7 files changed, 98 insertions, 111 deletions

diff --git a/security/apparmor/path.c b/security/apparmor/path.c
index 36cc0cc39e78..b566eba4a65c 100644
--- a/security/apparmor/path.c
+++ b/security/apparmor/path.c
@@ -57,23 +57,44 @@ static int prepend(char **buffer, int buflen, const char *str, int namelen)
 static int d_namespace_path(struct path *path, char *buf, int buflen,
                             char **name, int flags)
 {
-        struct path root, tmp;
         char *res;
-        int connected, error = 0;
+        int error = 0;
+        int connected = 1;
+
+        if (path->mnt->mnt_flags & MNT_INTERNAL) {
+                /* it's not mounted anywhere */
+                res = dentry_path(path->dentry, buf, buflen);
+                *name = res;
+                if (IS_ERR(res)) {
+                        *name = buf;
+                        return PTR_ERR(res);
+                }
+                if (path->dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
+                    strncmp(*name, "/sys/", 5) == 0) {
+                        /* TODO: convert over to using a per namespace
+                         * control instead of hard coded /proc
+                         */
+                        return prepend(name, *name - buf, "/proc", 5);
+                }
+                return 0;
+        }
 
-        /* Get the root we want to resolve too, released below */
+        /* resolve paths relative to chroot?*/
         if (flags & PATH_CHROOT_REL) {
-                /* resolve paths relative to chroot */
+                struct path root;
                 get_fs_root(current->fs, &root);
-        } else {
-                /* resolve paths relative to namespace */
-                root.mnt = current->nsproxy->mnt_ns->root;
-                root.dentry = root.mnt->mnt_root;
-                path_get(&root);
+                res = __d_path(path, &root, buf, buflen);
+                if (res && !IS_ERR(res)) {
+                        /* everything's fine */
+                        *name = res;
+                        path_put(&root);
+                        goto ok;
+                }
+                path_put(&root);
+                connected = 0;
         }
 
-        tmp = root;
-        res = __d_path(path, &tmp, buf, buflen);
+        res = d_absolute_path(path, buf, buflen);
 
         *name = res;
         /* handle error conditions - and still allow a partial path to
@@ -84,7 +105,10 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                 *name = buf;
                 goto out;
         }
+        if (!our_mnt(path->mnt))
+                connected = 0;
 
+ok:
         /* Handle two cases:
          * 1. A deleted dentry && profile is not allowing mediation of deleted
          * 2. On some filesystems, newly allocated dentries appear to the
@@ -97,10 +121,7 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
                         goto out;
         }
 
-        /* Determine if the path is connected to the expected root */
-        connected = tmp.dentry == root.dentry && tmp.mnt == root.mnt;
-
-        /* If the path is not connected,
+        /* If the path is not connected to the expected root,
          * check if it is a sysctl and handle specially else remove any
          * leading / that __d_path may have returned.
          * Unless
@@ -112,17 +133,9 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
          *     namespace root.
          */
         if (!connected) {
-                /* is the disconnect path a sysctl? */
-                if (tmp.dentry->d_sb->s_magic == PROC_SUPER_MAGIC &&
-                    strncmp(*name, "/sys/", 5) == 0) {
-                        /* TODO: convert over to using a per namespace
-                         * control instead of hard coded /proc
-                         */
-                        error = prepend(name, *name - buf, "/proc", 5);
-                } else if (!(flags & PATH_CONNECT_PATH) &&
+                if (!(flags & PATH_CONNECT_PATH) &&
                            !(((flags & CHROOT_NSCONNECT) == CHROOT_NSCONNECT) &&
-                             (tmp.mnt == current->nsproxy->mnt_ns->root &&
-                              tmp.dentry == tmp.mnt->mnt_root))) {
+                             our_mnt(path->mnt))) {
                         /* disconnected path, don't return pathname starting
                          * with '/'
                          */
@@ -133,8 +146,6 @@ static int d_namespace_path(struct path *path, char *buf, int buflen,
         }
 
 out:
-        path_put(&root);
-
         return error;
 }
 
diff --git a/security/keys/encrypted-keys/Makefile b/security/keys/encrypted-keys/Makefile
index 6bc7a86d1027..d6f8433250a5 100644
--- a/security/keys/encrypted-keys/Makefile
+++ b/security/keys/encrypted-keys/Makefile
@@ -2,5 +2,9 @@
 # Makefile for encrypted keys
 #
 
-obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o ecryptfs_format.o
-obj-$(CONFIG_TRUSTED_KEYS) += masterkey_trusted.o
+obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted-keys.o
+
+encrypted-keys-y := encrypted.o ecryptfs_format.o
+masterkey-$(CONFIG_TRUSTED_KEYS) := masterkey_trusted.o
+masterkey-$(CONFIG_TRUSTED_KEYS)-$(CONFIG_ENCRYPTED_KEYS) := masterkey_trusted.o
+encrypted-keys-y += $(masterkey-y) $(masterkey-m-m)
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index dcc843cb0f80..41144f71d615 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -444,7 +444,7 @@ static struct key *request_master_key(struct encrypted_key_payload *epayload,
                 goto out;
 
         if (IS_ERR(mkey)) {
-                int ret = PTR_ERR(epayload);
+                int ret = PTR_ERR(mkey);
 
                 if (ret == -ENOTSUPP)
                         pr_info("encrypted_key: key %s not supported",
diff --git a/security/keys/encrypted-keys/encrypted.h b/security/keys/encrypted-keys/encrypted.h
index b6ade8945250..8136a2d44c63 100644
--- a/security/keys/encrypted-keys/encrypted.h
+++ b/security/keys/encrypted-keys/encrypted.h
@@ -2,7 +2,8 @@
 #define __ENCRYPTED_KEY_H
 
 #define ENCRYPTED_DEBUG 0
-#ifdef CONFIG_TRUSTED_KEYS
+#if defined(CONFIG_TRUSTED_KEYS) || \
+  (defined(CONFIG_TRUSTED_KEYS_MODULE) && defined(CONFIG_ENCRYPTED_KEYS_MODULE))
 extern struct key *request_trusted_key(const char *trusted_desc,
                                        u8 **master_key, size_t *master_keylen);
 #else
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 5b366d7af3c4..69ff52c08e97 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -102,7 +102,8 @@ int user_update(struct key *key, const void *data, size_t datalen)
                 key->expiry = 0;
         }
 
-        kfree_rcu(zap, rcu);
+        if (zap)
+                kfree_rcu(zap, rcu);
 
 error:
         return ret;
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 6aceef518a41..5c32f36ff706 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -102,9 +102,6 @@ static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
 
 const char *smack_cipso_option = SMACK_CIPSO_OPTION;
 
-
-#define SEQ_READ_FINISHED       ((loff_t)-1)
-
 /*
  * Values for parsing cipso rules
  * SMK_DIGITLEN: Length of a digit field in a rule.
@@ -357,10 +354,12 @@ static ssize_t smk_write_load_list(struct file *file, const char __user *buf,
 
         rc = count;
         /*
+         * If this is "load" as opposed to "load-self" and a new rule
+         * it needs to get added for reporting.
          * smk_set_access returns true if there was already a rule
          * for the subject/object pair, and false if it was new.
          */
-        if (!smk_set_access(rule, rule_list, rule_lock)) {
+        if (load && !smk_set_access(rule, rule_list, rule_lock)) {
                 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
                 if (smlp != NULL) {
                         smlp->smk_rule = rule;
@@ -377,12 +376,12 @@ out:
         return rc;
 }
 
-
 /*
- * Seq_file read operations for /smack/load
+ * Core logic for smackfs seq list operations.
  */
 
-static void *load_seq_start(struct seq_file *s, loff_t *pos)
+static void *smk_seq_start(struct seq_file *s, loff_t *pos,
+                                struct list_head *head)
 {
         struct list_head *list;
 
@@ -390,7 +389,7 @@ static void *load_seq_start(struct seq_file *s, loff_t *pos)
          * This is 0 the first time through.
          */
         if (s->index == 0)
-                s->private = &smack_rule_list;
+                s->private = head;
 
         if (s->private == NULL)
                 return NULL;
@@ -404,11 +403,12 @@ static void *load_seq_start(struct seq_file *s, loff_t *pos)
         return list;
 }
 
-static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos)
+static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
+                                struct list_head *head)
 {
         struct list_head *list = v;
 
-        if (list_is_last(list, &smack_rule_list)) {
+        if (list_is_last(list, head)) {
                 s->private = NULL;
                 return NULL;
         }
@@ -416,6 +416,25 @@ static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos)
         return list->next;
 }
 
+static void smk_seq_stop(struct seq_file *s, void *v)
+{
+        /* No-op */
+}
+
+/*
+ * Seq_file read operations for /smack/load
+ */
+
+static void *load_seq_start(struct seq_file *s, loff_t *pos)
+{
+        return smk_seq_start(s, pos, &smack_rule_list);
+}
+
+static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos)
+{
+        return smk_seq_next(s, v, pos, &smack_rule_list);
+}
+
 static int load_seq_show(struct seq_file *s, void *v)
 {
         struct list_head *list = v;
@@ -446,16 +465,11 @@ static int load_seq_show(struct seq_file *s, void *v)
         return 0;
 }
 
-static void load_seq_stop(struct seq_file *s, void *v)
-{
-        /* No-op */
-}
-
 static const struct seq_operations load_seq_ops = {
         .start = load_seq_start,
         .next  = load_seq_next,
         .show  = load_seq_show,
-        .stop  = load_seq_stop,
+        .stop  = smk_seq_stop,
 };
 
 /**
@@ -574,28 +588,12 @@ static void smk_unlbl_ambient(char *oldambient)
 
 static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
 {
-        if (*pos == SEQ_READ_FINISHED)
-                return NULL;
-        if (list_empty(&smack_known_list))
-                return NULL;
-
-        return smack_known_list.next;
+        return smk_seq_start(s, pos, &smack_known_list);
 }
 
 static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct list_head  *list = v;
-
-        /*
-         * labels with no associated cipso value wont be printed
-         * in cipso_seq_show
-         */
-        if (list_is_last(list, &smack_known_list)) {
-                *pos = SEQ_READ_FINISHED;
-                return NULL;
-        }
-
-        return list->next;
+        return smk_seq_next(s, v, pos, &smack_known_list);
 }
 
 /*
@@ -634,16 +632,11 @@ static int cipso_seq_show(struct seq_file *s, void *v)
         return 0;
 }
 
-static void cipso_seq_stop(struct seq_file *s, void *v)
-{
-        /* No-op */
-}
-
 static const struct seq_operations cipso_seq_ops = {
         .start = cipso_seq_start,
-        .stop  = cipso_seq_stop,
         .next  = cipso_seq_next,
         .show  = cipso_seq_show,
+        .stop  = smk_seq_stop,
 };
 
 /**
@@ -788,23 +781,12 @@ static const struct file_operations smk_cipso_ops = {
 
 static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
 {
-        if (*pos == SEQ_READ_FINISHED)
-                return NULL;
-        if (list_empty(&smk_netlbladdr_list))
-                return NULL;
-        return smk_netlbladdr_list.next;
+        return smk_seq_start(s, pos, &smk_netlbladdr_list);
 }
 
 static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct list_head *list = v;
-
-        if (list_is_last(list, &smk_netlbladdr_list)) {
-                *pos = SEQ_READ_FINISHED;
-                return NULL;
-        }
-
-        return list->next;
+        return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
 }
 #define BEBITS  (sizeof(__be32) * 8)
 
@@ -828,16 +810,11 @@ static int netlbladdr_seq_show(struct seq_file *s, void *v)
         return 0;
 }
 
-static void netlbladdr_seq_stop(struct seq_file *s, void *v)
-{
-        /* No-op */
-}
-
 static const struct seq_operations netlbladdr_seq_ops = {
         .start = netlbladdr_seq_start,
-        .stop  = netlbladdr_seq_stop,
         .next  = netlbladdr_seq_next,
         .show  = netlbladdr_seq_show,
+        .stop  = smk_seq_stop,
 };
 
 /**
@@ -1405,23 +1382,14 @@ static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
 {
         struct task_smack *tsp = current_security();
 
-        if (*pos == SEQ_READ_FINISHED)
-                return NULL;
-        if (list_empty(&tsp->smk_rules))
-                return NULL;
-        return tsp->smk_rules.next;
+        return smk_seq_start(s, pos, &tsp->smk_rules);
 }
 
 static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
         struct task_smack *tsp = current_security();
-        struct list_head *list = v;
 
-        if (list_is_last(list, &tsp->smk_rules)) {
-                *pos = SEQ_READ_FINISHED;
-                return NULL;
-        }
-        return list->next;
+        return smk_seq_next(s, v, pos, &tsp->smk_rules);
 }
 
 static int load_self_seq_show(struct seq_file *s, void *v)
@@ -1453,16 +1421,11 @@ static int load_self_seq_show(struct seq_file *s, void *v)
         return 0;
 }
 
-static void load_self_seq_stop(struct seq_file *s, void *v)
-{
-        /* No-op */
-}
-
 static const struct seq_operations load_self_seq_ops = {
         .start = load_self_seq_start,
         .next  = load_self_seq_next,
         .show  = load_self_seq_show,
-        .stop  = load_self_seq_stop,
+        .stop  = smk_seq_stop,
 };
 
 
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index 738bbdf8d4c7..d9f3ced8756e 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -101,9 +101,8 @@ static char *tomoyo_get_absolute_path(struct path *path, char * const buffer,
 {
         char *pos = ERR_PTR(-ENOMEM);
         if (buflen >= 256) {
-                struct path ns_root = { };
                 /* go to whatever namespace root we are under */
-                pos = __d_path(path, &ns_root, buffer, buflen - 1);
+                pos = d_absolute_path(path, buffer, buflen - 1);
                 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
                         struct inode *inode = path->dentry->d_inode;
                         if (inode && S_ISDIR(inode->i_mode)) {
@@ -294,8 +293,16 @@ char *tomoyo_realpath_from_path(struct path *path)
                         pos = tomoyo_get_local_path(path->dentry, buf,
                                                     buf_len - 1);
                 /* Get absolute name for the rest. */
-                else
+                else {
                         pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
+                        /*
+                         * Fall back to local name if absolute name is not
+                         * available.
+                         */
+                        if (pos == ERR_PTR(-EINVAL))
+                                pos = tomoyo_get_local_path(path->dentry, buf,
+                                                            buf_len - 1);
+                }
 encode:
                 if (IS_ERR(pos))
                         continue;