
+ */
+static long get_instantiation_keyring(key_serial_t ringid,
+                                      struct request_key_auth *rka,
+                                      struct key **_dest_keyring)
+{
+        key_ref_t dkref;
+        /* just return a NULL pointer if we weren't asked to make a link */
+        if (ringid == 0) {
+                *_dest_keyring = NULL;
+                return 0;
+        }
+        /* if a specific keyring is nominated by ID, then use that */
+        if (ringid > 0) {
+                dkref = lookup_user_key(ringid, 1, 0, KEY_WRITE);
+                if (IS_ERR(dkref))
+                        return PTR_ERR(dkref);
+                *_dest_keyring = key_ref_to_ptr(dkref);
+                return 0;
+        }
+        if (ringid == KEY_SPEC_REQKEY_AUTH_KEY)
+                return -EINVAL;
+        /* otherwise specify the destination keyring recorded in the
+         * authorisation key (any KEY_SPEC_*_KEYRING) */
+        if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
+                *_dest_keyring = rka->dest_keyring;
+                return 0;
+        }
+        return -ENOKEY;
+}
+/*
+ * change the request_key authorisation key on the current process
+ */
+static int keyctl_change_reqkey_auth(struct key *key)
+{
+        struct cred *new;
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        key_put(new->request_key_auth);
+        new->request_key_auth = key_get(key);
+        return commit_creds(new);
+}
 /*****************************************************************************/
 /*
 * instantiate the key with the specified payload, and, if one is given, link
@@ -839,13 +893,15 @@ long keyctl_instantiate_key(key_serial_t id,
                            size_t plen,
                            key_serial_t ringid)
 {
+        const struct cred *cred = current_cred();
        struct request_key_auth *rka;
-        struct key *instkey;
+        struct key *instkey, *dest_keyring;
-        key_ref_t keyring_ref;
        void *payload;
        long ret;
        bool vm = false;
+        kenter("%d,,%zu,%d", id, plen, ringid);
        ret = -EINVAL;
        if (plen > 1024 * 1024 - 1)
                goto error;
@@ -853,7 +909,7 @@ long keyctl_instantiate_key(key_serial_t id,
        /* the appropriate instantiation authorisation key must have been
         * assumed before calling this */
        ret = -EPERM;
-        instkey = current->request_key_auth;
+        instkey = cred->request_key_auth;
        if (!instkey)
                goto error;
@@ -883,28 +939,20 @@ long keyctl_instantiate_key(key_serial_t id,
        /* find the destination keyring amongst those belonging to the
         * requesting task */
-        keyring_ref = NULL;
+        ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
-        if (ringid) {
+        if (ret < 0)
-                keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
+                goto error2;
-                                              KEY_WRITE);
-                if (IS_ERR(keyring_ref)) {
-                        ret = PTR_ERR(keyring_ref);
-                        goto error2;
-                }
-        }
        /* instantiate the key and link it into a keyring */
        ret = key_instantiate_and_link(rka->target_key, payload, plen,
-                                       key_ref_to_ptr(keyring_ref), instkey);
+                                       dest_keyring, instkey);
-        key_ref_put(keyring_ref);
+        key_put(dest_keyring);
        /* discard the assumed authority if it's just been disabled by
         * instantiation of the key */
-        if (ret == 0) {
+        if (ret == 0)
-                key_put(current->request_key_auth);
+                keyctl_change_reqkey_auth(NULL);
-                current->request_key_auth = NULL;
-        }
 error2:
        if (!vm)
@@ -923,15 +971,17 @@ error:
 */
 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 {
+        const struct cred *cred = current_cred();
        struct request_key_auth *rka;
-        struct key *instkey;
+        struct key *instkey, *dest_keyring;
-        key_ref_t keyring_ref;
        long ret;
+        kenter("%d,%u,%d", id, timeout, ringid);
        /* the appropriate instantiation authorisation key must have been
         * assumed before calling this */
        ret = -EPERM;
-        instkey = current->request_key_auth;
+        instkey = cred->request_key_auth;
        if (!instkey)
                goto error;
@@ -941,27 +991,20 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
        /* find the destination keyring if present (which must also be
         * writable) */
-        keyring_ref = NULL;
+        ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
-        if (ringid) {
+        if (ret < 0)
-                keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
+                goto error;
-                if (IS_ERR(keyring_ref)) {
-                        ret = PTR_ERR(keyring_ref);
-                        goto error;
-                }
-        }
        /* instantiate the key and link it into a keyring */
        ret = key_negate_and_link(rka->target_key, timeout,
-                                  key_ref_to_ptr(keyring_ref), instkey);
+                                  dest_keyring, instkey);
-        key_ref_put(keyring_ref);
+        key_put(dest_keyring);
        /* discard the assumed authority if it's just been disabled by
         * instantiation of the key */
-        if (ret == 0) {
+        if (ret == 0)
-                key_put(current->request_key_auth);
+                keyctl_change_reqkey_auth(NULL);
-                current->request_key_auth = NULL;
-        }
 error:
        return ret;
@@ -975,35 +1018,56 @@ error:
 */
 long keyctl_set_reqkey_keyring(int reqkey_defl)
 {
-        int ret;
+        struct cred *new;
+        int ret, old_setting;
+        old_setting = current_cred_xxx(jit_keyring);
+        if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
+                return old_setting;
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
        switch (reqkey_defl) {
        case KEY_REQKEY_DEFL_THREAD_KEYRING:
-                ret = install_thread_keyring(current);
+                ret = install_thread_keyring_to_cred(new);
                if (ret < 0)
-                        return ret;
+                        goto error;
                goto set;
        case KEY_REQKEY_DEFL_PROCESS_KEYRING:
-                ret = install_process_keyring(current);
+                ret = install_process_keyring_to_cred(new);
-                if (ret < 0)
+                if (ret < 0) {
-                        return ret;
+                        if (ret != -EEXIST)
+                                goto error;
+                        ret = 0;
+                }
+                goto set;
        case KEY_REQKEY_DEFL_DEFAULT:
        case KEY_REQKEY_DEFL_SESSION_KEYRING:
        case KEY_REQKEY_DEFL_USER_KEYRING:
        case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
-        set:
+        case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
-                current->jit_keyring = reqkey_defl;
+                goto set;
        case KEY_REQKEY_DEFL_NO_CHANGE:
-                return current->jit_keyring;
        case KEY_REQKEY_DEFL_GROUP_KEYRING:
        default:
-                return -EINVAL;
+                ret = -EINVAL;
+                goto error;
        }
+set:
+        new->jit_keyring = reqkey_defl;
+        commit_creds(new);
+        return old_setting;
+error:
+        abort_creds(new);
+        return -EINVAL;
 } /* end keyctl_set_reqkey_keyring() */
 /*****************************************************************************/
@@ -1018,7 +1082,7 @@ long keyctl_set_timeout(key_serial_t id, unsigned timeout)
        time_t expiry;
        long ret;
-        key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
+        key_ref = lookup_user_key(id, 1, 1, KEY_SETATTR);
        if (IS_ERR(key_ref)) {
                ret = PTR_ERR(key_ref);
                goto error;
@@ -1062,9 +1126,7 @@ long keyctl_assume_authority(key_serial_t id)
        /* we divest ourselves of authority if given an ID of 0 */
        if (id == 0) {
-                key_put(current->request_key_auth);
+                ret = keyctl_change_reqkey_auth(NULL);
-                current->request_key_auth = NULL;
-                ret = 0;
                goto error;
        }
@@ -1079,10 +1141,12 @@ long keyctl_assume_authority(key_serial_t id)
                goto error;
        }
-        key_put(current->request_key_auth);
+        ret = keyctl_change_reqkey_auth(authkey);
-        current->request_key_auth = authkey;
+        if (ret < 0)
-        ret = authkey->serial;
+                goto error;
+        key_put(authkey);
+        ret = authkey->serial;
 error:
        return ret;
@@ -1105,7 +1169,7 @@ long keyctl_get_security(key_serial_t keyid,
        char *context;
        long ret;
-        key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
+        key_ref = lookup_user_key(keyid, 0, 1, KEY_VIEW);
        if (IS_ERR(key_ref)) {
                if (PTR_ERR(key_ref) != -EACCES)
                        return PTR_ERR(key_ref);
@@ -1117,7 +1181,7 @@ long keyctl_get_security(key_serial_t keyid,
                        return PTR_ERR(key_ref);
                key_put(instkey);
-                key_ref = lookup_user_key(NULL, keyid, 0, 1, 0);
+                key_ref = lookup_user_key(keyid, 0, 1, 0);
                if (IS_ERR(key_ref))
                        return PTR_ERR(key_ref);
        }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index a9ab8affc092..ed851574d073 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -16,6 +16,7 @@
 #include <linux/security.h>
 #include <linux/seq_file.h>
 #include <linux/err.h>
+#include <keys/keyring-type.h>
 #include <asm/uaccess.h>
 #include "internal.h"
@@ -244,14 +245,14 @@ static long keyring_read(const struct key *keyring,
 * allocate a keyring and link into the destination keyring
 */
 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
-                          struct task_struct *ctx, unsigned long flags,
+                          const struct cred *cred, unsigned long flags,
                          struct key *dest)
 {
        struct key *keyring;
        int ret;
        keyring = key_alloc(&key_type_keyring, description,
-                            uid, gid, ctx,
+                            uid, gid, cred,
                            (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
                            flags);
@@ -280,7 +281,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
 * - we propagate the possession attribute from the keyring ref to the key ref
 */
 key_ref_t keyring_search_aux(key_ref_t keyring_ref,
-                             struct task_struct *context,
+                             const struct cred *cred,
                             struct key_type *type,
                             const void *description,
                             key_match_func_t match)
@@ -303,7 +304,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
        key_check(keyring);
        /* top keyring must have search permission to begin the search */
-        err = key_task_permission(keyring_ref, context, KEY_SEARCH);
+        err = key_task_permission(keyring_ref, cred, KEY_SEARCH);
        if (err < 0) {
                key_ref = ERR_PTR(err);
                goto error;
@@ -376,7 +377,7 @@ descend:
                /* key must have search permissions */
                if (key_task_permission(make_key_ref(key, possessed),
-                                        context, KEY_SEARCH) < 0)
+                                        cred, KEY_SEARCH) < 0)
                        continue;
                /* we set a different error code if we pass a negative key */
@@ -403,7 +404,7 @@ ascend:
                        continue;
                if (key_task_permission(make_key_ref(key, possessed),
-                                        context, KEY_SEARCH) < 0)
+                                        cred, KEY_SEARCH) < 0)
                        continue;
                /* stack the current position */
@@ -458,7 +459,7 @@ key_ref_t keyring_search(key_ref_t keyring,
        if (!type->match)
                return ERR_PTR(-ENOKEY);
-        return keyring_search_aux(keyring, current,
+        return keyring_search_aux(keyring, current->cred,
                                  type, description, type->match);
 } /* end keyring_search() */
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 3b41f9b52537..5d9fc7b93f2e 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -14,12 +14,19 @@
 #include "internal.h"
 /*****************************************************************************/
-/*
+/**
- * check to see whether permission is granted to use a key in the desired way,
+ * key_task_permission - Check a key can be used
- * but permit the security modules to override
+ * @key_ref: The key to check
+ * @cred: The credentials to use
+ * @perm: The permissions to check for
+ *
+ * Check to see whether permission is granted to use a key in the desired way,
+ * but permit the security modules to override.
+ *
+ * The caller must hold either a ref on cred or must hold the RCU readlock or a
+ * spinlock.
 */
-int key_task_permission(const key_ref_t key_ref,
+int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
-                        struct task_struct *context,
                        key_perm_t perm)
 {
        struct key *key;
@@ -29,7 +36,7 @@ int key_task_permission(const key_ref_t key_ref,
        key = key_ref_to_ptr(key_ref);
        /* use the second 8-bits of permissions for keys the caller owns */
-        if (key->uid == context->fsuid) {
+        if (key->uid == cred->fsuid) {
                kperm = key->perm >> 16;
                goto use_these_perms;
        }
@@ -37,15 +44,12 @@ int key_task_permission(const key_ref_t key_ref,
        /* use the third 8-bits of permissions for keys the caller has a group
         * membership in common with */
        if (key->gid != -1 && key->perm & KEY_GRP_ALL) {
-                if (key->gid == context->fsgid) {
+                if (key->gid == cred->fsgid) {
                        kperm = key->perm >> 8;
                        goto use_these_perms;
                }
-                task_lock(context);
+                ret = groups_search(cred->group_info, key->gid);
-                ret = groups_search(context->group_info, key->gid);
-                task_unlock(context);
                if (ret) {
                        kperm = key->perm >> 8;
                        goto use_these_perms;
@@ -56,6 +60,7 @@ int key_task_permission(const key_ref_t key_ref,
        kperm = key->perm;
 use_these_perms:
        /* use the top 8-bits of permissions for keys the caller possesses
         * - possessor permissions are additive with other permissions
         */
@@ -68,7 +73,7 @@ use_these_perms:
                return -EACCES;
        /* let LSM be the final arbiter */
-        return security_key_permission(key_ref, context, perm);
+        return security_key_permission(key_ref, cred, perm);
 } /* end key_task_permission() */
diff --git a/security/keys/proc.c b/security/keys/proc.c
index f619170da760..7f508def50e3 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -136,8 +136,12 @@ static int proc_keys_show(struct seq_file *m, void *v)
        int rc;
        /* check whether the current task is allowed to view the key (assuming
-         * non-possession) */
+         * non-possession)
-        rc = key_task_permission(make_key_ref(key, 0), current, KEY_VIEW);
+         * - the caller holds a spinlock, and thus the RCU read lock, making our
+         *   access to __current_cred() safe
+         */
+        rc = key_task_permission(make_key_ref(key, 0), current_cred(),
+                                 KEY_VIEW);
        if (rc < 0)
                return 0;
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 45b240af6dbe..2f5d89e92b85 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -40,13 +40,17 @@ struct key_user root_key_user = {
 /*
 * install user and user session keyrings for a particular UID
 */
-int install_user_keyrings(struct task_struct *tsk)
+int install_user_keyrings(void)
 {
-        struct user_struct *user = tsk->user;
+        struct user_struct *user;
+        const struct cred *cred;
        struct key *uid_keyring, *session_keyring;
        char buf[20];
        int ret;
+        cred = current_cred();
+        user = cred->user;
        kenter("%p{%u}", user, user->uid);
        if (user->uid_keyring) {
@@ -67,7 +71,7 @@ int install_user_keyrings(struct task_struct *tsk)
                uid_keyring = find_keyring_by_name(buf, true);
                if (IS_ERR(uid_keyring)) {
                        uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
-                                                    tsk, KEY_ALLOC_IN_QUOTA,
+                                                    cred, KEY_ALLOC_IN_QUOTA,
                                                    NULL);
                        if (IS_ERR(uid_keyring)) {
                                ret = PTR_ERR(uid_keyring);
@@ -83,7 +87,7 @@ int install_user_keyrings(struct task_struct *tsk)
                if (IS_ERR(session_keyring)) {
                        session_keyring =
                                keyring_alloc(buf, user->uid, (gid_t) -1,
-                                              tsk, KEY_ALLOC_IN_QUOTA, NULL);
+                                              cred, KEY_ALLOC_IN_QUOTA, NULL);
                        if (IS_ERR(session_keyring)) {
                                ret = PTR_ERR(session_keyring);
                                goto error_release;
@@ -115,140 +119,128 @@ error:
        return ret;
 }
-/*****************************************************************************/
 /*
- * deal with the UID changing
+ * install a fresh thread keyring directly to new credentials
 */
-void switch_uid_keyring(struct user_struct *new_user)
+int install_thread_keyring_to_cred(struct cred *new)
 {
-#if 0 /* do nothing for now */
+        struct key *keyring;
-        struct key *old;
-        /* switch to the new user's session keyring if we were running under
-         * root's default session keyring */
-        if (new_user->uid != 0 &&
-            current->session_keyring == &root_session_keyring
-            ) {
-                atomic_inc(&new_user->session_keyring->usage);
-                task_lock(current);
-                old = current->session_keyring;
-                current->session_keyring = new_user->session_keyring;
-                task_unlock(current);
-                key_put(old);
+        keyring = keyring_alloc("_tid", new->uid, new->gid, new,
-        }
+                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
-#endif
+        if (IS_ERR(keyring))
+                return PTR_ERR(keyring);
-} /* end switch_uid_keyring() */
+        new->thread_keyring = keyring;
+        return 0;
+}
-/*****************************************************************************/
 /*
 * install a fresh thread keyring, discarding the old one
 */
-int install_thread_keyring(struct task_struct *tsk)
+static int install_thread_keyring(void)
 {
-        struct key *keyring, *old;
+        struct cred *new;
-        char buf[20];
        int ret;
-        sprintf(buf, "_tid.%u", tsk->pid);
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
-        keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
+        BUG_ON(new->thread_keyring);
-                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
-        if (IS_ERR(keyring)) {
+        ret = install_thread_keyring_to_cred(new);
-                ret = PTR_ERR(keyring);
+        if (ret < 0) {
-                goto error;
+                abort_creds(new);
+                return ret;
        }
-        task_lock(tsk);
+        return commit_creds(new);
-        old = tsk->thread_keyring;
+}
-        tsk->thread_keyring = keyring;
-        task_unlock(tsk);
-        ret = 0;
+/*
+ * install a process keyring directly to a credentials struct
+ * - returns -EEXIST if there was already a process keyring, 0 if one installed,
+ *   and other -ve on any other error
+ */
+int install_process_keyring_to_cred(struct cred *new)
+{
+        struct key *keyring;
+        int ret;
-        key_put(old);
+        if (new->tgcred->process_keyring)
-error:
+                return -EEXIST;
+        keyring = keyring_alloc("_pid", new->uid, new->gid,
+                                new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
+        if (IS_ERR(keyring))
+                return PTR_ERR(keyring);
+        spin_lock_irq(&new->tgcred->lock);
+        if (!new->tgcred->process_keyring) {
+                new->tgcred->process_keyring = keyring;
+                keyring = NULL;
+                ret = 0;
+        } else {
+                ret = -EEXIST;
+        }
+        spin_unlock_irq(&new->tgcred->lock);
+        key_put(keyring);
        return ret;
+}
-} /* end install_thread_keyring() */
-/*****************************************************************************/
 /*
 * make sure a process keyring is installed
+ * - we
 */
-int install_process_keyring(struct task_struct *tsk)
+static int install_process_keyring(void)
 {
-        struct key *keyring;
+        struct cred *new;
-        char buf[20];
        int ret;
-        might_sleep();
+        new = prepare_creds();
+        if (!new)
-        if (!tsk->signal->process_keyring) {
+                return -ENOMEM;
-                sprintf(buf, "_pid.%u", tsk->tgid);
-                keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
-                                        KEY_ALLOC_QUOTA_OVERRUN, NULL);
-                if (IS_ERR(keyring)) {
-                        ret = PTR_ERR(keyring);
-                        goto error;
-                }
-                /* attach keyring */
-                spin_lock_irq(&tsk->sighand->siglock);
-                if (!tsk->signal->process_keyring) {
-                        tsk->signal->process_keyring = keyring;
-                        keyring = NULL;
-                }
-                spin_unlock_irq(&tsk->sighand->siglock);
-                key_put(keyring);
+        ret = install_process_keyring_to_cred(new);
+        if (ret < 0) {
+                abort_creds(new);
+                return ret != -EEXIST ?: 0;
        }
-        ret = 0;
+        return commit_creds(new);
-error:
+}
-        return ret;
-} /* end install_process_keyring() */
-/*****************************************************************************/
 /*
- * install a session keyring, discarding the old one
+ * install a session keyring directly to a credentials struct
- * - if a keyring is not supplied, an empty one is invented
 */
-static int install_session_keyring(struct task_struct *tsk,
+static int install_session_keyring_to_cred(struct cred *cred,
-                                   struct key *keyring)
+                                           struct key *keyring)
 {
        unsigned long flags;
        struct key *old;
-        char buf[20];
        might_sleep();
        /* create an empty session keyring */
        if (!keyring) {
-                sprintf(buf, "_ses.%u", tsk->tgid);
                flags = KEY_ALLOC_QUOTA_OVERRUN;
-                if (tsk->signal->session_keyring)
+                if (cred->tgcred->session_keyring)
                        flags = KEY_ALLOC_IN_QUOTA;
-                keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
+                keyring = keyring_alloc("_ses", cred->uid, cred->gid,
-                                        flags, NULL);
+                                        cred, flags, NULL);
                if (IS_ERR(keyring))
                        return PTR_ERR(keyring);
-        }
+        } else {
-        else {
                atomic_inc(&keyring->usage);
        }
        /* install the keyring */
-        spin_lock_irq(&tsk->sighand->siglock);
+        spin_lock_irq(&cred->tgcred->lock);
-        old = tsk->signal->session_keyring;
+        old = cred->tgcred->session_keyring;
-        rcu_assign_pointer(tsk->signal->session_keyring, keyring);
+        rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
-        spin_unlock_irq(&tsk->sighand->siglock);
+        spin_unlock_irq(&cred->tgcred->lock);
        /* we're using RCU on the pointer, but there's no point synchronising
         * on it if it didn't previously point to anything */
@@ -258,110 +250,29 @@ static int install_session_keyring(struct task_struct *tsk,
        }
        return 0;
+}
-} /* end install_session_keyring() */
-/*****************************************************************************/
-/*
- * copy the keys in a thread group for fork without CLONE_THREAD
- */
-int copy_thread_group_keys(struct task_struct *tsk)
-{
-        key_check(current->thread_group->session_keyring);
-        key_check(current->thread_group->process_keyring);
-        /* no process keyring yet */
-        tsk->signal->process_keyring = NULL;
-        /* same session keyring */
-        rcu_read_lock();
-        tsk->signal->session_keyring =
-                key_get(rcu_dereference(current->signal->session_keyring));
-        rcu_read_unlock();
-        return 0;
-} /* end copy_thread_group_keys() */
-/*****************************************************************************/
-/*
- * copy the keys for fork
- */
-int copy_keys(unsigned long clone_flags, struct task_struct *tsk)
-{
-        key_check(tsk->thread_keyring);
-        key_check(tsk->request_key_auth);
-        /* no thread keyring yet */
-        tsk->thread_keyring = NULL;
-        /* copy the request_key() authorisation for this thread */
-        key_get(tsk->request_key_auth);
-        return 0;
-} /* end copy_keys() */
-/*****************************************************************************/
-/*
- * dispose of thread group keys upon thread group destruction
- */
-void exit_thread_group_keys(struct signal_struct *tg)
-{
-        key_put(tg->session_keyring);
-        key_put(tg->process_keyring);
-} /* end exit_thread_group_keys() */
-/*****************************************************************************/
-/*
- * dispose of per-thread keys upon thread exit
- */
-void exit_keys(struct task_struct *tsk)
-{
-        key_put(tsk->thread_keyring);
-        key_put(tsk->request_key_auth);
-} /* end exit_keys() */
-/*****************************************************************************/
 /*
- * deal with execve()
+ * install a session keyring, discarding the old one
+ * - if a keyring is not supplied, an empty one is invented
 */
-int exec_keys(struct task_struct *tsk)
+static int install_session_keyring(struct key *keyring)
 {
-        struct key *old;
+        struct cred *new;
+        int ret;
-        /* newly exec'd tasks don't get a thread keyring */
-        task_lock(tsk);
-        old = tsk->thread_keyring;
-        tsk->thread_keyring = NULL;
-        task_unlock(tsk);
-        key_put(old);
-        /* discard the process keyring from a newly exec'd task */
-        spin_lock_irq(&tsk->sighand->siglock);
-        old = tsk->signal->process_keyring;
-        tsk->signal->process_keyring = NULL;
-        spin_unlock_irq(&tsk->sighand->siglock);
-        key_put(old);
-        return 0;
-} /* end exec_keys() */
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
-/*****************************************************************************/
+        ret = install_session_keyring_to_cred(new, NULL);
-/*
+        if (ret < 0) {
- * deal with SUID programs
+                abort_creds(new);
- * - we might want to make this invent a new session keyring
+                return ret;
- */
+        }
-int suid_keys(struct task_struct *tsk)
-{
-        return 0;
-} /* end suid_keys() */
+        return commit_creds(new);
+}
 /*****************************************************************************/
 /*
@@ -370,10 +281,11 @@ int suid_keys(struct task_struct *tsk)
 void key_fsuid_changed(struct task_struct *tsk)
 {
        /* update the ownership of the thread keyring */
-        if (tsk->thread_keyring) {
+        BUG_ON(!tsk->cred);
-                down_write(&tsk->thread_keyring->sem);
+        if (tsk->cred->thread_keyring) {
-                tsk->thread_keyring->uid = tsk->fsuid;
+                down_write(&tsk->cred->thread_keyring->sem);
-                up_write(&tsk->thread_keyring->sem);
+                tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
+                up_write(&tsk->cred->thread_keyring->sem);
        }
 } /* end key_fsuid_changed() */
@@ -385,10 +297,11 @@ void key_fsuid_changed(struct task_struct *tsk)
 void key_fsgid_changed(struct task_struct *tsk)
 {
        /* update the ownership of the thread keyring */
-        if (tsk->thread_keyring) {
+        BUG_ON(!tsk->cred);
-                down_write(&tsk->thread_keyring->sem);
+        if (tsk->cred->thread_keyring) {
-                tsk->thread_keyring->gid = tsk->fsgid;
+                down_write(&tsk->cred->thread_keyring->sem);
-                up_write(&tsk->thread_keyring->sem);
+                tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
+                up_write(&tsk->cred->thread_keyring->sem);
        }
 } /* end key_fsgid_changed() */
@@ -404,7 +317,7 @@ void key_fsgid_changed(struct task_struct *tsk)
 key_ref_t search_process_keyrings(struct key_type *type,
                                  const void *description,
                                  key_match_func_t match,
-                                  struct task_struct *context)
+                                  const struct cred *cred)
 {
        struct request_key_auth *rka;
        key_ref_t key_ref, ret, err;
@@ -423,10 +336,10 @@ key_ref_t search_process_keyrings(struct key_type *type,
        err = ERR_PTR(-EAGAIN);
        /* search the thread keyring first */
-        if (context->thread_keyring) {
+        if (cred->thread_keyring) {
                key_ref = keyring_search_aux(
-                        make_key_ref(context->thread_keyring, 1),
+                        make_key_ref(cred->thread_keyring, 1),
-                        context, type, description, match);
+                        cred, type, description, match);
                if (!IS_ERR(key_ref))
                        goto found;
@@ -444,10 +357,10 @@ key_ref_t search_process_keyrings(struct key_type *type,
        }
        /* search the process keyring second */
-        if (context->signal->process_keyring) {
+        if (cred->tgcred->process_keyring) {
                key_ref = keyring_search_aux(
-                        make_key_ref(context->signal->process_keyring, 1),
+                        make_key_ref(cred->tgcred->process_keyring, 1),
-                        context, type, description, match);
+                        cred, type, description, match);
                if (!IS_ERR(key_ref))
                        goto found;
@@ -465,13 +378,13 @@ key_ref_t search_process_keyrings(struct key_type *type,
        }
        /* search the session keyring */
-        if (context->signal->session_keyring) {
+        if (cred->tgcred->session_keyring) {
                rcu_read_lock();
                key_ref = keyring_search_aux(
                        make_key_ref(rcu_dereference(
-                                             context->signal->session_keyring),
+                                             cred->tgcred->session_keyring),
                                     1),
-                        context, type, description, match);
+                        cred, type, description, match);
                rcu_read_unlock();
                if (!IS_ERR(key_ref))
@@ -490,10 +403,10 @@ key_ref_t search_process_keyrings(struct key_type *type,
                }
        }
        /* or search the user-session keyring */
-        else if (context->user->session_keyring) {
+        else if (cred->user->session_keyring) {
                key_ref = keyring_search_aux(
-                        make_key_ref(context->user->session_keyring, 1),
+                        make_key_ref(cred->user->session_keyring, 1),
-                        context, type, description, match);
+                        cred, type, description, match);
                if (!IS_ERR(key_ref))
                        goto found;
@@ -514,20 +427,20 @@ key_ref_t search_process_keyrings(struct key_type *type,
         * search the keyrings of the process mentioned there
         * - we don't permit access to request_key auth keys via this method
         */
-        if (context->request_key_auth &&
+        if (cred->request_key_auth &&
-            context == current &&
+            cred == current_cred() &&
            type != &key_type_request_key_auth
            ) {
                /* defend against the auth key being revoked */
-                down_read(&context->request_key_auth->sem);
+                down_read(&cred->request_key_auth->sem);
-                if (key_validate(context->request_key_auth) == 0) {
+                if (key_validate(cred->request_key_auth) == 0) {
-                        rka = context->request_key_auth->payload.data;
+                        rka = cred->request_key_auth->payload.data;
                        key_ref = search_process_keyrings(type, description,
-                                                          match, rka->context);
+                                                          match, rka->cred);
-                        up_read(&context->request_key_auth->sem);
+                        up_read(&cred->request_key_auth->sem);
                        if (!IS_ERR(key_ref))
                                goto found;
@@ -544,7 +457,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
                                break;
                        }
                } else {
-                        up_read(&context->request_key_auth->sem);
+                        up_read(&cred->request_key_auth->sem);
                }
        }
@@ -572,93 +485,98 @@ static int lookup_user_key_possessed(const struct key *key, const void *target)
 * - don't create special keyrings unless so requested
 * - partially constructed keys aren't found unless requested
 */
-key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
+key_ref_t lookup_user_key(key_serial_t id, int create, int partial,
-                          int create, int partial, key_perm_t perm)
+                          key_perm_t perm)
 {
-        key_ref_t key_ref, skey_ref;
+        struct request_key_auth *rka;
+        const struct cred *cred;
        struct key *key;
+        key_ref_t key_ref, skey_ref;
        int ret;
-        if (!context)
+try_again:
-                context = current;
+        cred = get_current_cred();
        key_ref = ERR_PTR(-ENOKEY);
        switch (id) {
        case KEY_SPEC_THREAD_KEYRING:
-                if (!context->thread_keyring) {
+                if (!cred->thread_keyring) {
                        if (!create)
                                goto error;
-                        ret = install_thread_keyring(context);
+                        ret = install_thread_keyring();
                        if (ret < 0) {
                                key = ERR_PTR(ret);
                                goto error;
                        }
+                        goto reget_creds;
                }
-                key = context->thread_keyring;
+                key = cred->thread_keyring;
                atomic_inc(&key->usage);
                key_ref = make_key_ref(key, 1);
                break;
        case KEY_SPEC_PROCESS_KEYRING:
-                if (!context->signal->process_keyring) {
+                if (!cred->tgcred->process_keyring) {
                        if (!create)
                                goto error;
-                        ret = install_process_keyring(context);
+                        ret = install_process_keyring();
                        if (ret < 0) {
                                key = ERR_PTR(ret);
                                goto error;
                        }
+                        goto reget_creds;
                }
-                key = context->signal->process_keyring;
+                key = cred->tgcred->process_keyring;
                atomic_inc(&key->usage);
                key_ref = make_key_ref(key, 1);
                break;
        case KEY_SPEC_SESSION_KEYRING:
-                if (!context->signal->session_keyring) {
+                if (!cred->tgcred->session_keyring) {
                        /* always install a session keyring upon access if one
                         * doesn't exist yet */
-                        ret = install_user_keyrings(context);
+                        ret = install_user_keyrings();
                        if (ret < 0)
                                goto error;
                        ret = install_session_keyring(
-                                context, context->user->session_keyring);
+                                cred->user->session_keyring);
                        if (ret < 0)
                                goto error;
+                        goto reget_creds;
                }
                rcu_read_lock();
-                key = rcu_dereference(context->signal->session_keyring);
+                key = rcu_dereference(cred->tgcred->session_keyring);
                atomic_inc(&key->usage);
                rcu_read_unlock();
                key_ref = make_key_ref(key, 1);
                break;
        case KEY_SPEC_USER_KEYRING:
-                if (!context->user->uid_keyring) {
+                if (!cred->user->uid_keyring) {
-                        ret = install_user_keyrings(context);
+                        ret = install_user_keyrings();
                        if (ret < 0)
                                goto error;
                }
-                key = context->user->uid_keyring;
+                key = cred->user->uid_keyring;
                atomic_inc(&key->usage);
                key_ref = make_key_ref(key, 1);
                break;
        case KEY_SPEC_USER_SESSION_KEYRING:
-                if (!context->user->session_keyring) {
+                if (!cred->user->session_keyring) {
-                        ret = install_user_keyrings(context);
+                        ret = install_user_keyrings();
                        if (ret < 0)
                                goto error;
                }
-                key = context->user->session_keyring;
+                key = cred->user->session_keyring;
                atomic_inc(&key->usage);
                key_ref = make_key_ref(key, 1);
                break;
@@ -669,7 +587,7 @@ key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
                goto error;
        case KEY_SPEC_REQKEY_AUTH_KEY:
-                key = context->request_key_auth;
+                key = cred->request_key_auth;
                if (!key)
                        goto error;
@@ -677,6 +595,25 @@ key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
                key_ref = make_key_ref(key, 1);
                break;
+        case KEY_SPEC_REQUESTOR_KEYRING:
+                if (!cred->request_key_auth)
+                        goto error;
+                down_read(&cred->request_key_auth->sem);
+                if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
+                        key_ref = ERR_PTR(-EKEYREVOKED);
+                        key = NULL;
+                } else {
+                        rka = cred->request_key_auth->payload.data;
+                        key = rka->dest_keyring;
+                        atomic_inc(&key->usage);
+                }
+                up_read(&cred->request_key_auth->sem);
+                if (!key)
+                        goto error;
+                key_ref = make_key_ref(key, 1);
+                break;
        default:
                key_ref = ERR_PTR(-EINVAL);
                if (id < 1)
@@ -693,7 +630,7 @@ key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
                /* check to see if we possess the key */
                skey_ref = search_process_keyrings(key->type, key,
                                                   lookup_user_key_possessed,
-                                                   current);
+                                                   cred);
                if (!IS_ERR(skey_ref)) {
                        key_put(key);
@@ -725,11 +662,12 @@ key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
                goto invalid_key;
        /* check the permissions */
-        ret = key_task_permission(key_ref, context, perm);
+        ret = key_task_permission(key_ref, cred, perm);
        if (ret < 0)
                goto invalid_key;
 error:
+        put_cred(cred);
        return key_ref;
 invalid_key:
@@ -737,6 +675,12 @@ invalid_key:
        key_ref = ERR_PTR(ret);
        goto error;
+        /* if we attempted to install a keyring, then it may have caused new
+         * creds to be installed */
+reget_creds:
+        put_cred(cred);
+        goto try_again;
 } /* end lookup_user_key() */
 /*****************************************************************************/
@@ -748,20 +692,33 @@ invalid_key:
 */
 long join_session_keyring(const char *name)
 {
-        struct task_struct *tsk = current;
+        const struct cred *old;
+        struct cred *new;
        struct key *keyring;
-        long ret;
+        long ret, serial;
+        /* only permit this if there's a single thread in the thread group -
+         * this avoids us having to adjust the creds on all threads and risking
+         * ENOMEM */
+        if (!is_single_threaded(current))
+                return -EMLINK;
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
        /* if no name is provided, install an anonymous keyring */
        if (!name) {
-                ret = install_session_keyring(tsk, NULL);
+                ret = install_session_keyring_to_cred(new, NULL);
                if (ret < 0)
                        goto error;
-                rcu_read_lock();
+                serial = new->tgcred->session_keyring->serial;
-                ret = rcu_dereference(tsk->signal->session_keyring)->serial;
+                ret = commit_creds(new);
-                rcu_read_unlock();
+                if (ret == 0)
-                goto error;
+                        ret = serial;
+                goto okay;
        }
        /* allow the user to join or create a named keyring */
@@ -771,29 +728,33 @@ long join_session_keyring(const char *name)
        keyring = find_keyring_by_name(name, false);
        if (PTR_ERR(keyring) == -ENOKEY) {
                /* not found - try and create a new one */
-                keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk,
+                keyring = keyring_alloc(name, old->uid, old->gid, old,
                                        KEY_ALLOC_IN_QUOTA, NULL);
                if (IS_ERR(keyring)) {
                        ret = PTR_ERR(keyring);
                        goto error2;
                }
-        }
+        } else if (IS_ERR(keyring)) {
-        else if (IS_ERR(keyring)) {
                ret = PTR_ERR(keyring);
                goto error2;
        }
        /* we've got a keyring - now to install it */
-        ret = install_session_keyring(tsk, keyring);
+        ret = install_session_keyring_to_cred(new, keyring);
        if (ret < 0)
                goto error2;
+        commit_creds(new);
+        mutex_unlock(&key_session_mutex);
        ret = keyring->serial;
        key_put(keyring);
+okay:
+        return ret;
 error2:
        mutex_unlock(&key_session_mutex);
 error:
+        abort_creds(new);
        return ret;
+}
-} /* end join_session_keyring() */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index abea08f87fe2..0e04f72ef2d4 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -19,6 +19,8 @@
 #include <linux/slab.h>
 #include "internal.h"
+#define key_negative_timeout    60      /* default timeout on a negative key's existence */
 /*
 * wait_on_bit() sleep function for uninterruptible waiting
 */
@@ -64,7 +66,7 @@ static int call_sbin_request_key(struct key_construction *cons,
                                 const char *op,
                                 void *aux)
 {
-        struct task_struct *tsk = current;
+        const struct cred *cred = current_cred();
        key_serial_t prkey, sskey;
        struct key *key = cons->key, *authkey = cons->authkey, *keyring;
        char *argv[9], *envp[3], uid_str[12], gid_str[12];
@@ -74,15 +76,17 @@ static int call_sbin_request_key(struct key_construction *cons,
        kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
-        ret = install_user_keyrings(tsk);
+        ret = install_user_keyrings();
        if (ret < 0)
                goto error_alloc;
        /* allocate a new session keyring */
        sprintf(desc, "_req.%u", key->serial);
-        keyring = keyring_alloc(desc, current->fsuid, current->fsgid, current,
+        cred = get_current_cred();
+        keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
+        put_cred(cred);
        if (IS_ERR(keyring)) {
                ret = PTR_ERR(keyring);
                goto error_alloc;
@@ -94,29 +98,24 @@ static int call_sbin_request_key(struct key_construction *cons,
                goto error_link;
        /* record the UID and GID */
-        sprintf(uid_str, "%d", current->fsuid);
+        sprintf(uid_str, "%d", cred->fsuid);
-        sprintf(gid_str, "%d", current->fsgid);
+        sprintf(gid_str, "%d", cred->fsgid);
        /* we say which key is under construction */
        sprintf(key_str, "%d", key->serial);
        /* we specify the process's default keyrings */
        sprintf(keyring_str[0], "%d",
-                tsk->thread_keyring ? tsk->thread_keyring->serial : 0);
+                cred->thread_keyring ? cred->thread_keyring->serial : 0);
        prkey = 0;
-        if (tsk->signal->process_keyring)
+        if (cred->tgcred->process_keyring)
-                prkey = tsk->signal->process_keyring->serial;
+                prkey = cred->tgcred->process_keyring->serial;
-        sprintf(keyring_str[1], "%d", prkey);
-        if (tsk->signal->session_keyring) {
+        if (cred->tgcred->session_keyring)
-                rcu_read_lock();
+                sskey = rcu_dereference(cred->tgcred->session_keyring)->serial;
-                sskey = rcu_dereference(tsk->signal->session_keyring)->serial;
+        else
-                rcu_read_unlock();
+                sskey = cred->user->session_keyring->serial;
-        } else {
-                sskey = tsk->user->session_keyring->serial;
-        }
        sprintf(keyring_str[2], "%d", sskey);
@@ -157,8 +156,8 @@ error_link:
        key_put(keyring);
 error_alloc:
-        kleave(" = %d", ret);
        complete_request_key(cons, ret);
+        kleave(" = %d", ret);
        return ret;
 }
@@ -167,7 +166,8 @@ error_alloc:
 * - we ignore program failure and go on key status instead
 */
 static int construct_key(struct key *key, const void *callout_info,
-                         size_t callout_len, void *aux)
+                         size_t callout_len, void *aux,
+                         struct key *dest_keyring)
 {
        struct key_construction *cons;
        request_key_actor_t actor;
@@ -181,7 +181,8 @@ static int construct_key(struct key *key, const void *callout_info,
                return -ENOMEM;
        /* allocate an authorisation key */
-        authkey = request_key_auth_new(key, callout_info, callout_len);
+        authkey = request_key_auth_new(key, callout_info, callout_len,
+                                       dest_keyring);
        if (IS_ERR(authkey)) {
                kfree(cons);
                ret = PTR_ERR(authkey);
@@ -209,46 +210,67 @@ static int construct_key(struct key *key, const void *callout_info,
 }
 /*
- * link a key to the appropriate destination keyring
+ * get the appropriate destination keyring for the request
- * - the caller must hold a write lock on the destination keyring
+ * - we return whatever keyring we select with an extra reference upon it which
+ *   the caller must release
 */
-static void construct_key_make_link(struct key *key, struct key *dest_keyring)
+static void construct_get_dest_keyring(struct key **_dest_keyring)
 {
-        struct task_struct *tsk = current;
+        struct request_key_auth *rka;
-        struct key *drop = NULL;
+        const struct cred *cred = current_cred();
+        struct key *dest_keyring = *_dest_keyring, *authkey;
-        kenter("{%d},%p", key->serial, dest_keyring);
+        kenter("%p", dest_keyring);
        /* find the appropriate keyring */
-        if (!dest_keyring) {
+        if (dest_keyring) {
-                switch (tsk->jit_keyring) {
+                /* the caller supplied one */
+                key_get(dest_keyring);
+        } else {
+                /* use a default keyring; falling through the cases until we
+                 * find one that we actually have */
+                switch (cred->jit_keyring) {
                case KEY_REQKEY_DEFL_DEFAULT:
+                case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
+                        if (cred->request_key_auth) {
+                                authkey = cred->request_key_auth;
+                                down_read(&authkey->sem);
+                                rka = authkey->payload.data;
+                                if (!test_bit(KEY_FLAG_REVOKED,
+                                              &authkey->flags))
+                                        dest_keyring =
+                                                key_get(rka->dest_keyring);
+                                up_read(&authkey->sem);
+                                if (dest_keyring)
+                                        break;
+                        }
                case KEY_REQKEY_DEFL_THREAD_KEYRING:
-                        dest_keyring = tsk->thread_keyring;
+                        dest_keyring = key_get(cred->thread_keyring);
                        if (dest_keyring)
                                break;
                case KEY_REQKEY_DEFL_PROCESS_KEYRING:
-                        dest_keyring = tsk->signal->process_keyring;
+                        dest_keyring = key_get(cred->tgcred->process_keyring);
                        if (dest_keyring)
                                break;
                case KEY_REQKEY_DEFL_SESSION_KEYRING:
                        rcu_read_lock();
                        dest_keyring = key_get(
-                                rcu_dereference(tsk->signal->session_keyring));
+                                rcu_dereference(cred->tgcred->session_keyring));
                        rcu_read_unlock();
-                        drop = dest_keyring;
                        if (dest_keyring)
                                break;
                case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
-                        dest_keyring = tsk->user->session_keyring;
+                        dest_keyring =
+                                key_get(cred->user->session_keyring);
                        break;
                case KEY_REQKEY_DEFL_USER_KEYRING:
-                        dest_keyring = tsk->user->uid_keyring;
+                        dest_keyring = key_get(cred->user->uid_keyring);
                        break;
                case KEY_REQKEY_DEFL_GROUP_KEYRING:
@@ -257,10 +279,9 @@ static void construct_key_make_link(struct key *key, struct key *dest_keyring)
                }
        }
-        /* and attach the key to it */
+        *_dest_keyring = dest_keyring;
-        __key_link(dest_keyring, key);
+        kleave(" [dk %d]", key_serial(dest_keyring));
-        key_put(drop);
+        return;
-        kleave("");
 }
 /*
@@ -275,6 +296,7 @@ static int construct_alloc_key(struct key_type *type,
                               struct key_user *user,
                               struct key **_key)
 {
+        const struct cred *cred = current_cred();
        struct key *key;
        key_ref_t key_ref;
@@ -282,33 +304,28 @@ static int construct_alloc_key(struct key_type *type,
        mutex_lock(&user->cons_lock);
-        key = key_alloc(type, description,
+        key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
-                        current->fsuid, current->fsgid, current, KEY_POS_ALL,
+                        KEY_POS_ALL, flags);
-                        flags);
        if (IS_ERR(key))
                goto alloc_failed;
        set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
-        if (dest_keyring)
+        down_write(&dest_keyring->sem);
-                down_write(&dest_keyring->sem);
        /* attach the key to the destination keyring under lock, but we do need
         * to do another check just in case someone beat us to it whilst we
         * waited for locks */
        mutex_lock(&key_construction_mutex);
-        key_ref = search_process_keyrings(type, description, type->match,
+        key_ref = search_process_keyrings(type, description, type->match, cred);
-                                          current);
        if (!IS_ERR(key_ref))
                goto key_already_present;
-        if (dest_keyring)
+        __key_link(dest_keyring, key);
-                construct_key_make_link(key, dest_keyring);
        mutex_unlock(&key_construction_mutex);
-        if (dest_keyring)
+        up_write(&dest_keyring->sem);
-                up_write(&dest_keyring->sem);
        mutex_unlock(&user->cons_lock);
        *_key = key;
        kleave(" = 0 [%d]", key_serial(key));
@@ -346,25 +363,36 @@ static struct key *construct_key_and_link(struct key_type *type,
        struct key *key;
        int ret;
-        user = key_user_lookup(current->fsuid);
+        kenter("");
+        user = key_user_lookup(current_fsuid());
        if (!user)
                return ERR_PTR(-ENOMEM);
+        construct_get_dest_keyring(&dest_keyring);
        ret = construct_alloc_key(type, description, dest_keyring, flags, user,
                                  &key);
        key_user_put(user);
        if (ret == 0) {
-                ret = construct_key(key, callout_info, callout_len, aux);
+                ret = construct_key(key, callout_info, callout_len, aux,
-                if (ret < 0)
+                                    dest_keyring);
+                if (ret < 0) {
+                        kdebug("cons failed");
                        goto construction_failed;
+                }
        }
+        key_put(dest_keyring);
+        kleave(" = key %d", key_serial(key));
        return key;
 construction_failed:
        key_negate_and_link(key, key_negative_timeout, NULL, NULL);
        key_put(key);
+        key_put(dest_keyring);
+        kleave(" = %d", ret);
        return ERR_PTR(ret);
 }
@@ -383,6 +411,7 @@ struct key *request_key_and_link(struct key_type *type,
                                 struct key *dest_keyring,
                                 unsigned long flags)
 {
+        const struct cred *cred = current_cred();
        struct key *key;
        key_ref_t key_ref;
@@ -392,7 +421,7 @@ struct key *request_key_and_link(struct key_type *type,
        /* search all the process keyrings for a key */
        key_ref = search_process_keyrings(type, description, type->match,
-                                          current);
+                                          cred);
        if (!IS_ERR(key_ref)) {
                key = key_ref_to_ptr(key_ref);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index bd237b0a6331..86747151ee5b 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -105,9 +105,9 @@ static void request_key_auth_revoke(struct key *key)
        kenter("{%d}", key->serial);
-        if (rka->context) {
+        if (rka->cred) {
-                put_task_struct(rka->context);
+                put_cred(rka->cred);
-                rka->context = NULL;
+                rka->cred = NULL;
        }
 } /* end request_key_auth_revoke() */
@@ -122,12 +122,13 @@ static void request_key_auth_destroy(struct key *key)
        kenter("{%d}", key->serial);
-        if (rka->context) {
+        if (rka->cred) {
-                put_task_struct(rka->context);
+                put_cred(rka->cred);
-                rka->context = NULL;
+                rka->cred = NULL;
        }
        key_put(rka->target_key);
+        key_put(rka->dest_keyring);
        kfree(rka->callout_info);
        kfree(rka);
@@ -139,9 +140,10 @@ static void request_key_auth_destroy(struct key *key)
 * access to the caller's security data
 */
 struct key *request_key_auth_new(struct key *target, const void *callout_info,
-                                 size_t callout_len)
+                                 size_t callout_len, struct key *dest_keyring)
 {
        struct request_key_auth *rka, *irka;
+        const struct cred *cred = current->cred;
        struct key *authkey = NULL;
        char desc[20];
        int ret;
@@ -163,31 +165,29 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
        /* see if the calling process is already servicing the key request of
         * another process */
-        if (current->request_key_auth) {
+        if (cred->request_key_auth) {
                /* it is - use that instantiation context here too */
-                down_read(&current->request_key_auth->sem);
+                down_read(&cred->request_key_auth->sem);
                /* if the auth key has been revoked, then the key we're
                 * servicing is already instantiated */
-                if (test_bit(KEY_FLAG_REVOKED,
+                if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
-                             &current->request_key_auth->flags))
                        goto auth_key_revoked;
-                irka = current->request_key_auth->payload.data;
+                irka = cred->request_key_auth->payload.data;
-                rka->context = irka->context;
+                rka->cred = get_cred(irka->cred);
                rka->pid = irka->pid;
-                get_task_struct(rka->context);
-                up_read(&current->request_key_auth->sem);
+                up_read(&cred->request_key_auth->sem);
        }
        else {
                /* it isn't - use this process as the context */
-                rka->context = current;
+                rka->cred = get_cred(cred);
                rka->pid = current->pid;
-                get_task_struct(rka->context);
        }
        rka->target_key = key_get(target);
+        rka->dest_keyring = key_get(dest_keyring);
        memcpy(rka->callout_info, callout_info, callout_len);
        rka->callout_len = callout_len;
@@ -195,7 +195,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
        sprintf(desc, "%x", target->serial);
        authkey = key_alloc(&key_type_request_key_auth, desc,
-                            current->fsuid, current->fsgid, current,
+                            cred->fsuid, cred->fsgid, cred,
                            KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
                            KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
        if (IS_ERR(authkey)) {
@@ -203,16 +203,16 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                goto error_alloc;
        }
-        /* construct and attach to the keyring */
+        /* construct the auth key */
        ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
        if (ret < 0)
                goto error_inst;
-        kleave(" = {%d}", authkey->serial);
+        kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage));
        return authkey;
 auth_key_revoked:
-        up_read(&current->request_key_auth->sem);
+        up_read(&cred->request_key_auth->sem);
        kfree(rka->callout_info);
        kfree(rka);
        kleave("= -EKEYREVOKED");
@@ -223,6 +223,7 @@ error_inst:
        key_put(authkey);
 error_alloc:
        key_put(rka->target_key);
+        key_put(rka->dest_keyring);
        kfree(rka->callout_info);
        kfree(rka);
        kleave("= %d", ret);
@@ -254,6 +255,7 @@ static int key_get_instantiation_authkey_match(const struct key *key,
 */
 struct key *key_get_instantiation_authkey(key_serial_t target_id)
 {
+        const struct cred *cred = current_cred();
        struct key *authkey;
        key_ref_t authkey_ref;
@@ -261,7 +263,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
                &key_type_request_key_auth,
                (void *) (unsigned long) target_id,
                key_get_instantiation_authkey_match,
-                current);
+                cred);
        if (IS_ERR(authkey_ref)) {
                authkey = ERR_CAST(authkey_ref);
diff --git a/security/root_plug.c b/security/root_plug.c
index c3f68b5b372d..40fb4f15e27b 100644
--- a/security/root_plug.c
+++ b/security/root_plug.c
@@ -55,9 +55,9 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm)
        struct usb_device *dev;
        root_dbg("file %s, e_uid = %d, e_gid = %d\n",
-                 bprm->filename, bprm->e_uid, bprm->e_gid);
+                 bprm->filename, bprm->cred->euid, bprm->cred->egid);
-        if (bprm->e_gid == 0) {
+        if (bprm->cred->egid == 0) {
                dev = usb_find_device(vendor_id, product_id);
                if (!dev) {
                        root_dbg("e_gid = 0, and device not found, "
@@ -75,15 +75,12 @@ static struct security_operations rootplug_security_ops = {
        .ptrace_may_access =            cap_ptrace_may_access,
        .ptrace_traceme =               cap_ptrace_traceme,
        .capget =                       cap_capget,
-        .capset_check =                 cap_capset_check,
+        .capset =                       cap_capset,
-        .capset_set =                   cap_capset_set,
        .capable =                      cap_capable,
-        .bprm_apply_creds =             cap_bprm_apply_creds,
+        .bprm_set_creds =               cap_bprm_set_creds,
-        .bprm_set_security =            cap_bprm_set_security,
-        .task_post_setuid =             cap_task_post_setuid,
+        .task_fix_setuid =              cap_task_fix_setuid,
-        .task_reparent_to_init =        cap_task_reparent_to_init,
        .task_prctl =                   cap_task_prctl,
        .bprm_check_security =          rootplug_bprm_check_security,
diff --git a/security/security.c b/security/security.c
index c0acfa7177e5..038ef04b2c7f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -145,25 +145,23 @@ int security_capget(struct task_struct *target,
        return security_ops->capget(target, effective, inheritable, permitted);
 }
-int security_capset_check(struct task_struct *target,
+int security_capset(struct cred *new, const struct cred *old,
-                           kernel_cap_t *effective,
+                    const kernel_cap_t *effective,
-                           kernel_cap_t *inheritable,
+                    const kernel_cap_t *inheritable,
-                           kernel_cap_t *permitted)
+                    const kernel_cap_t *permitted)
 {
-        return security_ops->capset_check(target, effective, inheritable, permitted);
+        return security_ops->capset(new, old,
+                                    effective, inheritable, permitted);
 }
-void security_capset_set(struct task_struct *target,
+int security_capable(struct task_struct *tsk, int cap)
-                          kernel_cap_t *effective,
-                          kernel_cap_t *inheritable,
-                          kernel_cap_t *permitted)
 {
-        security_ops->capset_set(target, effective, inheritable, permitted);
+        return security_ops->capable(tsk, cap, SECURITY_CAP_AUDIT);
 }
-int security_capable(struct task_struct *tsk, int cap)
+int security_capable_noaudit(struct task_struct *tsk, int cap)
 {
-        return security_ops->capable(tsk, cap);
+        return security_ops->capable(tsk, cap, SECURITY_CAP_NOAUDIT);
 }
 int security_acct(struct file *file)
@@ -215,34 +213,24 @@ int security_vm_enough_memory_kern(long pages)
        return security_ops->vm_enough_memory(current->mm, pages);
 }
-int security_bprm_alloc(struct linux_binprm *bprm)
+int security_bprm_set_creds(struct linux_binprm *bprm)
-{
-        return security_ops->bprm_alloc_security(bprm);
-}
-void security_bprm_free(struct linux_binprm *bprm)
-{
-        security_ops->bprm_free_security(bprm);
-}
-void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
 {
-        security_ops->bprm_apply_creds(bprm, unsafe);
+        return security_ops->bprm_set_creds(bprm);
 }
-void security_bprm_post_apply_creds(struct linux_binprm *bprm)
+int security_bprm_check(struct linux_binprm *bprm)
 {
-        security_ops->bprm_post_apply_creds(bprm);
+        return security_ops->bprm_check_security(bprm);
 }
-int security_bprm_set(struct linux_binprm *bprm)
+void security_bprm_committing_creds(struct linux_binprm *bprm)
 {
-        return security_ops->bprm_set_security(bprm);
+        return security_ops->bprm_committing_creds(bprm);
 }
-int security_bprm_check(struct linux_binprm *bprm)
+void security_bprm_committed_creds(struct linux_binprm *bprm)
 {
-        return security_ops->bprm_check_security(bprm);
+        return security_ops->bprm_committed_creds(bprm);
 }
 int security_bprm_secureexec(struct linux_binprm *bprm)
@@ -603,9 +591,9 @@ int security_file_receive(struct file *file)
        return security_ops->file_receive(file);
 }
-int security_dentry_open(struct file *file)
+int security_dentry_open(struct file *file, const struct cred *cred)
 {
-        return security_ops->dentry_open(file);
+        return security_ops->dentry_open(file, cred);
 }
 int security_task_create(unsigned long clone_flags)
@@ -613,14 +601,29 @@ int security_task_create(unsigned long clone_flags)
        return security_ops->task_create(clone_flags);
 }
-int security_task_alloc(struct task_struct *p)
+void security_cred_free(struct cred *cred)
 {
-        return security_ops->task_alloc_security(p);
+        security_ops->cred_free(cred);
 }
-void security_task_free(struct task_struct *p)
+int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp)
 {
-        security_ops->task_free_security(p);
+        return security_ops->cred_prepare(new, old, gfp);
+}
+void security_commit_creds(struct cred *new, const struct cred *old)
+{
+        return security_ops->cred_commit(new, old);
+}
+int security_kernel_act_as(struct cred *new, u32 secid)
+{
+        return security_ops->kernel_act_as(new, secid);
+}
+int security_kernel_create_files_as(struct cred *new, struct inode *inode)
+{
+        return security_ops->kernel_create_files_as(new, inode);
 }
 int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
@@ -628,10 +631,10 @@ int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
        return security_ops->task_setuid(id0, id1, id2, flags);
 }
-int security_task_post_setuid(uid_t old_ruid, uid_t old_euid,
+int security_task_fix_setuid(struct cred *new, const struct cred *old,
-                               uid_t old_suid, int flags)
+                             int flags)
 {
-        return security_ops->task_post_setuid(old_ruid, old_euid, old_suid, flags);
+        return security_ops->task_fix_setuid(new, old, flags);
 }
 int security_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
@@ -713,14 +716,9 @@ int security_task_wait(struct task_struct *p)
 }
 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-                         unsigned long arg4, unsigned long arg5, long *rc_p)
+                         unsigned long arg4, unsigned long arg5)
-{
-        return security_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
-}
-void security_task_reparent_to_init(struct task_struct *p)
 {
-        security_ops->task_reparent_to_init(p);
+        return security_ops->task_prctl(option, arg2, arg3, arg4, arg5);
 }
 void security_task_to_inode(struct task_struct *p, struct inode *inode)
@@ -1120,9 +1118,10 @@ EXPORT_SYMBOL(security_skb_classify_flow);
 #ifdef CONFIG_KEYS
-int security_key_alloc(struct key *key, struct task_struct *tsk, unsigned long flags)
+int security_key_alloc(struct key *key, const struct cred *cred,
+                       unsigned long flags)
 {
-        return security_ops->key_alloc(key, tsk, flags);
+        return security_ops->key_alloc(key, cred, flags);
 }
 void security_key_free(struct key *key)
@@ -1131,9 +1130,9 @@ void security_key_free(struct key *key)
 }
 int security_key_permission(key_ref_t key_ref,
-                            struct task_struct *context, key_perm_t perm)
+                            const struct cred *cred, key_perm_t perm)
 {
-        return security_ops->key_permission(key_ref, context, perm);
+        return security_ops->key_permission(key_ref, cred, perm);
 }
 int security_key_getsecurity(struct key *key, char **_buffer)
diff --git a/security/selinux/exports.c b/security/selinux/exports.c
index 64af2d3409ef..c73aeaa008e8 100644
--- a/security/selinux/exports.c
+++ b/security/selinux/exports.c
@@ -39,9 +39,13 @@ EXPORT_SYMBOL_GPL(selinux_string_to_sid);
 int selinux_secmark_relabel_packet_permission(u32 sid)
 {
        if (selinux_enabled) {
-                struct task_security_struct *tsec = current->security;
+                const struct task_security_struct *__tsec;
+                u32 tsid;
-                return avc_has_perm(tsec->sid, sid, SECCLASS_PACKET,
+                __tsec = current_security();
+                tsid = __tsec->sid;
+                return avc_has_perm(tsid, sid, SECCLASS_PACKET,
                                    PACKET__RELABELTO, NULL);
        }
        return 0;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f85597a4d733..520f82ab3fbf 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -156,33 +156,62 @@ static int selinux_secmark_enabled(void)
        return (atomic_read(&selinux_secmark_refcount) > 0);
 }
-/* Allocate and free functions for each kind of security blob. */
+/*
+ * initialise the security for the init task
-static int task_alloc_security(struct task_struct *task)
+ */
+static void cred_init_security(void)
 {
+        struct cred *cred = (struct cred *) current->real_cred;
        struct task_security_struct *tsec;
        tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
        if (!tsec)
-                return -ENOMEM;
+                panic("SELinux:  Failed to initialize initial task.\n");
-        tsec->osid = tsec->sid = SECINITSID_UNLABELED;
+        tsec->osid = tsec->sid = SECINITSID_KERNEL;
-        task->security = tsec;
+        cred->security = tsec;
+}
-        return 0;
+/*
+ * get the security ID of a set of credentials
+ */
+static inline u32 cred_sid(const struct cred *cred)
+{
+        const struct task_security_struct *tsec;
+        tsec = cred->security;
+        return tsec->sid;
 }
-static void task_free_security(struct task_struct *task)
+/*
+ * get the objective security ID of a task
+ */
+static inline u32 task_sid(const struct task_struct *task)
 {
-        struct task_security_struct *tsec = task->security;
+        u32 sid;
-        task->security = NULL;
-        kfree(tsec);
+        rcu_read_lock();
+        sid = cred_sid(__task_cred(task));
+        rcu_read_unlock();
+        return sid;
 }
+/*
+ * get the subjective security ID of the current task
+ */
+static inline u32 current_sid(void)
+{
+        const struct task_security_struct *tsec = current_cred()->security;
+        return tsec->sid;
+}
+/* Allocate and free functions for each kind of security blob. */
 static int inode_alloc_security(struct inode *inode)
 {
-        struct task_security_struct *tsec = current->security;
        struct inode_security_struct *isec;
+        u32 sid = current_sid();
        isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
        if (!isec)
@@ -193,7 +222,7 @@ static int inode_alloc_security(struct inode *inode)
        isec->inode = inode;
        isec->sid = SECINITSID_UNLABELED;
        isec->sclass = SECCLASS_FILE;
-        isec->task_sid = tsec->sid;
+        isec->task_sid = sid;
        inode->i_security = isec;
        return 0;
@@ -215,15 +244,15 @@ static void inode_free_security(struct inode *inode)
 static int file_alloc_security(struct file *file)
 {
-        struct task_security_struct *tsec = current->security;
        struct file_security_struct *fsec;
+        u32 sid = current_sid();
        fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
        if (!fsec)
                return -ENOMEM;
-        fsec->sid = tsec->sid;
+        fsec->sid = sid;
-        fsec->fown_sid = tsec->sid;
+        fsec->fown_sid = sid;
        file->f_security = fsec;
        return 0;
@@ -338,8 +367,9 @@ static const match_table_t tokens = {
 static int may_context_mount_sb_relabel(u32 sid,
                        struct superblock_security_struct *sbsec,
-                        struct task_security_struct *tsec)
+                        const struct cred *cred)
 {
+        const struct task_security_struct *tsec = cred->security;
        int rc;
        rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
@@ -354,8 +384,9 @@ static int may_context_mount_sb_relabel(u32 sid,
 static int may_context_mount_inode_relabel(u32 sid,
                        struct superblock_security_struct *sbsec,
-                        struct task_security_struct *tsec)
+                        const struct cred *cred)
 {
+        const struct task_security_struct *tsec = cred->security;
        int rc;
        rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
                          FILESYSTEM__RELABELFROM, NULL);
@@ -553,8 +584,8 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
 static int selinux_set_mnt_opts(struct super_block *sb,
                                struct security_mnt_opts *opts)
 {
+        const struct cred *cred = current_cred();
        int rc = 0, i;
-        struct task_security_struct *tsec = current->security;
        struct superblock_security_struct *sbsec = sb->s_security;
        const char *name = sb->s_type->name;
        struct inode *inode = sbsec->sb->s_root->d_inode;
@@ -680,8 +711,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
        /* sets the context of the superblock for the fs being mounted. */
        if (fscontext_sid) {
+                rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
-                rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
                if (rc)
                        goto out;
@@ -695,12 +725,14 @@ static int selinux_set_mnt_opts(struct super_block *sb,
         */
        if (context_sid) {
                if (!fscontext_sid) {
-                        rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
+                        rc = may_context_mount_sb_relabel(context_sid, sbsec,
+                                                          cred);
                        if (rc)
                                goto out;
                        sbsec->sid = context_sid;
                } else {
-                        rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
+                        rc = may_context_mount_inode_relabel(context_sid, sbsec,
+                                                             cred);
                        if (rc)
                                goto out;
                }
@@ -712,7 +744,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
        }
        if (rootcontext_sid) {
-                rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
+                rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
+                                                     cred);
                if (rc)
                        goto out;
@@ -730,7 +763,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
                if (defcontext_sid != sbsec->def_sid) {
                        rc = may_context_mount_inode_relabel(defcontext_sid,
-                                                             sbsec, tsec);
+                                                             sbsec, cred);
                        if (rc)
                                goto out;
                }
@@ -1345,18 +1378,53 @@ static inline u32 signal_to_av(int sig)
        return perm;
 }
-/* Check permission betweeen a pair of tasks, e.g. signal checks,
+/*
-   fork check, ptrace check, etc. */
+ * Check permission between a pair of credentials
-static int task_has_perm(struct task_struct *tsk1,
+ * fork check, ptrace check, etc.
-                         struct task_struct *tsk2,
+ */
+static int cred_has_perm(const struct cred *actor,
+                         const struct cred *target,
+                         u32 perms)
+{
+        u32 asid = cred_sid(actor), tsid = cred_sid(target);
+        return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
+}
+/*
+ * Check permission between a pair of tasks, e.g. signal checks,
+ * fork check, ptrace check, etc.
+ * tsk1 is the actor and tsk2 is the target
+ * - this uses the default subjective creds of tsk1
+ */
+static int task_has_perm(const struct task_struct *tsk1,
+                         const struct task_struct *tsk2,
                         u32 perms)
 {
-        struct task_security_struct *tsec1, *tsec2;
+        const struct task_security_struct *__tsec1, *__tsec2;
+        u32 sid1, sid2;
-        tsec1 = tsk1->security;
+        rcu_read_lock();
-        tsec2 = tsk2->security;
+        __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
-        return avc_has_perm(tsec1->sid, tsec2->sid,
+        __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
-                            SECCLASS_PROCESS, perms, NULL);
+        rcu_read_unlock();
+        return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
+}
+/*
+ * Check permission between current and another task, e.g. signal checks,
+ * fork check, ptrace check, etc.
+ * current is the actor and tsk2 is the target
+ * - this uses current's subjective creds
+ */
+static int current_has_perm(const struct task_struct *tsk,
+                            u32 perms)
+{
+        u32 sid, tsid;
+        sid = current_sid();
+        tsid = task_sid(tsk);
+        return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
 }
 #if CAP_LAST_CAP > 63
@@ -1365,14 +1433,14 @@ static int task_has_perm(struct task_struct *tsk1,
 /* Check whether a task is allowed to use a capability. */
 static int task_has_capability(struct task_struct *tsk,
-                               int cap)
+                               int cap, int audit)
 {
-        struct task_security_struct *tsec;
        struct avc_audit_data ad;
+        struct av_decision avd;
        u16 sclass;
+        u32 sid = task_sid(tsk);
        u32 av = CAP_TO_MASK(cap);
+        int rc;
-        tsec = tsk->security;
        AVC_AUDIT_DATA_INIT(&ad, CAP);
        ad.tsk = tsk;
@@ -1390,37 +1458,39 @@ static int task_has_capability(struct task_struct *tsk,
                       "SELinux:  out of range capability %d\n", cap);
                BUG();
        }
-        return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
+        rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
+        if (audit == SECURITY_CAP_AUDIT)
+                avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
+        return rc;
 }
 /* Check whether a task is allowed to use a system operation. */
 static int task_has_system(struct task_struct *tsk,
                           u32 perms)
 {
-        struct task_security_struct *tsec;
+        u32 sid = task_sid(tsk);
-        tsec = tsk->security;
+        return avc_has_perm(sid, SECINITSID_KERNEL,
-        return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
                            SECCLASS_SYSTEM, perms, NULL);
 }
 /* Check whether a task has a particular permission to an inode.
   The 'adp' parameter is optional and allows other audit
   data to be passed (e.g. the dentry). */
-static int inode_has_perm(struct task_struct *tsk,
+static int inode_has_perm(const struct cred *cred,
                          struct inode *inode,
                          u32 perms,
                          struct avc_audit_data *adp)
 {
-        struct task_security_struct *tsec;
        struct inode_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid;
        if (unlikely(IS_PRIVATE(inode)))
                return 0;
-        tsec = tsk->security;
+        sid = cred_sid(cred);
        isec = inode->i_security;
        if (!adp) {
@@ -1429,23 +1499,24 @@ static int inode_has_perm(struct task_struct *tsk,
                ad.u.fs.inode = inode;
        }
-        return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
+        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
 }
 /* Same as inode_has_perm, but pass explicit audit data containing
   the dentry to help the auditing code to more easily generate the
   pathname if needed. */
-static inline int dentry_has_perm(struct task_struct *tsk,
+static inline int dentry_has_perm(const struct cred *cred,
                                  struct vfsmount *mnt,
                                  struct dentry *dentry,
                                  u32 av)
 {
        struct inode *inode = dentry->d_inode;
        struct avc_audit_data ad;
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.mnt = mnt;
        ad.u.fs.path.dentry = dentry;
-        return inode_has_perm(tsk, inode, av, &ad);
+        return inode_has_perm(cred, inode, av, &ad);
 }
 /* Check whether a task can use an open file descriptor to
@@ -1456,33 +1527,35 @@ static inline int dentry_has_perm(struct task_struct *tsk,
   has the same SID as the process.  If av is zero, then
   access to the file is not checked, e.g. for cases
   where only the descriptor is affected like seek. */
-static int file_has_perm(struct task_struct *tsk,
+static int file_has_perm(const struct cred *cred,
-                                struct file *file,
+                         struct file *file,
-                                u32 av)
+                         u32 av)
 {
-        struct task_security_struct *tsec = tsk->security;
        struct file_security_struct *fsec = file->f_security;
        struct inode *inode = file->f_path.dentry->d_inode;
        struct avc_audit_data ad;
+        u32 sid = cred_sid(cred);
        int rc;
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path = file->f_path;
-        if (tsec->sid != fsec->sid) {
+        if (sid != fsec->sid) {
-                rc = avc_has_perm(tsec->sid, fsec->sid,
+                rc = avc_has_perm(sid, fsec->sid,
                                  SECCLASS_FD,
                                  FD__USE,
                                  &ad);
                if (rc)
-                        return rc;
+                        goto out;
        }
        /* av is zero if only checking access to the descriptor. */
+        rc = 0;
        if (av)
-                return inode_has_perm(tsk, inode, av, &ad);
+                rc = inode_has_perm(cred, inode, av, &ad);
-        return 0;
+out:
+        return rc;
 }
 /* Check whether a task can create a file. */
@@ -1490,36 +1563,36 @@ static int may_create(struct inode *dir,
                      struct dentry *dentry,
                      u16 tclass)
 {
-        struct task_security_struct *tsec;
+        const struct cred *cred = current_cred();
+        const struct task_security_struct *tsec = cred->security;
        struct inode_security_struct *dsec;
        struct superblock_security_struct *sbsec;
-        u32 newsid;
+        u32 sid, newsid;
        struct avc_audit_data ad;
        int rc;
-        tsec = current->security;
        dsec = dir->i_security;
        sbsec = dir->i_sb->s_security;
+        sid = tsec->sid;
+        newsid = tsec->create_sid;
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.dentry = dentry;
-        rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
+        rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
                          DIR__ADD_NAME | DIR__SEARCH,
                          &ad);
        if (rc)
                return rc;
-        if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
+        if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) {
-                newsid = tsec->create_sid;
+                rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
-        } else {
-                rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
-                                             &newsid);
                if (rc)
                        return rc;
        }
-        rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
+        rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
        if (rc)
                return rc;
@@ -1532,11 +1605,9 @@ static int may_create(struct inode *dir,
 static int may_create_key(u32 ksid,
                          struct task_struct *ctx)
 {
-        struct task_security_struct *tsec;
+        u32 sid = task_sid(ctx);
-        tsec = ctx->security;
+        return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
-        return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
 }
 #define MAY_LINK        0
@@ -1549,13 +1620,12 @@ static int may_link(struct inode *dir,
                    int kind)
 {
-        struct task_security_struct *tsec;
        struct inode_security_struct *dsec, *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
        u32 av;
        int rc;
-        tsec = current->security;
        dsec = dir->i_security;
        isec = dentry->d_inode->i_security;
@@ -1564,7 +1634,7 @@ static int may_link(struct inode *dir,
        av = DIR__SEARCH;
        av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
-        rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
+        rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
        if (rc)
                return rc;
@@ -1584,7 +1654,7 @@ static int may_link(struct inode *dir,
                return 0;
        }
-        rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
+        rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
        return rc;
 }
@@ -1593,14 +1663,13 @@ static inline int may_rename(struct inode *old_dir,
                             struct inode *new_dir,
                             struct dentry *new_dentry)
 {
-        struct task_security_struct *tsec;
        struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
        u32 av;
        int old_is_dir, new_is_dir;
        int rc;
-        tsec = current->security;
        old_dsec = old_dir->i_security;
        old_isec = old_dentry->d_inode->i_security;
        old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
@@ -1609,16 +1678,16 @@ static inline int may_rename(struct inode *old_dir,
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.dentry = old_dentry;
-        rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
+        rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
                          DIR__REMOVE_NAME | DIR__SEARCH, &ad);
        if (rc)
                return rc;
-        rc = avc_has_perm(tsec->sid, old_isec->sid,
+        rc = avc_has_perm(sid, old_isec->sid,
                          old_isec->sclass, FILE__RENAME, &ad);
        if (rc)
                return rc;
        if (old_is_dir && new_dir != old_dir) {
-                rc = avc_has_perm(tsec->sid, old_isec->sid,
+                rc = avc_has_perm(sid, old_isec->sid,
                                  old_isec->sclass, DIR__REPARENT, &ad);
                if (rc)
                        return rc;
@@ -1628,13 +1697,13 @@ static inline int may_rename(struct inode *old_dir,
        av = DIR__ADD_NAME | DIR__SEARCH;
        if (new_dentry->d_inode)
                av |= DIR__REMOVE_NAME;
-        rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
+        rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
        if (rc)
                return rc;
        if (new_dentry->d_inode) {
                new_isec = new_dentry->d_inode->i_security;
                new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
-                rc = avc_has_perm(tsec->sid, new_isec->sid,
+                rc = avc_has_perm(sid, new_isec->sid,
                                  new_isec->sclass,
                                  (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
                if (rc)
@@ -1645,18 +1714,16 @@ static inline int may_rename(struct inode *old_dir,
 }
 /* Check whether a task can perform a filesystem operation. */
-static int superblock_has_perm(struct task_struct *tsk,
+static int superblock_has_perm(const struct cred *cred,
                               struct super_block *sb,
                               u32 perms,
                               struct avc_audit_data *ad)
 {
-        struct task_security_struct *tsec;
        struct superblock_security_struct *sbsec;
+        u32 sid = cred_sid(cred);
-        tsec = tsk->security;
        sbsec = sb->s_security;
-        return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
+        return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
-                            perms, ad);
 }
 /* Convert a Linux mode and permission mask to an access vector. */
@@ -1687,15 +1754,39 @@ static inline u32 file_mask_to_av(int mode, int mask)
        return av;
 }
+/* Convert a Linux file to an access vector. */
+static inline u32 file_to_av(struct file *file)
+{
+        u32 av = 0;
+        if (file->f_mode & FMODE_READ)
+                av |= FILE__READ;
+        if (file->f_mode & FMODE_WRITE) {
+                if (file->f_flags & O_APPEND)
+                        av |= FILE__APPEND;
+                else
+                        av |= FILE__WRITE;
+        }
+        if (!av) {
+                /*
+                 * Special file opened with flags 3 for ioctl-only use.
+                 */
+                av = FILE__IOCTL;
+        }
+        return av;
+}
 /*
- * Convert a file mask to an access vector and include the correct open
+ * Convert a file to an access vector and include the correct open
 * open permission.
 */
-static inline u32 open_file_mask_to_av(int mode, int mask)
+static inline u32 open_file_to_av(struct file *file)
 {
-        u32 av = file_mask_to_av(mode, mask);
+        u32 av = file_to_av(file);
        if (selinux_policycap_openperm) {
+                mode_t mode = file->f_path.dentry->d_inode->i_mode;
                /*
                 * lnk files and socks do not really have an 'open'
                 */
@@ -1711,34 +1802,11 @@ static inline u32 open_file_mask_to_av(int mode, int mask)
                        av |= DIR__OPEN;
                else
                        printk(KERN_ERR "SELinux: WARNING: inside %s with "
-                                "unknown mode:%x\n", __func__, mode);
+                                "unknown mode:%o\n", __func__, mode);
        }
        return av;
 }
-/* Convert a Linux file to an access vector. */
-static inline u32 file_to_av(struct file *file)
-{
-        u32 av = 0;
-        if (file->f_mode & FMODE_READ)
-                av |= FILE__READ;
-        if (file->f_mode & FMODE_WRITE) {
-                if (file->f_flags & O_APPEND)
-                        av |= FILE__APPEND;
-                else
-                        av |= FILE__WRITE;
-        }
-        if (!av) {
-                /*
-                 * Special file opened with flags 3 for ioctl-only use.
-                 */
-                av = FILE__IOCTL;
-        }
-        return av;
-}
 /* Hook functions begin here. */
 static int selinux_ptrace_may_access(struct task_struct *child,
@@ -1751,13 +1819,12 @@ static int selinux_ptrace_may_access(struct task_struct *child,
                return rc;
        if (mode == PTRACE_MODE_READ) {
-                struct task_security_struct *tsec = current->security;
+                u32 sid = current_sid();
-                struct task_security_struct *csec = child->security;
+                u32 csid = task_sid(child);
-                return avc_has_perm(tsec->sid, csec->sid,
+                return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
-                                    SECCLASS_FILE, FILE__READ, NULL);
        }
-        return task_has_perm(current, child, PROCESS__PTRACE);
+        return current_has_perm(child, PROCESS__PTRACE);
 }
 static int selinux_ptrace_traceme(struct task_struct *parent)
@@ -1776,40 +1843,37 @@ static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
 {
        int error;
-        error = task_has_perm(current, target, PROCESS__GETCAP);
+        error = current_has_perm(target, PROCESS__GETCAP);
        if (error)
                return error;
        return secondary_ops->capget(target, effective, inheritable, permitted);
 }
-static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
+static int selinux_capset(struct cred *new, const struct cred *old,
-                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
+                          const kernel_cap_t *effective,
+                          const kernel_cap_t *inheritable,
+                          const kernel_cap_t *permitted)
 {
        int error;
-        error = secondary_ops->capset_check(target, effective, inheritable, permitted);
+        error = secondary_ops->capset(new, old,
+                                      effective, inheritable, permitted);
        if (error)
                return error;
-        return task_has_perm(current, target, PROCESS__SETCAP);
+        return cred_has_perm(old, new, PROCESS__SETCAP);
 }
-static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
+static int selinux_capable(struct task_struct *tsk, int cap, int audit)
-                               kernel_cap_t *inheritable, kernel_cap_t *permitted)
-{
-        secondary_ops->capset_set(target, effective, inheritable, permitted);
-}
-static int selinux_capable(struct task_struct *tsk, int cap)
 {
        int rc;
-        rc = secondary_ops->capable(tsk, cap);
+        rc = secondary_ops->capable(tsk, cap, audit);
        if (rc)
                return rc;
-        return task_has_capability(tsk, cap);
+        return task_has_capability(tsk, cap, audit);
 }
 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
@@ -1857,15 +1921,14 @@ static int selinux_sysctl(ctl_table *table, int op)
 {
        int error = 0;
        u32 av;
-        struct task_security_struct *tsec;
+        u32 tsid, sid;
-        u32 tsid;
        int rc;
        rc = secondary_ops->sysctl(table, op);
        if (rc)
                return rc;
-        tsec = current->security;
+        sid = current_sid();
        rc = selinux_sysctl_get_sid(table, (op == 0001) ?
                                    SECCLASS_DIR : SECCLASS_FILE, &tsid);
@@ -1877,7 +1940,7 @@ static int selinux_sysctl(ctl_table *table, int op)
        /* The op values are "defined" in sysctl.c, thereby creating
         * a bad coupling between this module and sysctl.c */
        if (op == 001) {
-                error = avc_has_perm(tsec->sid, tsid,
+                error = avc_has_perm(sid, tsid,
                                     SECCLASS_DIR, DIR__SEARCH, NULL);
        } else {
                av = 0;
@@ -1886,7 +1949,7 @@ static int selinux_sysctl(ctl_table *table, int op)
                if (op & 002)
                        av |= FILE__WRITE;
                if (av)
-                        error = avc_has_perm(tsec->sid, tsid,
+                        error = avc_has_perm(sid, tsid,
                                             SECCLASS_FILE, av, NULL);
        }
@@ -1895,6 +1958,7 @@ static int selinux_sysctl(ctl_table *table, int op)
 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
 {
+        const struct cred *cred = current_cred();
        int rc = 0;
        if (!sb)
@@ -1906,14 +1970,12 @@ static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
        case Q_QUOTAOFF:
        case Q_SETINFO:
        case Q_SETQUOTA:
-                rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
+                rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
-                                         NULL);
                break;
        case Q_GETFMT:
        case Q_GETINFO:
        case Q_GETQUOTA:
-                rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
+                rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
-                                         NULL);
                break;
        default:
                rc = 0;  /* let the kernel handle invalid cmds */
@@ -1924,7 +1986,9 @@ static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
 static int selinux_quota_on(struct dentry *dentry)
 {
-        return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
+        const struct cred *cred = current_cred();
+        return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
 }
 static int selinux_syslog(int type)
@@ -1972,16 +2036,8 @@ static int selinux_syslog(int type)
 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
        int rc, cap_sys_admin = 0;
-        struct task_security_struct *tsec = current->security;
-        rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
-        if (rc == 0)
-                rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
-                                          SECCLASS_CAPABILITY,
-                                          CAP_TO_MASK(CAP_SYS_ADMIN),
-                                          0,
-                                          NULL);
+        rc = selinux_capable(current, CAP_SYS_ADMIN, SECURITY_CAP_NOAUDIT);
        if (rc == 0)
                cap_sys_admin = 1;
@@ -1990,59 +2046,45 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 /* binprm security operations */
-static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
+static int selinux_bprm_set_creds(struct linux_binprm *bprm)
-{
-        struct bprm_security_struct *bsec;
-        bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
-        if (!bsec)
-                return -ENOMEM;
-        bsec->sid = SECINITSID_UNLABELED;
-        bsec->set = 0;
-        bprm->security = bsec;
-        return 0;
-}
-static int selinux_bprm_set_security(struct linux_binprm *bprm)
 {
-        struct task_security_struct *tsec;
+        const struct task_security_struct *old_tsec;
-        struct inode *inode = bprm->file->f_path.dentry->d_inode;
+        struct task_security_struct *new_tsec;
        struct inode_security_struct *isec;
-        struct bprm_security_struct *bsec;
-        u32 newsid;
        struct avc_audit_data ad;
+        struct inode *inode = bprm->file->f_path.dentry->d_inode;
        int rc;
-        rc = secondary_ops->bprm_set_security(bprm);
+        rc = secondary_ops->bprm_set_creds(bprm);
        if (rc)
                return rc;
-        bsec = bprm->security;
+        /* SELinux context only depends on initial program or script and not
+         * the script interpreter */
-        if (bsec->set)
+        if (bprm->cred_prepared)
                return 0;
-        tsec = current->security;
+        old_tsec = current_security();
+        new_tsec = bprm->cred->security;
        isec = inode->i_security;
        /* Default to the current task SID. */
-        bsec->sid = tsec->sid;
+        new_tsec->sid = old_tsec->sid;
+        new_tsec->osid = old_tsec->sid;
        /* Reset fs, key, and sock SIDs on execve. */
-        tsec->create_sid = 0;
+        new_tsec->create_sid = 0;
-        tsec->keycreate_sid = 0;
+        new_tsec->keycreate_sid = 0;
-        tsec->sockcreate_sid = 0;
+        new_tsec->sockcreate_sid = 0;
-        if (tsec->exec_sid) {
+        if (old_tsec->exec_sid) {
-                newsid = tsec->exec_sid;
+                new_tsec->sid = old_tsec->exec_sid;
                /* Reset exec SID on execve. */
-                tsec->exec_sid = 0;
+                new_tsec->exec_sid = 0;
        } else {
                /* Check for a default transition on this program. */
-                rc = security_transition_sid(tsec->sid, isec->sid,
+                rc = security_transition_sid(old_tsec->sid, isec->sid,
-                                             SECCLASS_PROCESS, &newsid);
+                                             SECCLASS_PROCESS, &new_tsec->sid);
                if (rc)
                        return rc;
        }
@@ -2051,33 +2093,63 @@ static int selinux_bprm_set_security(struct linux_binprm *bprm)
        ad.u.fs.path = bprm->file->f_path;
        if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
-                newsid = tsec->sid;
+                new_tsec->sid = old_tsec->sid;
-        if (tsec->sid == newsid) {
+        if (new_tsec->sid == old_tsec->sid) {
-                rc = avc_has_perm(tsec->sid, isec->sid,
+                rc = avc_has_perm(old_tsec->sid, isec->sid,
                                  SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
                if (rc)
                        return rc;
        } else {
                /* Check permissions for the transition. */
-                rc = avc_has_perm(tsec->sid, newsid,
+                rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
                                  SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
                if (rc)
                        return rc;
-                rc = avc_has_perm(newsid, isec->sid,
+                rc = avc_has_perm(new_tsec->sid, isec->sid,
                                  SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
                if (rc)
                        return rc;
-                /* Clear any possibly unsafe personality bits on exec: */
+                /* Check for shared state */
-                current->personality &= ~PER_CLEAR_ON_SETID;
+                if (bprm->unsafe & LSM_UNSAFE_SHARE) {
+                        rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
+                                          SECCLASS_PROCESS, PROCESS__SHARE,
+                                          NULL);
+                        if (rc)
+                                return -EPERM;
+                }
+                /* Make sure that anyone attempting to ptrace over a task that
+                 * changes its SID has the appropriate permit */
+                if (bprm->unsafe &
+                    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
+                        struct task_struct *tracer;
+                        struct task_security_struct *sec;
+                        u32 ptsid = 0;
+                        rcu_read_lock();
+                        tracer = tracehook_tracer_task(current);
+                        if (likely(tracer != NULL)) {
+                                sec = __task_cred(tracer)->security;
+                                ptsid = sec->sid;
+                        }
+                        rcu_read_unlock();
-                /* Set the security field to the new SID. */
+                        if (ptsid != 0) {
-                bsec->sid = newsid;
+                                rc = avc_has_perm(ptsid, new_tsec->sid,
+                                                  SECCLASS_PROCESS,
+                                                  PROCESS__PTRACE, NULL);
+                                if (rc)
+                                        return -EPERM;
+                        }
+                }
+                /* Clear any possibly unsafe personality bits on exec: */
+                bprm->per_clear |= PER_CLEAR_ON_SETID;
        }
-        bsec->set = 1;
        return 0;
 }
@@ -2086,35 +2158,34 @@ static int selinux_bprm_check_security(struct linux_binprm *bprm)
        return secondary_ops->bprm_check_security(bprm);
 }
 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
 {
-        struct task_security_struct *tsec = current->security;
+        const struct cred *cred = current_cred();
+        const struct task_security_struct *tsec = cred->security;
+        u32 sid, osid;
        int atsecure = 0;
-        if (tsec->osid != tsec->sid) {
+        sid = tsec->sid;
+        osid = tsec->osid;
+        if (osid != sid) {
                /* Enable secure mode for SIDs transitions unless
                   the noatsecure permission is granted between
                   the two SIDs, i.e. ahp returns 0. */
-                atsecure = avc_has_perm(tsec->osid, tsec->sid,
+                atsecure = avc_has_perm(osid, sid,
-                                         SECCLASS_PROCESS,
+                                        SECCLASS_PROCESS,
-                                         PROCESS__NOATSECURE, NULL);
+                                        PROCESS__NOATSECURE, NULL);
        }
        return (atsecure || secondary_ops->bprm_secureexec(bprm));
 }
-static void selinux_bprm_free_security(struct linux_binprm *bprm)
-{
-        kfree(bprm->security);
-        bprm->security = NULL;
-}
 extern struct vfsmount *selinuxfs_mount;
 extern struct dentry *selinux_null;
 /* Derived from fs/exec.c:flush_old_files. */
-static inline void flush_unauthorized_files(struct files_struct *files)
+static inline void flush_unauthorized_files(const struct cred *cred,
+                                            struct files_struct *files)
 {
        struct avc_audit_data ad;
        struct file *file, *devnull = NULL;
@@ -2136,7 +2207,7 @@ static inline void flush_unauthorized_files(struct files_struct *files)
                           interested in the inode-based check here. */
                        file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
                        inode = file->f_path.dentry->d_inode;
-                        if (inode_has_perm(current, inode,
+                        if (inode_has_perm(cred, inode,
                                           FILE__READ | FILE__WRITE, NULL)) {
                                drop_tty = 1;
                        }
@@ -2171,7 +2242,7 @@ static inline void flush_unauthorized_files(struct files_struct *files)
                                file = fget(i);
                                if (!file)
                                        continue;
-                                if (file_has_perm(current,
+                                if (file_has_perm(cred,
                                                  file,
                                                  file_to_av(file))) {
                                        sys_close(i);
@@ -2185,7 +2256,10 @@ static inline void flush_unauthorized_files(struct files_struct *files)
                                        if (devnull) {
                                                get_file(devnull);
                                        } else {
-                                                devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
+                                                devnull = dentry_open(
+                                                        dget(selinux_null),
+                                                        mntget(selinuxfs_mount),
+                                                        O_RDWR, cred);
                                                if (IS_ERR(devnull)) {
                                                        devnull = NULL;
                                                        put_unused_fd(fd);
@@ -2204,94 +2278,78 @@ static inline void flush_unauthorized_files(struct files_struct *files)
        spin_unlock(&files->file_lock);
 }
-static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
+/*
+ * Prepare a process for imminent new credential changes due to exec
+ */
+static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
 {
-        struct task_security_struct *tsec;
+        struct task_security_struct *new_tsec;
-        struct bprm_security_struct *bsec;
+        struct rlimit *rlim, *initrlim;
-        u32 sid;
+        int rc, i;
-        int rc;
-        secondary_ops->bprm_apply_creds(bprm, unsafe);
-        tsec = current->security;
-        bsec = bprm->security;
+        secondary_ops->bprm_committing_creds(bprm);
-        sid = bsec->sid;
-        tsec->osid = tsec->sid;
+        new_tsec = bprm->cred->security;
-        bsec->unsafe = 0;
+        if (new_tsec->sid == new_tsec->osid)
-        if (tsec->sid != sid) {
+                return;
-                /* Check for shared state.  If not ok, leave SID
-                   unchanged and kill. */
-                if (unsafe & LSM_UNSAFE_SHARE) {
-                        rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
-                                        PROCESS__SHARE, NULL);
-                        if (rc) {
-                                bsec->unsafe = 1;
-                                return;
-                        }
-                }
-                /* Check for ptracing, and update the task SID if ok.
+        /* Close files for which the new task SID is not authorized. */
-                   Otherwise, leave SID unchanged and kill. */
+        flush_unauthorized_files(bprm->cred, current->files);
-                if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
-                        struct task_struct *tracer;
-                        struct task_security_struct *sec;
-                        u32 ptsid = 0;
-                        rcu_read_lock();
+        /* Always clear parent death signal on SID transitions. */
-                        tracer = tracehook_tracer_task(current);
+        current->pdeath_signal = 0;
-                        if (likely(tracer != NULL)) {
-                                sec = tracer->security;
-                                ptsid = sec->sid;
-                        }
-                        rcu_read_unlock();
-                        if (ptsid != 0) {
+        /* Check whether the new SID can inherit resource limits from the old
-                                rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
+         * SID.  If not, reset all soft limits to the lower of the current
-                                                  PROCESS__PTRACE, NULL);
+         * task's hard limit and the init task's soft limit.
-                                if (rc) {
+         *
-                                        bsec->unsafe = 1;
+         * Note that the setting of hard limits (even to lower them) can be
-                                        return;
+         * controlled by the setrlimit check.  The inclusion of the init task's
-                                }
+         * soft limit into the computation is to avoid resetting soft limits
-                        }
+         * higher than the default soft limit for cases where the default is
+         * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
+         */
+        rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
+                          PROCESS__RLIMITINH, NULL);
+        if (rc) {
+                for (i = 0; i < RLIM_NLIMITS; i++) {
+                        rlim = current->signal->rlim + i;
+                        initrlim = init_task.signal->rlim + i;
+                        rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
                }
-                tsec->sid = sid;
+                update_rlimit_cpu(rlim->rlim_cur);
        }
 }
 /*
- * called after apply_creds without the task lock held
+ * Clean up the process immediately after the installation of new credentials
+ * due to exec
 */
-static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
+static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
 {
-        struct task_security_struct *tsec;
+        const struct task_security_struct *tsec = current_security();
-        struct rlimit *rlim, *initrlim;
        struct itimerval itimer;
-        struct bprm_security_struct *bsec;
+        struct sighand_struct *psig;
+        u32 osid, sid;
        int rc, i;
+        unsigned long flags;
-        tsec = current->security;
+        secondary_ops->bprm_committed_creds(bprm);
-        bsec = bprm->security;
-        if (bsec->unsafe) {
+        osid = tsec->osid;
-                force_sig_specific(SIGKILL, current);
+        sid = tsec->sid;
-                return;
-        }
+        if (sid == osid)
-        if (tsec->osid == tsec->sid)
                return;
-        /* Close files for which the new task SID is not authorized. */
+        /* Check whether the new SID can inherit signal state from the old SID.
-        flush_unauthorized_files(current->files);
+         * If not, clear itimers to avoid subsequent signal generation and
+         * flush and unblock signals.
-        /* Check whether the new SID can inherit signal state
+         *
-           from the old SID.  If not, clear itimers to avoid
+         * This must occur _after_ the task SID has been updated so that any
-           subsequent signal generation and flush and unblock
+         * kill done after the flush will be checked against the new SID.
-           signals. This must occur _after_ the task SID has
+         */
-          been updated so that any kill done after the flush
+        rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
-          will be checked against the new SID. */
-        rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
-                          PROCESS__SIGINH, NULL);
        if (rc) {
                memset(&itimer, 0, sizeof itimer);
                for (i = 0; i < 3; i++)
@@ -2304,33 +2362,14 @@ static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
                spin_unlock_irq(&current->sighand->siglock);
        }
-        /* Always clear parent death signal on SID transitions. */
+        /* Wake up the parent if it is waiting so that it can recheck
-        current->pdeath_signal = 0;
+         * wait permission to the new task SID. */
+        read_lock_irq(&tasklist_lock);
-        /* Check whether the new SID can inherit resource limits
+        psig = current->parent->sighand;
-           from the old SID.  If not, reset all soft limits to
+        spin_lock_irqsave(&psig->siglock, flags);
-           the lower of the current task's hard limit and the init
-           task's soft limit.  Note that the setting of hard limits
-           (even to lower them) can be controlled by the setrlimit
-           check. The inclusion of the init task's soft limit into
-           the computation is to avoid resetting soft limits higher
-           than the default soft limit for cases where the default
-           is lower than the hard limit, e.g. RLIMIT_CORE or
-           RLIMIT_STACK.*/
-        rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
-                          PROCESS__RLIMITINH, NULL);
-        if (rc) {
-                for (i = 0; i < RLIM_NLIMITS; i++) {
-                        rlim = current->signal->rlim + i;
-                        initrlim = init_task.signal->rlim+i;
-                        rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
-                }
-                update_rlimit_cpu(rlim->rlim_cur);
-        }
-        /* Wake up the parent if it is waiting so that it can
-           recheck wait permission to the new task SID. */
        wake_up_interruptible(&current->parent->signal->wait_chldexit);
+        spin_unlock_irqrestore(&psig->siglock, flags);
+        read_unlock_irq(&tasklist_lock);
 }
 /* superblock security operations */
@@ -2437,6 +2476,7 @@ out:
 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
 {
+        const struct cred *cred = current_cred();
        struct avc_audit_data ad;
        int rc;
@@ -2446,16 +2486,17 @@ static int selinux_sb_kern_mount(struct super_block *sb, void *data)
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.dentry = sb->s_root;
-        return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
+        return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
 }
 static int selinux_sb_statfs(struct dentry *dentry)
 {
+        const struct cred *cred = current_cred();
        struct avc_audit_data ad;
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.dentry = dentry->d_sb->s_root;
-        return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
+        return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
 }
 static int selinux_mount(char *dev_name,
@@ -2464,6 +2505,7 @@ static int selinux_mount(char *dev_name,
                         unsigned long flags,
                         void *data)
 {
+        const struct cred *cred = current_cred();
        int rc;
        rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
@@ -2471,22 +2513,23 @@ static int selinux_mount(char *dev_name,
                return rc;
        if (flags & MS_REMOUNT)
-                return superblock_has_perm(current, path->mnt->mnt_sb,
+                return superblock_has_perm(cred, path->mnt->mnt_sb,
                                           FILESYSTEM__REMOUNT, NULL);
        else
-                return dentry_has_perm(current, path->mnt, path->dentry,
+                return dentry_has_perm(cred, path->mnt, path->dentry,
                                       FILE__MOUNTON);
 }
 static int selinux_umount(struct vfsmount *mnt, int flags)
 {
+        const struct cred *cred = current_cred();
        int rc;
        rc = secondary_ops->sb_umount(mnt, flags);
        if (rc)
                return rc;
-        return superblock_has_perm(current, mnt->mnt_sb,
+        return superblock_has_perm(cred, mnt->mnt_sb,
                                   FILESYSTEM__UNMOUNT, NULL);
 }
@@ -2506,21 +2549,22 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
                                       char **name, void **value,
                                       size_t *len)
 {
-        struct task_security_struct *tsec;
+        const struct cred *cred = current_cred();
+        const struct task_security_struct *tsec = cred->security;
        struct inode_security_struct *dsec;
        struct superblock_security_struct *sbsec;
-        u32 newsid, clen;
+        u32 sid, newsid, clen;
        int rc;
        char *namep = NULL, *context;
-        tsec = current->security;
        dsec = dir->i_security;
        sbsec = dir->i_sb->s_security;
-        if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
+        sid = tsec->sid;
-                newsid = tsec->create_sid;
+        newsid = tsec->create_sid;
-        } else {
-                rc = security_transition_sid(tsec->sid, dsec->sid,
+        if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) {
+                rc = security_transition_sid(sid, dsec->sid,
                                             inode_mode_to_security_class(inode->i_mode),
                                             &newsid);
                if (rc) {
@@ -2623,21 +2667,25 @@ static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dent
 static int selinux_inode_readlink(struct dentry *dentry)
 {
-        return dentry_has_perm(current, NULL, dentry, FILE__READ);
+        const struct cred *cred = current_cred();
+        return dentry_has_perm(cred, NULL, dentry, FILE__READ);
 }
 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
 {
+        const struct cred *cred = current_cred();
        int rc;
        rc = secondary_ops->inode_follow_link(dentry, nameidata);
        if (rc)
                return rc;
-        return dentry_has_perm(current, NULL, dentry, FILE__READ);
+        return dentry_has_perm(cred, NULL, dentry, FILE__READ);
 }
 static int selinux_inode_permission(struct inode *inode, int mask)
 {
+        const struct cred *cred = current_cred();
        int rc;
        rc = secondary_ops->inode_permission(inode, mask);
@@ -2649,12 +2697,13 @@ static int selinux_inode_permission(struct inode *inode, int mask)
                return 0;
        }
-        return inode_has_perm(current, inode,
+        return inode_has_perm(cred, inode,
-                               open_file_mask_to_av(inode->i_mode, mask), NULL);
+                              file_mask_to_av(inode->i_mode, mask), NULL);
 }
 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
 {
+        const struct cred *cred = current_cred();
        int rc;
        rc = secondary_ops->inode_setattr(dentry, iattr);
@@ -2666,18 +2715,22 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
        if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
                               ATTR_ATIME_SET | ATTR_MTIME_SET))
-                return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
+                return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
-        return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
+        return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
 }
 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 {
-        return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
+        const struct cred *cred = current_cred();
+        return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
 }
 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
 {
+        const struct cred *cred = current_cred();
        if (!strncmp(name, XATTR_SECURITY_PREFIX,
                     sizeof XATTR_SECURITY_PREFIX - 1)) {
                if (!strcmp(name, XATTR_NAME_CAPS)) {
@@ -2692,18 +2745,17 @@ static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
        /* Not an attribute we recognize, so just check the
           ordinary setattr permission. */
-        return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
+        return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
 }
 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
                                  const void *value, size_t size, int flags)
 {
-        struct task_security_struct *tsec = current->security;
        struct inode *inode = dentry->d_inode;
        struct inode_security_struct *isec = inode->i_security;
        struct superblock_security_struct *sbsec;
        struct avc_audit_data ad;
-        u32 newsid;
+        u32 newsid, sid = current_sid();
        int rc = 0;
        if (strcmp(name, XATTR_NAME_SELINUX))
@@ -2719,7 +2771,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        AVC_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.dentry = dentry;
-        rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
+        rc = avc_has_perm(sid, isec->sid, isec->sclass,
                          FILE__RELABELFROM, &ad);
        if (rc)
                return rc;
@@ -2733,12 +2785,12 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        if (rc)
                return rc;
-        rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
+        rc = avc_has_perm(sid, newsid, isec->sclass,
                          FILE__RELABELTO, &ad);
        if (rc)
                return rc;
-        rc = security_validate_transition(isec->sid, newsid, tsec->sid,
+        rc = security_validate_transition(isec->sid, newsid, sid,
                                          isec->sclass);
        if (rc)
                return rc;
@@ -2778,12 +2830,16 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
 {
-        return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
+        const struct cred *cred = current_cred();
+        return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
 }
 static int selinux_inode_listxattr(struct dentry *dentry)
 {
-        return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
+        const struct cred *cred = current_cred();
+        return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
 }
 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
@@ -2806,7 +2862,6 @@ static int selinux_inode_getsecurity(const struct inode *inode, const char *name
        u32 size;
        int error;
        char *context = NULL;
-        struct task_security_struct *tsec = current->security;
        struct inode_security_struct *isec = inode->i_security;
        if (strcmp(name, XATTR_SELINUX_SUFFIX))
@@ -2821,13 +2876,7 @@ static int selinux_inode_getsecurity(const struct inode *inode, const char *name
         * and lack of permission just means that we fall back to the
         * in-core context value, not a denial.
         */
-        error = secondary_ops->capable(current, CAP_MAC_ADMIN);
+        error = selinux_capable(current, CAP_MAC_ADMIN, SECURITY_CAP_NOAUDIT);
-        if (!error)
-                error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
-                                             SECCLASS_CAPABILITY2,
-                                             CAPABILITY2__MAC_ADMIN,
-                                             0,
-                                             NULL);
        if (!error)
                error = security_sid_to_context_force(isec->sid, &context,
                                                      &size);
@@ -2894,6 +2943,7 @@ static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
 static int selinux_revalidate_file_permission(struct file *file, int mask)
 {
+        const struct cred *cred = current_cred();
        int rc;
        struct inode *inode = file->f_path.dentry->d_inode;
@@ -2906,7 +2956,7 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
        if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
                mask |= MAY_APPEND;
-        rc = file_has_perm(current, file,
+        rc = file_has_perm(cred, file,
                           file_mask_to_av(inode->i_mode, mask));
        if (rc)
                return rc;
@@ -2917,16 +2967,16 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
 static int selinux_file_permission(struct file *file, int mask)
 {
        struct inode *inode = file->f_path.dentry->d_inode;
-        struct task_security_struct *tsec = current->security;
        struct file_security_struct *fsec = file->f_security;
        struct inode_security_struct *isec = inode->i_security;
+        u32 sid = current_sid();
        if (!mask) {
                /* No permission to check.  Existence test. */
                return 0;
        }
-        if (tsec->sid == fsec->sid && fsec->isid == isec->sid
+        if (sid == fsec->sid && fsec->isid == isec->sid
            && fsec->pseqno == avc_policy_seqno())
                return selinux_netlbl_inode_permission(inode, mask);
@@ -2946,6 +2996,7 @@ static void selinux_file_free_security(struct file *file)
 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
                              unsigned long arg)
 {
+        const struct cred *cred = current_cred();
        u32 av = 0;
        if (_IOC_DIR(cmd) & _IOC_WRITE)
@@ -2955,11 +3006,14 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
        if (!av)
                av = FILE__IOCTL;
-        return file_has_perm(current, file, av);
+        return file_has_perm(cred, file, av);
 }
 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
 {
+        const struct cred *cred = current_cred();
+        int rc = 0;
 #ifndef CONFIG_PPC32
        if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
                /*
@@ -2967,9 +3021,9 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
                 * private file mapping that will also be writable.
                 * This has an additional check.
                 */
-                int rc = task_has_perm(current, current, PROCESS__EXECMEM);
+                rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
                if (rc)
-                        return rc;
+                        goto error;
        }
 #endif
@@ -2984,9 +3038,11 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
                if (prot & PROT_EXEC)
                        av |= FILE__EXECUTE;
-                return file_has_perm(current, file, av);
+                return file_has_perm(cred, file, av);
        }
-        return 0;
+error:
+        return rc;
 }
 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
@@ -2994,7 +3050,7 @@ static int selinux_file_mmap(struct file *file, unsigned long reqprot,
                             unsigned long addr, unsigned long addr_only)
 {
        int rc = 0;
-        u32 sid = ((struct task_security_struct *)(current->security))->sid;
+        u32 sid = current_sid();
        if (addr < mmap_min_addr)
                rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
@@ -3013,6 +3069,7 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
                                 unsigned long reqprot,
                                 unsigned long prot)
 {
+        const struct cred *cred = current_cred();
        int rc;
        rc = secondary_ops->file_mprotect(vma, reqprot, prot);
@@ -3027,12 +3084,11 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
                rc = 0;
                if (vma->vm_start >= vma->vm_mm->start_brk &&
                    vma->vm_end <= vma->vm_mm->brk) {
-                        rc = task_has_perm(current, current,
+                        rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
-                                           PROCESS__EXECHEAP);
                } else if (!vma->vm_file &&
                           vma->vm_start <= vma->vm_mm->start_stack &&
                           vma->vm_end >= vma->vm_mm->start_stack) {
-                        rc = task_has_perm(current, current, PROCESS__EXECSTACK);
+                        rc = current_has_perm(current, PROCESS__EXECSTACK);
                } else if (vma->vm_file && vma->anon_vma) {
                        /*
                         * We are making executable a file mapping that has
@@ -3041,8 +3097,7 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
                         * modified content.  This typically should only
                         * occur for text relocations.
                         */
-                        rc = file_has_perm(current, vma->vm_file,
+                        rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
-                                           FILE__EXECMOD);
                }
                if (rc)
                        return rc;
@@ -3054,12 +3109,15 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
 static int selinux_file_lock(struct file *file, unsigned int cmd)
 {
-        return file_has_perm(current, file, FILE__LOCK);
+        const struct cred *cred = current_cred();
+        return file_has_perm(cred, file, FILE__LOCK);
 }
 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
                              unsigned long arg)
 {
+        const struct cred *cred = current_cred();
        int err = 0;
        switch (cmd) {
@@ -3070,7 +3128,7 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
                }
                if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
-                        err = file_has_perm(current, file, FILE__WRITE);
+                        err = file_has_perm(cred, file, FILE__WRITE);
                        break;
                }
                /* fall through */
@@ -3080,7 +3138,7 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
        case F_GETOWN:
        case F_GETSIG:
                /* Just check FD__USE permission */
-                err = file_has_perm(current, file, 0);
+                err = file_has_perm(cred, file, 0);
                break;
        case F_GETLK:
        case F_SETLK:
@@ -3094,7 +3152,7 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
                        err = -EINVAL;
                        break;
                }
-                err = file_has_perm(current, file, FILE__LOCK);
+                err = file_has_perm(cred, file, FILE__LOCK);
                break;
        }
@@ -3103,12 +3161,10 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
 static int selinux_file_set_fowner(struct file *file)
 {
-        struct task_security_struct *tsec;
        struct file_security_struct *fsec;
-        tsec = current->security;
        fsec = file->f_security;
-        fsec->fown_sid = tsec->sid;
+        fsec->fown_sid = current_sid();
        return 0;
 }
@@ -3117,14 +3173,13 @@ static int selinux_file_send_sigiotask(struct task_struct *tsk,
                                       struct fown_struct *fown, int signum)
 {
        struct file *file;
+        u32 sid = current_sid();
        u32 perm;
-        struct task_security_struct *tsec;
        struct file_security_struct *fsec;
        /* struct fown_struct is never outside the context of a struct file */
        file = container_of(fown, struct file, f_owner);
-        tsec = tsk->security;
        fsec = file->f_security;
        if (!signum)
@@ -3132,20 +3187,23 @@ static int selinux_file_send_sigiotask(struct task_struct *tsk,
        else
                perm = signal_to_av(signum);
-        return avc_has_perm(fsec->fown_sid, tsec->sid,
+        return avc_has_perm(fsec->fown_sid, sid,
                            SECCLASS_PROCESS, perm, NULL);
 }
 static int selinux_file_receive(struct file *file)
 {
-        return file_has_perm(current, file, file_to_av(file));
+        const struct cred *cred = current_cred();
+        return file_has_perm(cred, file, file_to_av(file));
 }
-static int selinux_dentry_open(struct file *file)
+static int selinux_dentry_open(struct file *file, const struct cred *cred)
 {
        struct file_security_struct *fsec;
        struct inode *inode;
        struct inode_security_struct *isec;
        inode = file->f_path.dentry->d_inode;
        fsec = file->f_security;
        isec = inode->i_security;
@@ -3166,7 +3224,7 @@ static int selinux_dentry_open(struct file *file)
         * new inode label or new policy.
         * This check is not redundant - do not remove.
         */
-        return inode_has_perm(current, inode, file_to_av(file), NULL);
+        return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
 }
 /* task security operations */
@@ -3179,36 +3237,88 @@ static int selinux_task_create(unsigned long clone_flags)
        if (rc)
                return rc;
-        return task_has_perm(current, current, PROCESS__FORK);
+        return current_has_perm(current, PROCESS__FORK);
 }
-static int selinux_task_alloc_security(struct task_struct *tsk)
+/*
+ * detach and free the LSM part of a set of credentials
+ */
+static void selinux_cred_free(struct cred *cred)
 {
-        struct task_security_struct *tsec1, *tsec2;
+        struct task_security_struct *tsec = cred->security;
-        int rc;
+        cred->security = NULL;
+        kfree(tsec);
-        tsec1 = current->security;
+}
-        rc = task_alloc_security(tsk);
+/*
-        if (rc)
+ * prepare a new set of credentials for modification
-                return rc;
+ */
-        tsec2 = tsk->security;
+static int selinux_cred_prepare(struct cred *new, const struct cred *old,
+                                gfp_t gfp)
+{
+        const struct task_security_struct *old_tsec;
+        struct task_security_struct *tsec;
-        tsec2->osid = tsec1->osid;
+        old_tsec = old->security;
-        tsec2->sid = tsec1->sid;
-        /* Retain the exec, fs, key, and sock SIDs across fork */
+        tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
-        tsec2->exec_sid = tsec1->exec_sid;
+        if (!tsec)
-        tsec2->create_sid = tsec1->create_sid;
+                return -ENOMEM;
-        tsec2->keycreate_sid = tsec1->keycreate_sid;
-        tsec2->sockcreate_sid = tsec1->sockcreate_sid;
+        new->security = tsec;
        return 0;
 }
-static void selinux_task_free_security(struct task_struct *tsk)
+/*
+ * commit new credentials
+ */
+static void selinux_cred_commit(struct cred *new, const struct cred *old)
+{
+        secondary_ops->cred_commit(new, old);
+}
+/*
+ * set the security data for a kernel service
+ * - all the creation contexts are set to unlabelled
+ */
+static int selinux_kernel_act_as(struct cred *new, u32 secid)
 {
-        task_free_security(tsk);
+        struct task_security_struct *tsec = new->security;
+        u32 sid = current_sid();
+        int ret;
+        ret = avc_has_perm(sid, secid,
+                           SECCLASS_KERNEL_SERVICE,
+                           KERNEL_SERVICE__USE_AS_OVERRIDE,
+                           NULL);
+        if (ret == 0) {
+                tsec->sid = secid;
+                tsec->create_sid = 0;
+                tsec->keycreate_sid = 0;
+                tsec->sockcreate_sid = 0;
+        }
+        return ret;
+}
+/*
+ * set the file creation context in a security record to the same as the
+ * objective context of the specified inode
+ */
+static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
+{
+        struct inode_security_struct *isec = inode->i_security;
+        struct task_security_struct *tsec = new->security;
+        u32 sid = current_sid();
+        int ret;
+        ret = avc_has_perm(sid, isec->sid,
+                           SECCLASS_KERNEL_SERVICE,
+                           KERNEL_SERVICE__CREATE_FILES_AS,
+                           NULL);
+        if (ret == 0)
+                tsec->create_sid = isec->sid;
+        return 0;
 }
 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
@@ -3222,9 +3332,10 @@ static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
        return 0;
 }
-static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
+static int selinux_task_fix_setuid(struct cred *new, const struct cred *old,
+                                   int flags)
 {
-        return secondary_ops->task_post_setuid(id0, id1, id2, flags);
+        return secondary_ops->task_fix_setuid(new, old, flags);
 }
 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
@@ -3235,23 +3346,22 @@ static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
 {
-        return task_has_perm(current, p, PROCESS__SETPGID);
+        return current_has_perm(p, PROCESS__SETPGID);
 }
 static int selinux_task_getpgid(struct task_struct *p)
 {
-        return task_has_perm(current, p, PROCESS__GETPGID);
+        return current_has_perm(p, PROCESS__GETPGID);
 }
 static int selinux_task_getsid(struct task_struct *p)
 {
-        return task_has_perm(current, p, PROCESS__GETSESSION);
+        return current_has_perm(p, PROCESS__GETSESSION);
 }
 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
 {
-        struct task_security_struct *tsec = p->security;
+        *secid = task_sid(p);
-        *secid = tsec->sid;
 }
 static int selinux_task_setgroups(struct group_info *group_info)
@@ -3268,7 +3378,7 @@ static int selinux_task_setnice(struct task_struct *p, int nice)
        if (rc)
                return rc;
-        return task_has_perm(current, p, PROCESS__SETSCHED);
+        return current_has_perm(p, PROCESS__SETSCHED);
 }
 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
@@ -3279,12 +3389,12 @@ static int selinux_task_setioprio(struct task_struct *p, int ioprio)
        if (rc)
                return rc;
-        return task_has_perm(current, p, PROCESS__SETSCHED);
+        return current_has_perm(p, PROCESS__SETSCHED);
 }
 static int selinux_task_getioprio(struct task_struct *p)
 {
-        return task_has_perm(current, p, PROCESS__GETSCHED);
+        return current_has_perm(p, PROCESS__GETSCHED);
 }
 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
@@ -3299,9 +3409,9 @@ static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim
        /* Control the ability to change the hard limit (whether
           lowering or raising it), so that the hard limit can
           later be used as a safe reset point for the soft limit
-           upon context transitions. See selinux_bprm_apply_creds. */
+           upon context transitions.  See selinux_bprm_committing_creds. */
        if (old_rlim->rlim_max != new_rlim->rlim_max)
-                return task_has_perm(current, current, PROCESS__SETRLIMIT);
+                return current_has_perm(current, PROCESS__SETRLIMIT);
        return 0;
 }
@@ -3314,17 +3424,17 @@ static int selinux_task_setscheduler(struct task_struct *p, int policy, struct s
        if (rc)
                return rc;
-        return task_has_perm(current, p, PROCESS__SETSCHED);
+        return current_has_perm(p, PROCESS__SETSCHED);
 }
 static int selinux_task_getscheduler(struct task_struct *p)
 {
-        return task_has_perm(current, p, PROCESS__GETSCHED);
+        return current_has_perm(p, PROCESS__GETSCHED);
 }
 static int selinux_task_movememory(struct task_struct *p)
 {
-        return task_has_perm(current, p, PROCESS__SETSCHED);
+        return current_has_perm(p, PROCESS__SETSCHED);
 }
 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
@@ -3332,7 +3442,6 @@ static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
 {
        u32 perm;
        int rc;
-        struct task_security_struct *tsec;
        rc = secondary_ops->task_kill(p, info, sig, secid);
        if (rc)
@@ -3342,11 +3451,11 @@ static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
                perm = PROCESS__SIGNULL; /* null signal; existence test */
        else
                perm = signal_to_av(sig);
-        tsec = p->security;
        if (secid)
-                rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
+                rc = avc_has_perm(secid, task_sid(p),
+                                  SECCLASS_PROCESS, perm, NULL);
        else
-                rc = task_has_perm(current, p, perm);
+                rc = current_has_perm(p, perm);
        return rc;
 }
@@ -3354,13 +3463,12 @@ static int selinux_task_prctl(int option,
                              unsigned long arg2,
                              unsigned long arg3,
                              unsigned long arg4,
-                              unsigned long arg5,
+                              unsigned long arg5)
-                              long *rc_p)
 {
        /* The current prctl operations do not appear to require
           any SELinux controls since they merely observe or modify
           the state of the current process. */
-        return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
+        return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5);
 }
 static int selinux_task_wait(struct task_struct *p)
@@ -3368,27 +3476,14 @@ static int selinux_task_wait(struct task_struct *p)
        return task_has_perm(p, current, PROCESS__SIGCHLD);
 }
-static void selinux_task_reparent_to_init(struct task_struct *p)
-{
-        struct task_security_struct *tsec;
-        secondary_ops->task_reparent_to_init(p);
-        tsec = p->security;
-        tsec->osid = tsec->sid;
-        tsec->sid = SECINITSID_KERNEL;
-        return;
-}
 static void selinux_task_to_inode(struct task_struct *p,
                                  struct inode *inode)
 {
-        struct task_security_struct *tsec = p->security;
        struct inode_security_struct *isec = inode->i_security;
+        u32 sid = task_sid(p);
-        isec->sid = tsec->sid;
+        isec->sid = sid;
        isec->initialized = 1;
-        return;
 }
 /* Returns error only if unable to parse addresses */
@@ -3627,19 +3722,19 @@ static int socket_has_perm(struct task_struct *task, struct socket *sock,
                           u32 perms)
 {
        struct inode_security_struct *isec;
-        struct task_security_struct *tsec;
        struct avc_audit_data ad;
+        u32 sid;
        int err = 0;
-        tsec = task->security;
        isec = SOCK_INODE(sock)->i_security;
        if (isec->sid == SECINITSID_KERNEL)
                goto out;
+        sid = task_sid(task);
        AVC_AUDIT_DATA_INIT(&ad, NET);
        ad.u.net.sk = sock->sk;
-        err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
+        err = avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
 out:
        return err;
@@ -3648,18 +3743,20 @@ out:
 static int selinux_socket_create(int family, int type,
                                 int protocol, int kern)
 {
+        const struct cred *cred = current_cred();
+        const struct task_security_struct *tsec = cred->security;
+        u32 sid, newsid;
+        u16 secclass;
        int err = 0;
-        struct task_security_struct *tsec;
-        u32 newsid;
        if (kern)
                goto out;
-        tsec = current->security;
+        sid = tsec->sid;
-        newsid = tsec->sockcreate_sid ? : tsec->sid;
+        newsid = tsec->sockcreate_sid ?: sid;
-        err = avc_has_perm(tsec->sid, newsid,
-                           socket_type_to_security_class(family, type,
+        secclass = socket_type_to_security_class(family, type, protocol);
-                           protocol), SOCKET__CREATE, NULL);
+        err = avc_has_perm(sid, newsid, secclass, SOCKET__CREATE, NULL);
 out:
        return err;
@@ -3668,18 +3765,26 @@ out:
 static int selinux_socket_post_create(struct socket *sock, int family,
                                      int type, int protocol, int kern)
 {
-        int err = 0;
+        const struct cred *cred = current_cred();
+        const struct task_security_struct *tsec = cred->security;
        struct inode_security_struct *isec;
-        struct task_security_struct *tsec;
        struct sk_security_struct *sksec;
-        u32 newsid;
+        u32 sid, newsid;
+        int err = 0;
+        sid = tsec->sid;
+        newsid = tsec->sockcreate_sid;
        isec = SOCK_INODE(sock)->i_security;
-        tsec = current->security;
+        if (kern)
-        newsid = tsec->sockcreate_sid ? : tsec->sid;
+                isec->sid = SECINITSID_KERNEL;
+        else if (newsid)
+                isec->sid = newsid;
+        else
+                isec->sid = sid;
        isec->sclass = socket_type_to_security_class(family, type, protocol);
-        isec->sid = kern ? SECINITSID_KERNEL : newsid;
        isec->initialized = 1;
        if (sock->sk) {
@@ -3714,7 +3819,6 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
        if (family == PF_INET || family == PF_INET6) {
                char *addrp;
                struct inode_security_struct *isec;
-                struct task_security_struct *tsec;
                struct avc_audit_data ad;
                struct sockaddr_in *addr4 = NULL;
                struct sockaddr_in6 *addr6 = NULL;
@@ -3722,7 +3826,6 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                struct sock *sk = sock->sk;
                u32 sid, node_perm;
-                tsec = current->security;
                isec = SOCK_INODE(sock)->i_security;
                if (family == PF_INET) {
@@ -4387,7 +4490,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
                                  "SELinux:  unrecognized netlink message"
                                  " type=%hu for sclass=%hu\n",
                                  nlh->nlmsg_type, isec->sclass);
-                        if (!selinux_enforcing)
+                        if (!selinux_enforcing || security_get_allow_unknown())
                                err = 0;
                }
@@ -4763,15 +4866,16 @@ static int ipc_alloc_security(struct task_struct *task,
                              struct kern_ipc_perm *perm,
                              u16 sclass)
 {
-        struct task_security_struct *tsec = task->security;
        struct ipc_security_struct *isec;
+        u32 sid;
        isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
        if (!isec)
                return -ENOMEM;
+        sid = task_sid(task);
        isec->sclass = sclass;
-        isec->sid = tsec->sid;
+        isec->sid = sid;
        perm->security = isec;
        return 0;
@@ -4809,17 +4913,16 @@ static void msg_msg_free_security(struct msg_msg *msg)
 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
                        u32 perms)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
-        tsec = current->security;
        isec = ipc_perms->security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = ipc_perms->key;
-        return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
+        return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
 }
 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
@@ -4835,22 +4938,21 @@ static void selinux_msg_msg_free_security(struct msg_msg *msg)
 /* message queue security operations */
 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
        int rc;
        rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
        if (rc)
                return rc;
-        tsec = current->security;
        isec = msq->q_perm.security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = msq->q_perm.key;
-        rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
+        rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
                          MSGQ__CREATE, &ad);
        if (rc) {
                ipc_free_security(&msq->q_perm);
@@ -4866,17 +4968,16 @@ static void selinux_msg_queue_free_security(struct msg_queue *msq)
 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
-        tsec = current->security;
        isec = msq->q_perm.security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = msq->q_perm.key;
-        return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
+        return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
                            MSGQ__ASSOCIATE, &ad);
 }
@@ -4910,13 +5011,12 @@ static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct msg_security_struct *msec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
        int rc;
-        tsec = current->security;
        isec = msq->q_perm.security;
        msec = msg->security;
@@ -4928,9 +5028,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
                 * Compute new sid based on current process and
                 * message queue this message will be stored in
                 */
-                rc = security_transition_sid(tsec->sid,
+                rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
-                                             isec->sid,
-                                             SECCLASS_MSG,
                                             &msec->sid);
                if (rc)
                        return rc;
@@ -4940,16 +5038,16 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
        ad.u.ipc_id = msq->q_perm.key;
        /* Can this process write to the queue? */
-        rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
+        rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
                          MSGQ__WRITE, &ad);
        if (!rc)
                /* Can this process send the message */
-                rc = avc_has_perm(tsec->sid, msec->sid,
+                rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
-                                  SECCLASS_MSG, MSG__SEND, &ad);
+                                  MSG__SEND, &ad);
        if (!rc)
                /* Can the message be put in the queue? */
-                rc = avc_has_perm(msec->sid, isec->sid,
+                rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
-                                  SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
+                                  MSGQ__ENQUEUE, &ad);
        return rc;
 }
@@ -4958,23 +5056,22 @@ static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
                                    struct task_struct *target,
                                    long type, int mode)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct msg_security_struct *msec;
        struct avc_audit_data ad;
+        u32 sid = task_sid(target);
        int rc;
-        tsec = target->security;
        isec = msq->q_perm.security;
        msec = msg->security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = msq->q_perm.key;
-        rc = avc_has_perm(tsec->sid, isec->sid,
+        rc = avc_has_perm(sid, isec->sid,
                          SECCLASS_MSGQ, MSGQ__READ, &ad);
        if (!rc)
-                rc = avc_has_perm(tsec->sid, msec->sid,
+                rc = avc_has_perm(sid, msec->sid,
                                  SECCLASS_MSG, MSG__RECEIVE, &ad);
        return rc;
 }
@@ -4982,22 +5079,21 @@ static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
 /* Shared Memory security operations */
 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
        int rc;
        rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
        if (rc)
                return rc;
-        tsec = current->security;
        isec = shp->shm_perm.security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = shp->shm_perm.key;
-        rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
+        rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
                          SHM__CREATE, &ad);
        if (rc) {
                ipc_free_security(&shp->shm_perm);
@@ -5013,17 +5109,16 @@ static void selinux_shm_free_security(struct shmid_kernel *shp)
 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
-        tsec = current->security;
        isec = shp->shm_perm.security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = shp->shm_perm.key;
-        return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
+        return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
                            SHM__ASSOCIATE, &ad);
 }
@@ -5081,22 +5176,21 @@ static int selinux_shm_shmat(struct shmid_kernel *shp,
 /* Semaphore security operations */
 static int selinux_sem_alloc_security(struct sem_array *sma)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
        int rc;
        rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
        if (rc)
                return rc;
-        tsec = current->security;
        isec = sma->sem_perm.security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = sma->sem_perm.key;
-        rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
+        rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
                          SEM__CREATE, &ad);
        if (rc) {
                ipc_free_security(&sma->sem_perm);
@@ -5112,17 +5206,16 @@ static void selinux_sem_free_security(struct sem_array *sma)
 static int selinux_sem_associate(struct sem_array *sma, int semflg)
 {
-        struct task_security_struct *tsec;
        struct ipc_security_struct *isec;
        struct avc_audit_data ad;
+        u32 sid = current_sid();
-        tsec = current->security;
        isec = sma->sem_perm.security;
        AVC_AUDIT_DATA_INIT(&ad, IPC);
        ad.u.ipc_id = sma->sem_perm.key;
-        return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
+        return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
                            SEM__ASSOCIATE, &ad);
 }
@@ -5212,33 +5305,35 @@ static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
 static int selinux_getprocattr(struct task_struct *p,
                               char *name, char **value)
 {
-        struct task_security_struct *tsec;
+        const struct task_security_struct *__tsec;
        u32 sid;
        int error;
        unsigned len;
        if (current != p) {
-                error = task_has_perm(current, p, PROCESS__GETATTR);
+                error = current_has_perm(p, PROCESS__GETATTR);
                if (error)
                        return error;
        }
-        tsec = p->security;
+        rcu_read_lock();
+        __tsec = __task_cred(p)->security;
        if (!strcmp(name, "current"))
-                sid = tsec->sid;
+                sid = __tsec->sid;
        else if (!strcmp(name, "prev"))
-                sid = tsec->osid;
+                sid = __tsec->osid;
        else if (!strcmp(name, "exec"))
-                sid = tsec->exec_sid;
+                sid = __tsec->exec_sid;
        else if (!strcmp(name, "fscreate"))
-                sid = tsec->create_sid;
+                sid = __tsec->create_sid;
        else if (!strcmp(name, "keycreate"))
-                sid = tsec->keycreate_sid;
+                sid = __tsec->keycreate_sid;
        else if (!strcmp(name, "sockcreate"))
-                sid = tsec->sockcreate_sid;
+                sid = __tsec->sockcreate_sid;
        else
-                return -EINVAL;
+                goto invalid;
+        rcu_read_unlock();
        if (!sid)
                return 0;
@@ -5247,6 +5342,10 @@ static int selinux_getprocattr(struct task_struct *p,
        if (error)
                return error;
        return len;
+invalid:
+        rcu_read_unlock();
+        return -EINVAL;
 }
 static int selinux_setprocattr(struct task_struct *p,
@@ -5254,7 +5353,8 @@ static int selinux_setprocattr(struct task_struct *p,
 {
        struct task_security_struct *tsec;
        struct task_struct *tracer;
-        u32 sid = 0;
+        struct cred *new;
+        u32 sid = 0, ptsid;
        int error;
        char *str = value;
@@ -5270,15 +5370,15 @@ static int selinux_setprocattr(struct task_struct *p,
         * above restriction is ever removed.
         */
        if (!strcmp(name, "exec"))
-                error = task_has_perm(current, p, PROCESS__SETEXEC);
+                error = current_has_perm(p, PROCESS__SETEXEC);
        else if (!strcmp(name, "fscreate"))
-                error = task_has_perm(current, p, PROCESS__SETFSCREATE);
+                error = current_has_perm(p, PROCESS__SETFSCREATE);
        else if (!strcmp(name, "keycreate"))
-                error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
+                error = current_has_perm(p, PROCESS__SETKEYCREATE);
        else if (!strcmp(name, "sockcreate"))
-                error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
+                error = current_has_perm(p, PROCESS__SETSOCKCREATE);
        else if (!strcmp(name, "current"))
-                error = task_has_perm(current, p, PROCESS__SETCURRENT);
+                error = current_has_perm(p, PROCESS__SETCURRENT);
        else
                error = -EINVAL;
        if (error)
@@ -5301,87 +5401,75 @@ static int selinux_setprocattr(struct task_struct *p,
                        return error;
        }
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
        /* Permission checking based on the specified context is
           performed during the actual operation (execve,
           open/mkdir/...), when we know the full context of the
-           operation.  See selinux_bprm_set_security for the execve
+           operation.  See selinux_bprm_set_creds for the execve
           checks and may_create for the file creation checks. The
           operation will then fail if the context is not permitted. */
-        tsec = p->security;
+        tsec = new->security;
-        if (!strcmp(name, "exec"))
+        if (!strcmp(name, "exec")) {
                tsec->exec_sid = sid;
-        else if (!strcmp(name, "fscreate"))
+        } else if (!strcmp(name, "fscreate")) {
                tsec->create_sid = sid;
-        else if (!strcmp(name, "keycreate")) {
+        } else if (!strcmp(name, "keycreate")) {
                error = may_create_key(sid, p);
                if (error)
-                        return error;
+                        goto abort_change;
                tsec->keycreate_sid = sid;
-        } else if (!strcmp(name, "sockcreate"))
+        } else if (!strcmp(name, "sockcreate")) {
                tsec->sockcreate_sid = sid;
-        else if (!strcmp(name, "current")) {
+        } else if (!strcmp(name, "current")) {
-                struct av_decision avd;
+                error = -EINVAL;
                if (sid == 0)
-                        return -EINVAL;
+                        goto abort_change;
-                /*
-                 * SELinux allows to change context in the following case only.
+                /* Only allow single threaded processes to change context */
-                 *  - Single threaded processes.
+                error = -EPERM;
-                 *  - Multi threaded processes intend to change its context into
+                if (!is_single_threaded(p)) {
-                 *    more restricted domain (defined by TYPEBOUNDS statement).
+                        error = security_bounded_transition(tsec->sid, sid);
-                 */
+                        if (error)
-                if (atomic_read(&p->mm->mm_users) != 1) {
+                                goto abort_change;
-                        struct task_struct *g, *t;
-                        struct mm_struct *mm = p->mm;
-                        read_lock(&tasklist_lock);
-                        do_each_thread(g, t) {
-                                if (t->mm == mm && t != p) {
-                                        read_unlock(&tasklist_lock);
-                                        error = security_bounded_transition(tsec->sid, sid);
-                                        if (!error)
-                                                goto boundary_ok;
-                                        return error;
-                                }
-                        } while_each_thread(g, t);
-                        read_unlock(&tasklist_lock);
                }
-boundary_ok:
                /* Check permissions for the transition. */
                error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
                                     PROCESS__DYNTRANSITION, NULL);
                if (error)
-                        return error;
+                        goto abort_change;
                /* Check for ptracing, and update the task SID if ok.
                   Otherwise, leave SID unchanged and fail. */
+                ptsid = 0;
                task_lock(p);
-                rcu_read_lock();
                tracer = tracehook_tracer_task(p);
-                if (tracer != NULL) {
+                if (tracer)
-                        struct task_security_struct *ptsec = tracer->security;
+                        ptsid = task_sid(tracer);
-                        u32 ptsid = ptsec->sid;
+                task_unlock(p);
-                        rcu_read_unlock();
-                        error = avc_has_perm_noaudit(ptsid, sid,
+                if (tracer) {
-                                                     SECCLASS_PROCESS,
+                        error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
-                                                     PROCESS__PTRACE, 0, &avd);
+                                             PROCESS__PTRACE, NULL);
-                        if (!error)
-                                tsec->sid = sid;
-                        task_unlock(p);
-                        avc_audit(ptsid, sid, SECCLASS_PROCESS,
-                                  PROCESS__PTRACE, &avd, error, NULL);
                        if (error)
-                                return error;
+                                goto abort_change;
-                } else {
-                        rcu_read_unlock();
-                        tsec->sid = sid;
-                        task_unlock(p);
                }
-        } else
-                return -EINVAL;
+                tsec->sid = sid;
+        } else {
+                error = -EINVAL;
+                goto abort_change;
+        }
+        commit_creds(new);
        return size;
+abort_change:
+        abort_creds(new);
+        return error;
 }
 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
@@ -5401,22 +5489,23 @@ static void selinux_release_secctx(char *secdata, u32 seclen)
 #ifdef CONFIG_KEYS
-static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
+static int selinux_key_alloc(struct key *k, const struct cred *cred,
                             unsigned long flags)
 {
-        struct task_security_struct *tsec = tsk->security;
+        const struct task_security_struct *tsec;
        struct key_security_struct *ksec;
        ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
        if (!ksec)
                return -ENOMEM;
+        tsec = cred->security;
        if (tsec->keycreate_sid)
                ksec->sid = tsec->keycreate_sid;
        else
                ksec->sid = tsec->sid;
-        k->security = ksec;
+        k->security = ksec;
        return 0;
 }
@@ -5429,17 +5518,12 @@ static void selinux_key_free(struct key *k)
 }
 static int selinux_key_permission(key_ref_t key_ref,
-                            struct task_struct *ctx,
+                                  const struct cred *cred,
-                            key_perm_t perm)
+                                  key_perm_t perm)
 {
        struct key *key;
-        struct task_security_struct *tsec;
        struct key_security_struct *ksec;
+        u32 sid;
-        key = key_ref_to_ptr(key_ref);
-        tsec = ctx->security;
-        ksec = key->security;
        /* if no specific permissions are requested, we skip the
           permission check. No serious, additional covert channels
@@ -5447,8 +5531,12 @@ static int selinux_key_permission(key_ref_t key_ref,
        if (perm == 0)
                return 0;
-        return avc_has_perm(tsec->sid, ksec->sid,
+        sid = cred_sid(cred);
-                            SECCLASS_KEY, perm, NULL);
+        key = key_ref_to_ptr(key_ref);
+        ksec = key->security;
+        return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
 }
 static int selinux_key_getsecurity(struct key *key, char **_buffer)
@@ -5473,8 +5561,7 @@ static struct security_operations selinux_ops = {
        .ptrace_may_access =            selinux_ptrace_may_access,
        .ptrace_traceme =               selinux_ptrace_traceme,
        .capget =                       selinux_capget,
-        .capset_check =                 selinux_capset_check,
+        .capset =                       selinux_capset,
-        .capset_set =                   selinux_capset_set,
        .sysctl =                       selinux_sysctl,
        .capable =                      selinux_capable,
        .quotactl =                     selinux_quotactl,
@@ -5485,12 +5572,10 @@ static struct security_operations selinux_ops = {
        .netlink_send =                 selinux_netlink_send,
        .netlink_recv =                 selinux_netlink_recv,
-        .bprm_alloc_security =          selinux_bprm_alloc_security,
+        .bprm_set_creds =               selinux_bprm_set_creds,
-        .bprm_free_security =           selinux_bprm_free_security,
-        .bprm_apply_creds =             selinux_bprm_apply_creds,
-        .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
-        .bprm_set_security =            selinux_bprm_set_security,
        .bprm_check_security =          selinux_bprm_check_security,
+        .bprm_committing_creds =        selinux_bprm_committing_creds,
+        .bprm_committed_creds =         selinux_bprm_committed_creds,
        .bprm_secureexec =              selinux_bprm_secureexec,
        .sb_alloc_security =            selinux_sb_alloc_security,
@@ -5549,10 +5634,13 @@ static struct security_operations selinux_ops = {
        .dentry_open =                  selinux_dentry_open,
        .task_create =                  selinux_task_create,
-        .task_alloc_security =          selinux_task_alloc_security,
+        .cred_free =                    selinux_cred_free,
-        .task_free_security =           selinux_task_free_security,
+        .cred_prepare =                 selinux_cred_prepare,
+        .cred_commit =                  selinux_cred_commit,
+        .kernel_act_as =                selinux_kernel_act_as,
+        .kernel_create_files_as =       selinux_kernel_create_files_as,
        .task_setuid =                  selinux_task_setuid,
-        .task_post_setuid =             selinux_task_post_setuid,
+        .task_fix_setuid =              selinux_task_fix_setuid,
        .task_setgid =                  selinux_task_setgid,
        .task_setpgid =                 selinux_task_setpgid,
        .task_getpgid =                 selinux_task_getpgid,
@@ -5569,7 +5657,6 @@ static struct security_operations selinux_ops = {
        .task_kill =                    selinux_task_kill,
        .task_wait =                    selinux_task_wait,
        .task_prctl =                   selinux_task_prctl,
-        .task_reparent_to_init =        selinux_task_reparent_to_init,
        .task_to_inode =                selinux_task_to_inode,
        .ipc_permission =               selinux_ipc_permission,
@@ -5665,8 +5752,6 @@ static struct security_operations selinux_ops = {
 static __init int selinux_init(void)
 {
-        struct task_security_struct *tsec;
        if (!security_module_enable(&selinux_ops)) {
                selinux_enabled = 0;
                return 0;
@@ -5680,10 +5765,7 @@ static __init int selinux_init(void)
        printk(KERN_INFO "SELinux:  Initializing.\n");
        /* Set the security state for the initial task. */
-        if (task_alloc_security(current))
+        cred_init_security();
-                panic("SELinux:  Failed to initialize initial task.\n");
-        tsec = current->security;
-        tsec->osid = tsec->sid = SECINITSID_KERNEL;
        sel_inode_cache = kmem_cache_create("selinux_inode_security",
                                            sizeof(struct inode_security_struct),
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index 1223b4ff9bee..c0c885427b91 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -176,3 +176,5 @@
   S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
   S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")
   S_(SECCLASS_PEER, PEER__RECV, "recv")
+   S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__USE_AS_OVERRIDE, "use_as_override")
+   S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__CREATE_FILES_AS, "create_files_as")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index c4c51165c505..0ba79fe00e11 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -841,3 +841,5 @@
 #define DCCP_SOCKET__NAME_CONNECT                 0x00800000UL
 #define MEMPROTECT__MMAP_ZERO                     0x00000001UL
 #define PEER__RECV                                0x00000001UL
+#define KERNEL_SERVICE__USE_AS_OVERRIDE           0x00000001UL
+#define KERNEL_SERVICE__CREATE_FILES_AS           0x00000002UL
diff --git a/security/selinux/include/class_to_string.h b/security/selinux/include/class_to_string.h
index bd813c366e34..21ec786611d4 100644
--- a/security/selinux/include/class_to_string.h
+++ b/security/selinux/include/class_to_string.h
@@ -72,3 +72,8 @@
    S_(NULL)
    S_("peer")
    S_("capability2")
+    S_(NULL)
+    S_(NULL)
+    S_(NULL)
+    S_(NULL)
+    S_("kernel_service")
diff --git a/security/selinux/include/flask.h b/security/selinux/include/flask.h
index febf8868e852..882f27d66fac 100644
--- a/security/selinux/include/flask.h
+++ b/security/selinux/include/flask.h
@@ -52,6 +52,7 @@
 #define SECCLASS_MEMPROTECT                              61
 #define SECCLASS_PEER                                    68
 #define SECCLASS_CAPABILITY2                             69
+#define SECCLASS_KERNEL_SERVICE                          74
 /*
 * Security identifier indices for initial entities
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index f8be8d7fa26d..3cc45168f674 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -77,17 +77,6 @@ struct ipc_security_struct {
        u32 sid;        /* SID of IPC resource */
 };
-struct bprm_security_struct {
-        u32 sid;                /* SID for transformed process */
-        unsigned char set;
-        /*
-         * unsafe is used to share failure information from bprm_apply_creds()
-         * to bprm_post_apply_creds().
-         */
-        char unsafe;
-};
 struct netif_security_struct {
        int ifindex;                    /* device index */
        u32 sid;                        /* SID for this interface */
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index ff59c0c4804b..4ed7bab89c59 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -63,6 +63,9 @@ static struct nlmsg_perm nlmsg_route_perms[] =
        { RTM_GETANYCAST,       NETLINK_ROUTE_SOCKET__NLMSG_READ  },
        { RTM_GETNEIGHTBL,      NETLINK_ROUTE_SOCKET__NLMSG_READ  },
        { RTM_SETNEIGHTBL,      NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_NEWADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_DELADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
+        { RTM_GETADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_READ  },
 };
 static struct nlmsg_perm nlmsg_firewall_perms[] =
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 69c9dccc8cf0..c86303638235 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -95,13 +95,18 @@ extern void selnl_notify_setenforce(int val);
 static int task_has_security(struct task_struct *tsk,
                             u32 perms)
 {
-        struct task_security_struct *tsec;
+        const struct task_security_struct *tsec;
+        u32 sid = 0;
-        tsec = tsk->security;
+        rcu_read_lock();
+        tsec = __task_cred(tsk)->security;
+        if (tsec)
+                sid = tsec->sid;
+        rcu_read_unlock();
        if (!tsec)
                return -EACCES;
-        return avc_has_perm(tsec->sid, SECINITSID_SECURITY,
+        return avc_has_perm(sid, SECINITSID_SECURITY,
                            SECCLASS_SECURITY, perms, NULL);
 }
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 8f17f542a116..c0eb72013d67 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -197,7 +197,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
        struct xfrm_user_sec_ctx *uctx, u32 sid)
 {
        int rc = 0;
-        struct task_security_struct *tsec = current->security;
+        const struct task_security_struct *tsec = current_security();
        struct xfrm_sec_ctx *ctx = NULL;
        char *ctx_str = NULL;
        u32 str_len;
@@ -333,7 +333,7 @@ void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
 */
 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 {
-        struct task_security_struct *tsec = current->security;
+        const struct task_security_struct *tsec = current_security();
        int rc = 0;
        if (ctx) {
@@ -378,7 +378,7 @@ void selinux_xfrm_state_free(struct xfrm_state *x)
  */
 int selinux_xfrm_state_delete(struct xfrm_state *x)
 {
-        struct task_security_struct *tsec = current->security;
+        const struct task_security_struct *tsec = current_security();
        struct xfrm_sec_ctx *ctx = x->security;
        int rc = 0;
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 79ff21ed4c3b..247cec3b5a43 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -164,7 +164,7 @@ int smk_curacc(char *obj_label, u32 mode)
 {
        int rc;
-        rc = smk_access(current->security, obj_label, mode);
+        rc = smk_access(current_security(), obj_label, mode);
        if (rc == 0)
                return 0;
@@ -173,7 +173,7 @@ int smk_curacc(char *obj_label, u32 mode)
         * only one that gets privilege and current does not
         * have that label.
         */
-        if (smack_onlycap != NULL && smack_onlycap != current->security)
+        if (smack_onlycap != NULL && smack_onlycap != current->cred->security)
                return rc;
        if (capable(CAP_MAC_OVERRIDE))
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 6e2dc0bab70d..8ad48161cef5 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -30,6 +30,8 @@
 #include "smack.h"
+#define task_security(task)     (task_cred_xxx((task), security))
 /*
 * I hope these are the hokeyist lines of code in the module. Casey.
 */
@@ -102,7 +104,7 @@ static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode)
        if (rc != 0)
                return rc;
-        rc = smk_access(current->security, ctp->security, MAY_READWRITE);
+        rc = smk_access(current_security(), task_security(ctp), MAY_READWRITE);
        if (rc != 0 && capable(CAP_MAC_OVERRIDE))
                return 0;
        return rc;
@@ -124,7 +126,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
        if (rc != 0)
                return rc;
-        rc = smk_access(ptp->security, current->security, MAY_READWRITE);
+        rc = smk_access(task_security(ptp), current_security(), MAY_READWRITE);
        if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE))
                return 0;
        return rc;
@@ -141,7 +143,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
 static int smack_syslog(int type)
 {
        int rc;
-        char *sp = current->security;
+        char *sp = current_security();
        rc = cap_syslog(type);
        if (rc != 0)
@@ -373,7 +375,7 @@ static int smack_sb_umount(struct vfsmount *mnt, int flags)
 */
 static int smack_inode_alloc_security(struct inode *inode)
 {
-        inode->i_security = new_inode_smack(current->security);
+        inode->i_security = new_inode_smack(current_security());
        if (inode->i_security == NULL)
                return -ENOMEM;
        return 0;
@@ -818,7 +820,7 @@ static int smack_file_permission(struct file *file, int mask)
 */
 static int smack_file_alloc_security(struct file *file)
 {
-        file->f_security = current->security;
+        file->f_security = current_security();
        return 0;
 }
@@ -916,7 +918,7 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
 */
 static int smack_file_set_fowner(struct file *file)
 {
-        file->f_security = current->security;
+        file->f_security = current_security();
        return 0;
 }
@@ -941,7 +943,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
         * struct fown_struct is never outside the context of a struct file
         */
        file = container_of(fown, struct file, f_owner);
-        rc = smk_access(file->f_security, tsk->security, MAY_WRITE);
+        rc = smk_access(file->f_security, tsk->cred->security, MAY_WRITE);
        if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
                return 0;
        return rc;
@@ -973,33 +975,75 @@ static int smack_file_receive(struct file *file)
 */
 /**
- * smack_task_alloc_security - "allocate" a task blob
+ * smack_cred_free - "free" task-level security credentials
- * @tsk: the task in need of a blob
+ * @cred: the credentials in question
 *
 * Smack isn't using copies of blobs. Everyone
- * points to an immutable list. No alloc required.
+ * points to an immutable list. The blobs never go away.
- * No data copy required.
+ * There is no leak here.
+ */
+static void smack_cred_free(struct cred *cred)
+{
+        cred->security = NULL;
+}
+/**
+ * smack_cred_prepare - prepare new set of credentials for modification
+ * @new: the new credentials
+ * @old: the original credentials
+ * @gfp: the atomicity of any memory allocations
+ *
+ * Prepare a new set of credentials for modification.
+ */
+static int smack_cred_prepare(struct cred *new, const struct cred *old,
+                              gfp_t gfp)
+{
+        new->security = old->security;
+        return 0;
+}
+/*
+ * commit new credentials
+ * @new: the new credentials
+ * @old: the original credentials
+ */
+static void smack_cred_commit(struct cred *new, const struct cred *old)
+{
+}
+/**
+ * smack_kernel_act_as - Set the subjective context in a set of credentials
+ * @new points to the set of credentials to be modified.
+ * @secid specifies the security ID to be set
 *
- * Always returns 0
+ * Set the security data for a kernel service.
 */
-static int smack_task_alloc_security(struct task_struct *tsk)
+static int smack_kernel_act_as(struct cred *new, u32 secid)
 {
-        tsk->security = current->security;
+        char *smack = smack_from_secid(secid);
+        if (smack == NULL)
+                return -EINVAL;
+        new->security = smack;
        return 0;
 }
 /**
- * smack_task_free_security - "free" a task blob
+ * smack_kernel_create_files_as - Set the file creation label in a set of creds
- * @task: the task with the blob
+ * @new points to the set of credentials to be modified
+ * @inode points to the inode to use as a reference
 *
- * Smack isn't using copies of blobs. Everyone
+ * Set the file creation context in a set of credentials to the same
- * points to an immutable list. The blobs never go away.
+ * as the objective context of the specified inode
- * There is no leak here.
 */
-static void smack_task_free_security(struct task_struct *task)
+static int smack_kernel_create_files_as(struct cred *new,
+                                        struct inode *inode)
 {
-        task->security = NULL;
+        struct inode_smack *isp = inode->i_security;
+        new->security = isp->smk_inode;
+        return 0;
 }
 /**
@@ -1011,7 +1055,7 @@ static void smack_task_free_security(struct task_struct *task)
 */
 static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
 {
-        return smk_curacc(p->security, MAY_WRITE);
+        return smk_curacc(task_security(p), MAY_WRITE);
 }
 /**
@@ -1022,7 +1066,7 @@ static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
 */
 static int smack_task_getpgid(struct task_struct *p)
 {
-        return smk_curacc(p->security, MAY_READ);
+        return smk_curacc(task_security(p), MAY_READ);
 }
 /**
@@ -1033,7 +1077,7 @@ static int smack_task_getpgid(struct task_struct *p)
 */
 static int smack_task_getsid(struct task_struct *p)
 {
-        return smk_curacc(p->security, MAY_READ);
+        return smk_curacc(task_security(p), MAY_READ);
 }
 /**
@@ -1045,7 +1089,7 @@ static int smack_task_getsid(struct task_struct *p)
 */
 static void smack_task_getsecid(struct task_struct *p, u32 *secid)
 {
-        *secid = smack_to_secid(p->security);
+        *secid = smack_to_secid(task_security(p));
 }
 /**
@@ -1061,7 +1105,7 @@ static int smack_task_setnice(struct task_struct *p, int nice)
        rc = cap_task_setnice(p, nice);
        if (rc == 0)
-                rc = smk_curacc(p->security, MAY_WRITE);
+                rc = smk_curacc(task_security(p), MAY_WRITE);
        return rc;
 }
@@ -1078,7 +1122,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio)
        rc = cap_task_setioprio(p, ioprio);
        if (rc == 0)
-                rc = smk_curacc(p->security, MAY_WRITE);
+                rc = smk_curacc(task_security(p), MAY_WRITE);
        return rc;
 }
@@ -1090,7 +1134,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio)
 */
 static int smack_task_getioprio(struct task_struct *p)
 {
-        return smk_curacc(p->security, MAY_READ);
+        return smk_curacc(task_security(p), MAY_READ);
 }
 /**
@@ -1108,7 +1152,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy,
        rc = cap_task_setscheduler(p, policy, lp);
        if (rc == 0)
-                rc = smk_curacc(p->security, MAY_WRITE);
+                rc = smk_curacc(task_security(p), MAY_WRITE);
        return rc;
 }
@@ -1120,7 +1164,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy,
 */
 static int smack_task_getscheduler(struct task_struct *p)
 {
-        return smk_curacc(p->security, MAY_READ);
+        return smk_curacc(task_security(p), MAY_READ);
 }
 /**
@@ -1131,7 +1175,7 @@ static int smack_task_getscheduler(struct task_struct *p)
 */
 static int smack_task_movememory(struct task_struct *p)
 {
-        return smk_curacc(p->security, MAY_WRITE);
+        return smk_curacc(task_security(p), MAY_WRITE);
 }
 /**
@@ -1154,13 +1198,13 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
         * can write the receiver.
         */
        if (secid == 0)
-                return smk_curacc(p->security, MAY_WRITE);
+                return smk_curacc(task_security(p), MAY_WRITE);
        /*
         * If the secid isn't 0 we're dealing with some USB IO
         * specific behavior. This is not clean. For one thing
         * we can't take privilege into account.
         */
-        return smk_access(smack_from_secid(secid), p->security, MAY_WRITE);
+        return smk_access(smack_from_secid(secid), task_security(p), MAY_WRITE);
 }
 /**
@@ -1173,7 +1217,7 @@ static int smack_task_wait(struct task_struct *p)
 {
        int rc;
-        rc = smk_access(current->security, p->security, MAY_WRITE);
+        rc = smk_access(current_security(), task_security(p), MAY_WRITE);
        if (rc == 0)
                return 0;
@@ -1204,7 +1248,7 @@ static int smack_task_wait(struct task_struct *p)
 static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
 {
        struct inode_smack *isp = inode->i_security;
-        isp->smk_inode = p->security;
+        isp->smk_inode = task_security(p);
 }
 /*
@@ -1223,7 +1267,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
 */
 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
 {
-        char *csp = current->security;
+        char *csp = current_security();
        struct socket_smack *ssp;
        ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
@@ -1448,7 +1492,7 @@ static int smack_flags_to_may(int flags)
 */
 static int smack_msg_msg_alloc_security(struct msg_msg *msg)
 {
-        msg->security = current->security;
+        msg->security = current_security();
        return 0;
 }
@@ -1484,7 +1528,7 @@ static int smack_shm_alloc_security(struct shmid_kernel *shp)
 {
        struct kern_ipc_perm *isp = &shp->shm_perm;
-        isp->security = current->security;
+        isp->security = current_security();
        return 0;
 }
@@ -1593,7 +1637,7 @@ static int smack_sem_alloc_security(struct sem_array *sma)
 {
        struct kern_ipc_perm *isp = &sma->sem_perm;
-        isp->security = current->security;
+        isp->security = current_security();
        return 0;
 }
@@ -1697,7 +1741,7 @@ static int smack_msg_queue_alloc_security(struct msg_queue *msq)
 {
        struct kern_ipc_perm *kisp = &msq->q_perm;
-        kisp->security = current->security;
+        kisp->security = current_security();
        return 0;
 }
@@ -1852,7 +1896,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
        struct super_block *sbp;
        struct superblock_smack *sbsp;
        struct inode_smack *isp;
-        char *csp = current->security;
+        char *csp = current_security();
        char *fetched;
        char *final;
        struct dentry *dp;
@@ -2009,7 +2053,7 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
        if (strcmp(name, "current") != 0)
                return -EINVAL;
-        cp = kstrdup(p->security, GFP_KERNEL);
+        cp = kstrdup(task_security(p), GFP_KERNEL);
        if (cp == NULL)
                return -ENOMEM;
@@ -2033,6 +2077,7 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
 static int smack_setprocattr(struct task_struct *p, char *name,
                             void *value, size_t size)
 {
+        struct cred *new;
        char *newsmack;
        /*
@@ -2055,7 +2100,11 @@ static int smack_setprocattr(struct task_struct *p, char *name,
        if (newsmack == NULL)
                return -EINVAL;
-        p->security = newsmack;
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        new->security = newsmack;
+        commit_creds(new);
        return size;
 }
@@ -2288,8 +2337,7 @@ static void smack_sock_graft(struct sock *sk, struct socket *parent)
                return;
        ssp = sk->sk_security;
-        ssp->smk_in = current->security;
+        ssp->smk_in = ssp->smk_out = current_security();
-        ssp->smk_out = current->security;
        ssp->smk_packet[0] = '\0';
        rc = smack_netlabel(sk);
@@ -2352,17 +2400,17 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
 /**
 * smack_key_alloc - Set the key security blob
 * @key: object
- * @tsk: the task associated with the key
+ * @cred: the credentials to use
 * @flags: unused
 *
 * No allocation required
 *
 * Returns 0
 */
-static int smack_key_alloc(struct key *key, struct task_struct *tsk,
+static int smack_key_alloc(struct key *key, const struct cred *cred,
                           unsigned long flags)
 {
-        key->security = tsk->security;
+        key->security = cred->security;
        return 0;
 }
@@ -2380,14 +2428,14 @@ static void smack_key_free(struct key *key)
 /*
 * smack_key_permission - Smack access on a key
 * @key_ref: gets to the object
- * @context: task involved
+ * @cred: the credentials to use
 * @perm: unused
 *
 * Return 0 if the task has read and write to the object,
 * an error code otherwise
 */
 static int smack_key_permission(key_ref_t key_ref,
-                                struct task_struct *context, key_perm_t perm)
+                                const struct cred *cred, key_perm_t perm)
 {
        struct key *keyp;
@@ -2403,10 +2451,10 @@ static int smack_key_permission(key_ref_t key_ref,
        /*
         * This should not occur
         */
-        if (context->security == NULL)
+        if (cred->security == NULL)
                return -EACCES;
-        return smk_access(context->security, keyp->security, MAY_READWRITE);
+        return smk_access(cred->security, keyp->security, MAY_READWRITE);
 }
 #endif /* CONFIG_KEYS */
@@ -2577,15 +2625,13 @@ struct security_operations smack_ops = {
        .ptrace_may_access =            smack_ptrace_may_access,
        .ptrace_traceme =               smack_ptrace_traceme,
        .capget =                       cap_capget,
-        .capset_check =                 cap_capset_check,
+        .capset =                       cap_capset,
-        .capset_set =                   cap_capset_set,
        .capable =                      cap_capable,
        .syslog =                       smack_syslog,
        .settime =                      cap_settime,
        .vm_enough_memory =             cap_vm_enough_memory,
-        .bprm_apply_creds =             cap_bprm_apply_creds,
+        .bprm_set_creds =               cap_bprm_set_creds,
-        .bprm_set_security =            cap_bprm_set_security,
        .bprm_secureexec =              cap_bprm_secureexec,
        .sb_alloc_security =            smack_sb_alloc_security,
@@ -2627,9 +2673,12 @@ struct security_operations smack_ops = {
        .file_send_sigiotask =          smack_file_send_sigiotask,
        .file_receive =                 smack_file_receive,
-        .task_alloc_security =          smack_task_alloc_security,
+        .cred_free =                    smack_cred_free,
-        .task_free_security =           smack_task_free_security,
+        .cred_prepare =                 smack_cred_prepare,
-        .task_post_setuid =             cap_task_post_setuid,
+        .cred_commit =                  smack_cred_commit,
+        .kernel_act_as =                smack_kernel_act_as,
+        .kernel_create_files_as =       smack_kernel_create_files_as,
+        .task_fix_setuid =              cap_task_fix_setuid,
        .task_setpgid =                 smack_task_setpgid,
        .task_getpgid =                 smack_task_getpgid,
        .task_getsid =                  smack_task_getsid,
@@ -2642,7 +2691,6 @@ struct security_operations smack_ops = {
        .task_movememory =              smack_task_movememory,
        .task_kill =                    smack_task_kill,
        .task_wait =                    smack_task_wait,
-        .task_reparent_to_init =        cap_task_reparent_to_init,
        .task_to_inode =                smack_task_to_inode,
        .task_prctl =                   cap_task_prctl,
@@ -2718,6 +2766,8 @@ struct security_operations smack_ops = {
 */
 static __init int smack_init(void)
 {
+        struct cred *cred;
        if (!security_module_enable(&smack_ops))
                return 0;
@@ -2726,7 +2776,8 @@ static __init int smack_init(void)
        /*
         * Set the security state for the initial task.
         */
-        current->security = &smack_known_floor.smk_known;
+        cred = (struct cred *) current->cred;
+        cred->security = &smack_known_floor.smk_known;
        /*
         * Initialize locks
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index c21d8c8bf0c7..ca257dfdc75d 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -336,7 +336,7 @@ static void smk_cipso_doi(void)
        audit_info.loginuid = audit_get_loginuid(current);
        audit_info.sessionid = audit_get_sessionid(current);
-        audit_info.secid = smack_to_secid(current->security);
+        audit_info.secid = smack_to_secid(current_security());
        rc = netlbl_cfg_map_del(NULL, &audit_info);
        if (rc != 0)
@@ -371,7 +371,7 @@ static void smk_unlbl_ambient(char *oldambient)
        audit_info.loginuid = audit_get_loginuid(current);
        audit_info.sessionid = audit_get_sessionid(current);
-        audit_info.secid = smack_to_secid(current->security);
+        audit_info.secid = smack_to_secid(current_security());
        if (oldambient != NULL) {
                rc = netlbl_cfg_map_del(oldambient, &audit_info);
@@ -843,7 +843,7 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
                                 size_t count, loff_t *ppos)
 {
        char in[SMK_LABELLEN];
-        char *sp = current->security;
+        char *sp = current->cred->security;
        if (!capable(CAP_MAC_ADMIN))
                return -EPERM;