8 files changed, 214 insertions, 335 deletions

diff --git a/security/capability.c b/security/capability.c
index efeb6d9e0e6a..185804f99ad1 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -32,24 +32,19 @@ static int cap_quota_on(struct dentry *dentry)
         return 0;
 }
 
-static int cap_bprm_alloc_security(struct linux_binprm *bprm)
+static int cap_bprm_check_security (struct linux_binprm *bprm)
 {
         return 0;
 }
 
-static void cap_bprm_free_security(struct linux_binprm *bprm)
+static void cap_bprm_committing_creds(struct linux_binprm *bprm)
 {
 }
 
-static void cap_bprm_post_apply_creds(struct linux_binprm *bprm)
+static void cap_bprm_committed_creds(struct linux_binprm *bprm)
 {
 }
 
-static int cap_bprm_check_security(struct linux_binprm *bprm)
-{
-        return 0;
-}
-
 static int cap_sb_alloc_security(struct super_block *sb)
 {
         return 0;
@@ -827,11 +822,9 @@ void security_fixup_ops(struct security_operations *ops)
         set_to_cap_if_null(ops, syslog);
         set_to_cap_if_null(ops, settime);
         set_to_cap_if_null(ops, vm_enough_memory);
-        set_to_cap_if_null(ops, bprm_alloc_security);
-        set_to_cap_if_null(ops, bprm_free_security);
-        set_to_cap_if_null(ops, bprm_apply_creds);
-        set_to_cap_if_null(ops, bprm_post_apply_creds);
-        set_to_cap_if_null(ops, bprm_set_security);
+        set_to_cap_if_null(ops, bprm_set_creds);
+        set_to_cap_if_null(ops, bprm_committing_creds);
+        set_to_cap_if_null(ops, bprm_committed_creds);
         set_to_cap_if_null(ops, bprm_check_security);
         set_to_cap_if_null(ops, bprm_secureexec);
         set_to_cap_if_null(ops, sb_alloc_security);
diff --git a/security/commoncap.c b/security/commoncap.c
index b5419273f92d..51dfa11e8e56 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -167,7 +167,7 @@ int cap_capset(struct cred *new,
 
 static inline void bprm_clear_caps(struct linux_binprm *bprm)
 {
-        cap_clear(bprm->cap_post_exec_permitted);
+        cap_clear(bprm->cred->cap_permitted);
         bprm->cap_effective = false;
 }
 
@@ -198,15 +198,15 @@ int cap_inode_killpriv(struct dentry *dentry)
 }
 
 static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
-                                          struct linux_binprm *bprm)
+                                          struct linux_binprm *bprm,
+                                          bool *effective)
 {
+        struct cred *new = bprm->cred;
         unsigned i;
         int ret = 0;
 
         if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
-                bprm->cap_effective = true;
-        else
-                bprm->cap_effective = false;
+                *effective = true;
 
         CAP_FOR_EACH_U32(i) {
                 __u32 permitted = caps->permitted.cap[i];
@@ -215,16 +215,13 @@ static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
                 /*
                  * pP' = (X & fP) | (pI & fI)
                  */
-                bprm->cap_post_exec_permitted.cap[i] =
-                        (current->cred->cap_bset.cap[i] & permitted) |
-                        (current->cred->cap_inheritable.cap[i] & inheritable);
+                new->cap_permitted.cap[i] =
+                        (new->cap_bset.cap[i] & permitted) |
+                        (new->cap_inheritable.cap[i] & inheritable);
 
-                if (permitted & ~bprm->cap_post_exec_permitted.cap[i]) {
-                        /*
-                         * insufficient to execute correctly
-                         */
+                if (permitted & ~new->cap_permitted.cap[i])
+                        /* insufficient to execute correctly */
                         ret = -EPERM;
-                }
         }
 
         /*
@@ -232,7 +229,7 @@ static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
          * do not have enough capabilities, we return an error if they are
          * missing some "forced" (aka file-permitted) capabilities.
          */
-        return bprm->cap_effective ? ret : 0;
+        return *effective ? ret : 0;
 }
 
 int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
@@ -250,10 +247,9 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
 
         size = inode->i_op->getxattr((struct dentry *)dentry, XATTR_NAME_CAPS, &caps,
                                    XATTR_CAPS_SZ);
-        if (size == -ENODATA || size == -EOPNOTSUPP) {
+        if (size == -ENODATA || size == -EOPNOTSUPP)
                 /* no data, that's ok */
                 return -ENODATA;
-        }
         if (size < 0)
                 return size;
 
@@ -262,7 +258,7 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
 
         cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps.magic_etc);
 
-        switch ((magic_etc & VFS_CAP_REVISION_MASK)) {
+        switch (magic_etc & VFS_CAP_REVISION_MASK) {
         case VFS_CAP_REVISION_1:
                 if (size != XATTR_CAPS_SZ_1)
                         return -EINVAL;
@@ -283,11 +279,12 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
                 cpu_caps->permitted.cap[i] = le32_to_cpu(caps.data[i].permitted);
                 cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
         }
+
         return 0;
 }
 
 /* Locate any VFS capabilities: */
-static int get_file_caps(struct linux_binprm *bprm)
+static int get_file_caps(struct linux_binprm *bprm, bool *effective)
 {
         struct dentry *dentry;
         int rc = 0;
@@ -313,7 +310,10 @@ static int get_file_caps(struct linux_binprm *bprm)
                 goto out;
         }
 
-        rc = bprm_caps_from_vfs_caps(&vcaps, bprm);
+        rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective);
+        if (rc == -EINVAL)
+                printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
+                       __func__, rc, bprm->filename);
 
 out:
         dput(dentry);
@@ -334,18 +334,27 @@ int cap_inode_killpriv(struct dentry *dentry)
         return 0;
 }
 
-static inline int get_file_caps(struct linux_binprm *bprm)
+static inline int get_file_caps(struct linux_binprm *bprm, bool *effective)
 {
         bprm_clear_caps(bprm);
         return 0;
 }
 #endif
 
-int cap_bprm_set_security (struct linux_binprm *bprm)
+/*
+ * set up the new credentials for an exec'd task
+ */
+int cap_bprm_set_creds(struct linux_binprm *bprm)
 {
+        const struct cred *old = current_cred();
+        struct cred *new = bprm->cred;
+        bool effective;
         int ret;
 
-        ret = get_file_caps(bprm);
+        effective = false;
+        ret = get_file_caps(bprm, &effective);
+        if (ret < 0)
+                return ret;
 
         if (!issecure(SECURE_NOROOT)) {
                 /*
@@ -353,63 +362,47 @@ int cap_bprm_set_security (struct linux_binprm *bprm)
                  * executables under compatibility mode, we override the
                  * capability sets for the file.
                  *
-                 * If only the real uid is 0, we do not set the effective
-                 * bit.
+                 * If only the real uid is 0, we do not set the effective bit.
                  */
-                if (bprm->e_uid == 0 || current_uid() == 0) {
+                if (new->euid == 0 || new->uid == 0) {
                         /* pP' = (cap_bset & ~0) | (pI & ~0) */
-                        bprm->cap_post_exec_permitted = cap_combine(
-                                current->cred->cap_bset,
-                                current->cred->cap_inheritable);
-                        bprm->cap_effective = (bprm->e_uid == 0);
-                        ret = 0;
+                        new->cap_permitted = cap_combine(old->cap_bset,
+                                                         old->cap_inheritable);
                 }
+                if (new->euid == 0)
+                        effective = true;
         }
 
-        return ret;
-}
-
-int cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
-{
-        const struct cred *old = current_cred();
-        struct cred *new;
-
-        new = prepare_creds();
-        if (!new)
-                return -ENOMEM;
-
-        if (bprm->e_uid != old->uid || bprm->e_gid != old->gid ||
-            !cap_issubset(bprm->cap_post_exec_permitted,
-                          old->cap_permitted)) {
-                set_dumpable(current->mm, suid_dumpable);
-                current->pdeath_signal = 0;
-
-                if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
-                        if (!capable(CAP_SETUID)) {
-                                bprm->e_uid = old->uid;
-                                bprm->e_gid = old->gid;
-                        }
-                        if (cap_limit_ptraced_target()) {
-                                bprm->cap_post_exec_permitted = cap_intersect(
-                                        bprm->cap_post_exec_permitted,
-                                        new->cap_permitted);
-                        }
+        /* Don't let someone trace a set[ug]id/setpcap binary with the revised
+         * credentials unless they have the appropriate permit
+         */
+        if ((new->euid != old->uid ||
+             new->egid != old->gid ||
+             !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
+            bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
+                /* downgrade; they get no more than they had, and maybe less */
+                if (!capable(CAP_SETUID)) {
+                        new->euid = new->uid;
+                        new->egid = new->gid;
                 }
+                if (cap_limit_ptraced_target())
+                        new->cap_permitted = cap_intersect(new->cap_permitted,
+                                                           old->cap_permitted);
         }
 
-        new->suid = new->euid = new->fsuid = bprm->e_uid;
-        new->sgid = new->egid = new->fsgid = bprm->e_gid;
+        new->suid = new->fsuid = new->euid;
+        new->sgid = new->fsgid = new->egid;
 
-        /* For init, we want to retain the capabilities set
-         * in the init_task struct. Thus we skip the usual
-         * capability rules */
+        /* For init, we want to retain the capabilities set in the initial
+         * task.  Thus we skip the usual capability rules
+         */
         if (!is_global_init(current)) {
-                new->cap_permitted = bprm->cap_post_exec_permitted;
-                if (bprm->cap_effective)
-                        new->cap_effective = bprm->cap_post_exec_permitted;
+                if (effective)
+                        new->cap_effective = new->cap_permitted;
                 else
                         cap_clear(new->cap_effective);
         }
+        bprm->cap_effective = effective;
 
         /*
          * Audit candidate if current->cap_effective is set
@@ -425,23 +418,31 @@ int cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
          */
         if (!cap_isclear(new->cap_effective)) {
                 if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
-                    bprm->e_uid != 0 || new->uid != 0 ||
-                    issecure(SECURE_NOROOT))
-                        audit_log_bprm_fcaps(bprm, new, old);
+                    new->euid != 0 || new->uid != 0 ||
+                    issecure(SECURE_NOROOT)) {
+                        ret = audit_log_bprm_fcaps(bprm, new, old);
+                        if (ret < 0)
+                                return ret;
+                }
         }
 
         new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
-        return commit_creds(new);
+        return 0;
 }
 
-int cap_bprm_secureexec (struct linux_binprm *bprm)
+/*
+ * determine whether a secure execution is required
+ * - the creds have been committed at this point, and are no longer available
+ *   through bprm
+ */
+int cap_bprm_secureexec(struct linux_binprm *bprm)
 {
         const struct cred *cred = current_cred();
 
         if (cred->uid != 0) {
                 if (bprm->cap_effective)
                         return 1;
-                if (!cap_isclear(bprm->cap_post_exec_permitted))
+                if (!cap_isclear(cred->cap_permitted))
                         return 1;
         }
 
@@ -477,7 +478,7 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
 }
 
 /* moved from kernel/sys.c. */
-/* 
+/*
  * cap_emulate_setxuid() fixes the effective / permitted capabilities of
  * a process after a call to setuid, setreuid, or setresuid.
  *
@@ -491,10 +492,10 @@ int cap_inode_removexattr(struct dentry *dentry, const char *name)
  *  3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
  *  capabilities are set to the permitted capabilities.
  *
- *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should 
+ *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
  *  never happen.
  *
- *  -astor 
+ *  -astor
  *
  * cevans - New behaviour, Oct '99
  * A process may, via prctl(), elect to keep its capabilities when it
@@ -751,4 +752,3 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
                 cap_sys_admin = 1;
         return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
-
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index df329f684a65..2f5d89e92b85 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -276,48 +276,6 @@ static int install_session_keyring(struct key *keyring)
 
 /*****************************************************************************/
 /*
- * deal with execve()
- */
-int exec_keys(struct task_struct *tsk)
-{
-        struct thread_group_cred *tgcred = NULL;
-        struct cred *new;
-
-#ifdef CONFIG_KEYS
-        tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
-        if (!tgcred)
-                return -ENOMEM;
-#endif
-
-        new = prepare_creds();
-        if (new < 0)
-                return -ENOMEM;
-
-        /* newly exec'd tasks don't get a thread keyring */
-        key_put(new->thread_keyring);
-        new->thread_keyring = NULL;
-
-        /* create a new per-thread-group creds for all this set of threads to
-         * share */
-        memcpy(tgcred, new->tgcred, sizeof(struct thread_group_cred));
-
-        atomic_set(&tgcred->usage, 1);
-        spin_lock_init(&tgcred->lock);
-
-        /* inherit the session keyring; new process keyring */
-        key_get(tgcred->session_keyring);
-        tgcred->process_keyring = NULL;
-
-        release_tgcred(new);
-        new->tgcred = tgcred;
-
-        commit_creds(new);
-        return 0;
-
-} /* end exec_keys() */
-
-/*****************************************************************************/
-/*
  * the filesystem user ID changed
  */
 void key_fsuid_changed(struct task_struct *tsk)
diff --git a/security/root_plug.c b/security/root_plug.c
index c3f68b5b372d..40fb4f15e27b 100644
--- a/security/root_plug.c
+++ b/security/root_plug.c
@@ -55,9 +55,9 @@ static int rootplug_bprm_check_security (struct linux_binprm *bprm)
         struct usb_device *dev;
 
         root_dbg("file %s, e_uid = %d, e_gid = %d\n",
-                 bprm->filename, bprm->e_uid, bprm->e_gid);
+                 bprm->filename, bprm->cred->euid, bprm->cred->egid);
 
-        if (bprm->e_gid == 0) {
+        if (bprm->cred->egid == 0) {
                 dev = usb_find_device(vendor_id, product_id);
                 if (!dev) {
                         root_dbg("e_gid = 0, and device not found, "
@@ -75,15 +75,12 @@ static struct security_operations rootplug_security_ops = {
         .ptrace_may_access =            cap_ptrace_may_access,
         .ptrace_traceme =               cap_ptrace_traceme,
         .capget =                       cap_capget,
-        .capset_check =                 cap_capset_check,
-        .capset_set =                   cap_capset_set,
+        .capset =                       cap_capset,
         .capable =                      cap_capable,
 
-        .bprm_apply_creds =             cap_bprm_apply_creds,
-        .bprm_set_security =            cap_bprm_set_security,
+        .bprm_set_creds =               cap_bprm_set_creds,
 
-        .task_post_setuid =             cap_task_post_setuid,
-        .task_reparent_to_init =        cap_task_reparent_to_init,
+        .task_fix_setuid =              cap_task_fix_setuid,
         .task_prctl =                   cap_task_prctl,
 
         .bprm_check_security =          rootplug_bprm_check_security,
diff --git a/security/security.c b/security/security.c
index a55d739c6864..dc5babb2d6d8 100644
--- a/security/security.c
+++ b/security/security.c
@@ -213,34 +213,24 @@ int security_vm_enough_memory_kern(long pages)
         return security_ops->vm_enough_memory(current->mm, pages);
 }
 
-int security_bprm_alloc(struct linux_binprm *bprm)
+int security_bprm_set_creds(struct linux_binprm *bprm)
 {
-        return security_ops->bprm_alloc_security(bprm);
+        return security_ops->bprm_set_creds(bprm);
 }
 
-void security_bprm_free(struct linux_binprm *bprm)
-{
-        security_ops->bprm_free_security(bprm);
-}
-
-int security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
-{
-        return security_ops->bprm_apply_creds(bprm, unsafe);
-}
-
-void security_bprm_post_apply_creds(struct linux_binprm *bprm)
+int security_bprm_check(struct linux_binprm *bprm)
 {
-        security_ops->bprm_post_apply_creds(bprm);
+        return security_ops->bprm_check_security(bprm);
 }
 
-int security_bprm_set(struct linux_binprm *bprm)
+void security_bprm_committing_creds(struct linux_binprm *bprm)
 {
-        return security_ops->bprm_set_security(bprm);
+        return security_ops->bprm_committing_creds(bprm);
 }
 
-int security_bprm_check(struct linux_binprm *bprm)
+void security_bprm_committed_creds(struct linux_binprm *bprm)
 {
-        return security_ops->bprm_check_security(bprm);
+        return security_ops->bprm_committed_creds(bprm);
 }
 
 int security_bprm_secureexec(struct linux_binprm *bprm)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index c71bba78872f..21a592184633 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2029,59 +2029,45 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 
 /* binprm security operations */
 
-static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
+static int selinux_bprm_set_creds(struct linux_binprm *bprm)
 {
-        struct bprm_security_struct *bsec;
-
-        bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
-        if (!bsec)
-                return -ENOMEM;
-
-        bsec->sid = SECINITSID_UNLABELED;
-        bsec->set = 0;
-
-        bprm->security = bsec;
-        return 0;
-}
-
-static int selinux_bprm_set_security(struct linux_binprm *bprm)
-{
-        struct task_security_struct *tsec;
-        struct inode *inode = bprm->file->f_path.dentry->d_inode;
+        const struct task_security_struct *old_tsec;
+        struct task_security_struct *new_tsec;
         struct inode_security_struct *isec;
-        struct bprm_security_struct *bsec;
-        u32 newsid;
         struct avc_audit_data ad;
+        struct inode *inode = bprm->file->f_path.dentry->d_inode;
         int rc;
 
-        rc = secondary_ops->bprm_set_security(bprm);
+        rc = secondary_ops->bprm_set_creds(bprm);
         if (rc)
                 return rc;
 
-        bsec = bprm->security;
-
-        if (bsec->set)
+        /* SELinux context only depends on initial program or script and not
+         * the script interpreter */
+        if (bprm->cred_prepared)
                 return 0;
 
-        tsec = current_security();
+        old_tsec = current_security();
+        new_tsec = bprm->cred->security;
         isec = inode->i_security;
 
         /* Default to the current task SID. */
-        bsec->sid = tsec->sid;
+        new_tsec->sid = old_tsec->sid;
+        new_tsec->osid = old_tsec->sid;
 
         /* Reset fs, key, and sock SIDs on execve. */
-        tsec->create_sid = 0;
-        tsec->keycreate_sid = 0;
-        tsec->sockcreate_sid = 0;
+        new_tsec->create_sid = 0;
+        new_tsec->keycreate_sid = 0;
+        new_tsec->sockcreate_sid = 0;
 
-        if (tsec->exec_sid) {
-                newsid = tsec->exec_sid;
+        if (old_tsec->exec_sid) {
+                new_tsec->sid = old_tsec->exec_sid;
                 /* Reset exec SID on execve. */
-                tsec->exec_sid = 0;
+                new_tsec->exec_sid = 0;
         } else {
                 /* Check for a default transition on this program. */
-                rc = security_transition_sid(tsec->sid, isec->sid,
-                                             SECCLASS_PROCESS, &newsid);
+                rc = security_transition_sid(old_tsec->sid, isec->sid,
+                                             SECCLASS_PROCESS, &new_tsec->sid);
                 if (rc)
                         return rc;
         }
@@ -2090,33 +2076,63 @@ static int selinux_bprm_set_security(struct linux_binprm *bprm)
         ad.u.fs.path = bprm->file->f_path;
 
         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
-                newsid = tsec->sid;
+                new_tsec->sid = old_tsec->sid;
 
-        if (tsec->sid == newsid) {
-                rc = avc_has_perm(tsec->sid, isec->sid,
+        if (new_tsec->sid == old_tsec->sid) {
+                rc = avc_has_perm(old_tsec->sid, isec->sid,
                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
                 if (rc)
                         return rc;
         } else {
                 /* Check permissions for the transition. */
-                rc = avc_has_perm(tsec->sid, newsid,
+                rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
                 if (rc)
                         return rc;
 
-                rc = avc_has_perm(newsid, isec->sid,
+                rc = avc_has_perm(new_tsec->sid, isec->sid,
                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
                 if (rc)
                         return rc;
 
-                /* Clear any possibly unsafe personality bits on exec: */
-                current->personality &= ~PER_CLEAR_ON_SETID;
+                /* Check for shared state */
+                if (bprm->unsafe & LSM_UNSAFE_SHARE) {
+                        rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
+                                          SECCLASS_PROCESS, PROCESS__SHARE,
+                                          NULL);
+                        if (rc)
+                                return -EPERM;
+                }
+
+                /* Make sure that anyone attempting to ptrace over a task that
+                 * changes its SID has the appropriate permit */
+                if (bprm->unsafe &
+                    (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
+                        struct task_struct *tracer;
+                        struct task_security_struct *sec;
+                        u32 ptsid = 0;
+
+                        rcu_read_lock();
+                        tracer = tracehook_tracer_task(current);
+                        if (likely(tracer != NULL)) {
+                                sec = __task_cred(tracer)->security;
+                                ptsid = sec->sid;
+                        }
+                        rcu_read_unlock();
+
+                        if (ptsid != 0) {
+                                rc = avc_has_perm(ptsid, new_tsec->sid,
+                                                  SECCLASS_PROCESS,
+                                                  PROCESS__PTRACE, NULL);
+                                if (rc)
+                                        return -EPERM;
+                        }
+                }
 
-                /* Set the security field to the new SID. */
-                bsec->sid = newsid;
+                /* Clear any possibly unsafe personality bits on exec: */
+                bprm->per_clear |= PER_CLEAR_ON_SETID;
         }
 
-        bsec->set = 1;
         return 0;
 }
 
@@ -2125,7 +2141,6 @@ static int selinux_bprm_check_security(struct linux_binprm *bprm)
         return secondary_ops->bprm_check_security(bprm);
 }
 
-
 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
 {
         const struct cred *cred = current_cred();
@@ -2141,19 +2156,13 @@ static int selinux_bprm_secureexec(struct linux_binprm *bprm)
                    the noatsecure permission is granted between
                    the two SIDs, i.e. ahp returns 0. */
                 atsecure = avc_has_perm(osid, sid,
-                                         SECCLASS_PROCESS,
-                                         PROCESS__NOATSECURE, NULL);
+                                        SECCLASS_PROCESS,
+                                        PROCESS__NOATSECURE, NULL);
         }
 
         return (atsecure || secondary_ops->bprm_secureexec(bprm));
 }
 
-static void selinux_bprm_free_security(struct linux_binprm *bprm)
-{
-        kfree(bprm->security);
-        bprm->security = NULL;
-}
-
 extern struct vfsmount *selinuxfs_mount;
 extern struct dentry *selinux_null;
 
@@ -2252,108 +2261,78 @@ static inline void flush_unauthorized_files(const struct cred *cred,
         spin_unlock(&files->file_lock);
 }
 
-static int selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
+/*
+ * Prepare a process for imminent new credential changes due to exec
+ */
+static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
 {
-        struct task_security_struct *tsec;
-        struct bprm_security_struct *bsec;
-        struct cred *new;
-        u32 sid;
-        int rc;
-
-        rc = secondary_ops->bprm_apply_creds(bprm, unsafe);
-        if (rc < 0)
-                return rc;
-
-        new = prepare_creds();
-        if (!new)
-                return -ENOMEM;
+        struct task_security_struct *new_tsec;
+        struct rlimit *rlim, *initrlim;
+        int rc, i;
 
-        tsec = new->security;
+        secondary_ops->bprm_committing_creds(bprm);
 
-        bsec = bprm->security;
-        sid = bsec->sid;
-
-        tsec->osid = tsec->sid;
-        bsec->unsafe = 0;
-        if (tsec->sid != sid) {
-                /* Check for shared state.  If not ok, leave SID
-                   unchanged and kill. */
-                if (unsafe & LSM_UNSAFE_SHARE) {
-                        rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
-                                        PROCESS__SHARE, NULL);
-                        if (rc) {
-                                bsec->unsafe = 1;
-                                goto out;
-                        }
-                }
+        new_tsec = bprm->cred->security;
+        if (new_tsec->sid == new_tsec->osid)
+                return;
 
-                /* Check for ptracing, and update the task SID if ok.
-                   Otherwise, leave SID unchanged and kill. */
-                if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
-                        struct task_struct *tracer;
-                        struct task_security_struct *sec;
-                        u32 ptsid = 0;
+        /* Close files for which the new task SID is not authorized. */
+        flush_unauthorized_files(bprm->cred, current->files);
 
-                        rcu_read_lock();
-                        tracer = tracehook_tracer_task(current);
-                        if (likely(tracer != NULL)) {
-                                sec = __task_cred(tracer)->security;
-                                ptsid = sec->sid;
-                        }
-                        rcu_read_unlock();
+        /* Always clear parent death signal on SID transitions. */
+        current->pdeath_signal = 0;
 
-                        if (ptsid != 0) {
-                                rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
-                                                  PROCESS__PTRACE, NULL);
-                                if (rc) {
-                                        bsec->unsafe = 1;
-                                        goto out;
-                                }
-                        }
+        /* Check whether the new SID can inherit resource limits from the old
+         * SID.  If not, reset all soft limits to the lower of the current
+         * task's hard limit and the init task's soft limit.
+         *
+         * Note that the setting of hard limits (even to lower them) can be
+         * controlled by the setrlimit check.  The inclusion of the init task's
+         * soft limit into the computation is to avoid resetting soft limits
+         * higher than the default soft limit for cases where the default is
+         * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
+         */
+        rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
+                          PROCESS__RLIMITINH, NULL);
+        if (rc) {
+                for (i = 0; i < RLIM_NLIMITS; i++) {
+                        rlim = current->signal->rlim + i;
+                        initrlim = init_task.signal->rlim + i;
+                        rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
                 }
-                tsec->sid = sid;
+                update_rlimit_cpu(rlim->rlim_cur);
         }
-
-out:
-        commit_creds(new);
-        return 0;
 }
 
 /*
- * called after apply_creds without the task lock held
+ * Clean up the process immediately after the installation of new credentials
+ * due to exec
  */
-static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
+static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
 {
-        const struct cred *cred = current_cred();
-        struct task_security_struct *tsec;
-        struct rlimit *rlim, *initrlim;
+        const struct task_security_struct *tsec = current_security();
         struct itimerval itimer;
-        struct bprm_security_struct *bsec;
         struct sighand_struct *psig;
+        u32 osid, sid;
         int rc, i;
         unsigned long flags;
 
-        tsec = current_security();
-        bsec = bprm->security;
+        secondary_ops->bprm_committed_creds(bprm);
 
-        if (bsec->unsafe) {
-                force_sig_specific(SIGKILL, current);
-                return;
-        }
-        if (tsec->osid == tsec->sid)
+        osid = tsec->osid;
+        sid = tsec->sid;
+
+        if (sid == osid)
                 return;
 
-        /* Close files for which the new task SID is not authorized. */
-        flush_unauthorized_files(cred, current->files);
-
-        /* Check whether the new SID can inherit signal state
-           from the old SID.  If not, clear itimers to avoid
-           subsequent signal generation and flush and unblock
-           signals. This must occur _after_ the task SID has
-          been updated so that any kill done after the flush
-          will be checked against the new SID. */
-        rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
-                          PROCESS__SIGINH, NULL);
+        /* Check whether the new SID can inherit signal state from the old SID.
+         * If not, clear itimers to avoid subsequent signal generation and
+         * flush and unblock signals.
+         *
+         * This must occur _after_ the task SID has been updated so that any
+         * kill done after the flush will be checked against the new SID.
+         */
+        rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
         if (rc) {
                 memset(&itimer, 0, sizeof itimer);
                 for (i = 0; i < 3; i++)
@@ -2366,32 +2345,8 @@ static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
                 spin_unlock_irq(&current->sighand->siglock);
         }
 
-        /* Always clear parent death signal on SID transitions. */
-        current->pdeath_signal = 0;
-
-        /* Check whether the new SID can inherit resource limits
-           from the old SID.  If not, reset all soft limits to
-           the lower of the current task's hard limit and the init
-           task's soft limit.  Note that the setting of hard limits
-           (even to lower them) can be controlled by the setrlimit
-           check. The inclusion of the init task's soft limit into
-           the computation is to avoid resetting soft limits higher
-           than the default soft limit for cases where the default
-           is lower than the hard limit, e.g. RLIMIT_CORE or
-           RLIMIT_STACK.*/
-        rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
-                          PROCESS__RLIMITINH, NULL);
-        if (rc) {
-                for (i = 0; i < RLIM_NLIMITS; i++) {
-                        rlim = current->signal->rlim + i;
-                        initrlim = init_task.signal->rlim+i;
-                        rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
-                }
-                update_rlimit_cpu(rlim->rlim_cur);
-        }
-
-        /* Wake up the parent if it is waiting so that it can
-           recheck wait permission to the new task SID. */
+        /* Wake up the parent if it is waiting so that it can recheck
+         * wait permission to the new task SID. */
         read_lock_irq(&tasklist_lock);
         psig = current->parent->sighand;
         spin_lock_irqsave(&psig->siglock, flags);
@@ -5556,12 +5511,10 @@ static struct security_operations selinux_ops = {
         .netlink_send =                 selinux_netlink_send,
         .netlink_recv =                 selinux_netlink_recv,
 
-        .bprm_alloc_security =          selinux_bprm_alloc_security,
-        .bprm_free_security =           selinux_bprm_free_security,
-        .bprm_apply_creds =             selinux_bprm_apply_creds,
-        .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
-        .bprm_set_security =            selinux_bprm_set_security,
+        .bprm_set_creds =               selinux_bprm_set_creds,
         .bprm_check_security =          selinux_bprm_check_security,
+        .bprm_committing_creds =        selinux_bprm_committing_creds,
+        .bprm_committed_creds =         selinux_bprm_committed_creds,
         .bprm_secureexec =              selinux_bprm_secureexec,
 
         .sb_alloc_security =            selinux_sb_alloc_security,
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index f8be8d7fa26d..3cc45168f674 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -77,17 +77,6 @@ struct ipc_security_struct {
         u32 sid;        /* SID of IPC resource */
 };
 
-struct bprm_security_struct {
-        u32 sid;                /* SID for transformed process */
-        unsigned char set;
-
-        /*
-         * unsafe is used to share failure information from bprm_apply_creds()
-         * to bprm_post_apply_creds().
-         */
-        char unsafe;
-};
-
 struct netif_security_struct {
         int ifindex;                    /* device index */
         u32 sid;                        /* SID for this interface */
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e952b397153d..de396742abf4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2596,8 +2596,7 @@ struct security_operations smack_ops = {
         .settime =                      cap_settime,
         .vm_enough_memory =             cap_vm_enough_memory,
 
-        .bprm_apply_creds =             cap_bprm_apply_creds,
-        .bprm_set_security =            cap_bprm_set_security,
+        .bprm_set_creds =               cap_bprm_set_creds,
         .bprm_secureexec =              cap_bprm_secureexec,
 
         .sb_alloc_security =            smack_sb_alloc_security,