Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 19b5b517 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6 

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  SELinux: one little, two little, three little whitespaces, the avc.c saga.
  SELinux: cleanup on isle selinuxfs.c
  changing whitespace for fun and profit: policydb.c
  SELinux: whitespace and formating fixes for hooks.c
  SELinux: clean up printks
  SELinux: sidtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: services.c whitespace, syntax, and static declaraction cleanups
  SELinux: mls.c whitespace, syntax, and static declaraction cleanups
  SELinux: hashtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: ebitmap.c whitespace, syntax, and static declaraction cleanups
  SELinux: conditional.c whitespace, syntax, and static declaraction cleanups
  SELinux: avtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: xfrm.c whitespace, syntax, and static declaraction cleanups
  SELinux: nlmsgtab.c whitespace, syntax, and static declaraction cleanups
  SELinux: netnode.c whitespace, syntax, and static declaraction cleanups
  SELinux: netlink.c whitespace, syntax, and static declaraction cleanups
  SELinux: netlabel.c whitespace, syntax, and static declaraction cleanups
  SELinux: netif.c whitespace, syntax, and static declaraction cleanups
parents bda0c0af 95fff33b

security/selinux/avc.c

+29 −29
Original line number Diff line number Diff line
@@ -426,7 +426,7 @@ static int avc_latest_notif_update(int seqno, int is_insert) 
	spin_lock_irqsave(&notif_lock, flag);

	if (is_insert) {

		if (seqno < avc_cache.latest_notif) {

			printk(KERN_WARNING "avc:  seqno %d < latest_notif %d\n",

			printk(KERN_WARNING "SELinux: avc:  seqno %d < latest_notif %d\n",

			       seqno, avc_cache.latest_notif);

			ret = -EAGAIN;

		}

security/selinux/hooks.c

+254 −258
Original line number Diff line number Diff line
@@ -99,7 +99,7 @@ extern struct security_operations *security_ops; 
atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);



#ifdef CONFIG_SECURITY_SELINUX_DEVELOP

int selinux_enforcing = 0;

int selinux_enforcing;



static int __init enforcing_setup(char *str)

{
@@ -123,13 +123,13 @@ int selinux_enabled = 1; 
#endif



/* Original (dummy) security module. */

static struct security_operations *original_ops = NULL;

static struct security_operations *original_ops;



/* Minimal support for a secondary security module,

   just to allow the use of the dummy or capability modules.

   The owlsm module can alternatively be used as a secondary

   module as long as CONFIG_OWLSM_FD is not enabled. */

static struct security_operations *secondary_ops = NULL;

static struct security_operations *secondary_ops;



/* Lists of inode and superblock security structures initialized

   before the policy was loaded. */
@@ -575,8 +575,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
			goto out;

		}

		rc = -EINVAL;

		printk(KERN_WARNING "Unable to set superblock options before "

		       "the security server is initialized\n");

		printk(KERN_WARNING "SELinux: Unable to set superblock options "

			"before the security server is initialized\n");

		goto out;

	}
@@ -1135,7 +1135,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
			dentry = d_find_alias(inode);

		}

		if (!dentry) {

			printk(KERN_WARNING "%s:  no dentry for dev=%s "

			printk(KERN_WARNING "SELinux: %s:  no dentry for dev=%s "

			       "ino=%ld\n", __func__, inode->i_sb->s_id,

			       inode->i_ino);

			goto out_unlock;
@@ -1173,7 +1173,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
		dput(dentry);

		if (rc < 0) {

			if (rc != -ENODATA) {

				printk(KERN_WARNING "%s:  getxattr returned "

				printk(KERN_WARNING "SELinux: %s:  getxattr returned "

				       "%d for dev=%s ino=%ld\n", __func__,

				       -rc, inode->i_sb->s_id, inode->i_ino);

				kfree(context);
@@ -1187,7 +1187,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent 
							     sbsec->def_sid,

							     GFP_NOFS);

			if (rc) {

				printk(KERN_WARNING "%s:  context_to_sid(%s) "

				printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "

				       "returned %d for dev=%s ino=%ld\n",

				       __func__, context, -rc,

				       inode->i_sb->s_id, inode->i_ino);
@@ -1510,7 +1510,8 @@ static int may_link(struct inode *dir, 
		av = DIR__RMDIR;

		break;

	default:

		printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);

		printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",

			__func__, kind);

		return 0;

	}
@@ -1640,8 +1641,8 @@ static inline u32 open_file_mask_to_av(int mode, int mask) 
		else if (S_ISDIR(mode))

			av |= DIR__OPEN;

		else

			printk(KERN_ERR "SELinux: WARNING: inside open_file_to_av "

				"with unknown mode:%x\n", mode);

			printk(KERN_ERR "SELinux: WARNING: inside %s with "

				"unknown mode:%x\n", __func__, mode);

	}

	return av;

}
@@ -1817,16 +1818,14 @@ static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb) 
	case Q_QUOTAOFF:

	case Q_SETINFO:

	case Q_SETQUOTA:

			rc = superblock_has_perm(current,

						 sb,

						 FILESYSTEM__QUOTAMOD, NULL);

		rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,

					 NULL);

		break;

	case Q_GETFMT:

	case Q_GETINFO:

	case Q_GETQUOTA:

			rc = superblock_has_perm(current,

						 sb,

						 FILESYSTEM__QUOTAGET, NULL);

		rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,

					 NULL);

		break;

	default:

		rc = 0;  /* let the kernel handle invalid cmds */
@@ -2314,8 +2313,7 @@ static inline void take_selinux_option(char **to, char *from, int *first, 
	if (!*first) {

		**to = '|';

		*to += 1;

	}

	else

	} else

		*first = 0;



	while (current_size < len) {
@@ -2893,7 +2891,6 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, 
	 */

	default:

		error = file_has_perm(current, file, FILE__IOCTL);



	}

	return error;

}
@@ -5218,8 +5215,7 @@ static int selinux_setprocattr(struct task_struct *p, 
			tsec->sid = sid;

			task_unlock(p);

		}

	}

	else

	} else

		return -EINVAL;



	return size;
@@ -5523,11 +5519,10 @@ static __init int selinux_init(void) 
	if (register_security(&selinux_ops))

		panic("SELinux: Unable to register with kernel.\n");



	if (selinux_enforcing) {

	if (selinux_enforcing)

		printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");

	} else {

	else

		printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");

	}



#ifdef CONFIG_KEYS

	/* Add security information to initial keyrings */
@@ -5672,10 +5667,11 @@ static void selinux_nf_ip_exit(void) 
#endif /* CONFIG_NETFILTER */



#ifdef CONFIG_SECURITY_SELINUX_DISABLE

static int selinux_disabled;



int selinux_disable(void)

{

	extern void exit_sel_fs(void);

	static int selinux_disabled = 0;



	if (ss_initialized) {

		/* Not permitted after initial policy load. */

security/selinux/netif.c

+9 −10
Original line number Diff line number Diff line
@@ -31,8 +31,7 @@ 
#define SEL_NETIF_HASH_SIZE	64

#define SEL_NETIF_HASH_MAX	1024



struct sel_netif

{

struct sel_netif {

	struct list_head list;

	struct netif_security_struct nsec;

	struct rcu_head rcu_head;

security/selinux/nlmsgtab.c

+2 −3
Original line number Diff line number Diff line
@@ -23,8 +23,7 @@ 
#include "flask.h"

#include "av_permissions.h"



struct nlmsg_perm

{

struct nlmsg_perm {

	u16	nlmsg_type;

	u32	perm;

};

security/selinux/selinuxfs.c

+65 −62
Original line number Diff line number Diff line
@@ -73,17 +73,17 @@ __setup("selinux_compat_net=", selinux_compat_net_setup); 
static DEFINE_MUTEX(sel_mutex);



/* global data for booleans */

static struct dentry *bool_dir = NULL;

static int bool_num = 0;

static struct dentry *bool_dir;

static int bool_num;

static char **bool_pending_names;

static int *bool_pending_values = NULL;

static int *bool_pending_values;



/* global data for classes */

static struct dentry *class_dir = NULL;

static struct dentry *class_dir;

static unsigned long last_class_ino;



/* global data for policy capabilities */

static struct dentry *policycap_dir = NULL;

static struct dentry *policycap_dir;



extern void selnl_notify_setenforce(int val);
@@ -390,8 +390,8 @@ static ssize_t sel_write_context(struct file * file, char *buf, size_t size) 
		return length;



	if (len > SIMPLE_TRANSACTION_LIMIT) {

		printk(KERN_ERR "%s:  context size (%u) exceeds payload "

		       "max\n", __func__, len);

		printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "

			"payload max\n", __func__, len);

		length = -ERANGE;

		goto out;

	}
@@ -643,8 +643,8 @@ static ssize_t sel_write_create(struct file * file, char *buf, size_t size) 
		goto out2;



	if (len > SIMPLE_TRANSACTION_LIMIT) {

		printk(KERN_ERR "%s:  context size (%u) exceeds payload "

		       "max\n", __func__, len);

		printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "

			"payload max\n", __func__, len);

		length = -ERANGE;

		goto out3;

	}
@@ -820,8 +820,8 @@ static ssize_t sel_write_member(struct file * file, char *buf, size_t size) 
		goto out2;



	if (len > SIMPLE_TRANSACTION_LIMIT) {

		printk(KERN_ERR "%s:  context size (%u) exceeds payload "

		       "max\n", __func__, len);

		printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "

			"payload max\n", __func__, len);

		length = -ERANGE;

		goto out3;

	}
@@ -872,7 +872,8 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf, 
		ret = -EINVAL;

		goto out;

	}

	if (!(page = (char*)get_zeroed_page(GFP_KERNEL))) {

	page = (char *)get_zeroed_page(GFP_KERNEL);

	if (!page) {

		ret = -ENOMEM;

		goto out;

	}
@@ -991,9 +992,8 @@ static ssize_t sel_commit_bools_write(struct file *filep, 
	if (sscanf(page, "%d", &new_value) != 1)

		goto out;



	if (new_value && bool_pending_values) {

	if (new_value && bool_pending_values)

		security_set_bools(bool_num, bool_pending_values);

	}



	length = count;
@@ -1055,7 +1055,8 @@ static int sel_make_bools(void) 


	sel_remove_entries(dir);



	if (!(page = (char*)get_zeroed_page(GFP_KERNEL)))

	page = (char *)get_zeroed_page(GFP_KERNEL);

	if (!page)

		return -ENOMEM;



	ret = security_get_bools(&num, &names, &values);
@@ -1083,7 +1084,8 @@ static int sel_make_bools(void) 
			goto err;

		}

		isec = (struct inode_security_struct *)inode->i_security;

		if ((ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid)))

		ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);

		if (ret)

			goto err;

		isec->sid = sid;

		isec->initialized = 1;
@@ -1111,7 +1113,7 @@ err: 


#define NULL_FILE_NAME "null"



struct dentry *selinux_null = NULL;

struct dentry *selinux_null;



static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,

					    size_t count, loff_t *ppos)
@@ -1760,7 +1762,8 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent) 
out:

	return ret;

err:

	printk(KERN_ERR "%s:  failed while creating inodes\n", __func__);

	printk(KERN_ERR "SELinux: %s:  failed while creating inodes\n",

		__func__);

	goto out;

}