brcmfamc: add the feature-disable property

[platform/kernel/linux-rpi.git] / security / security.c

diff --git a/security/security.c b/security/security.c
index b38155b..7b9f9d3 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -58,10 +58,13 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = {
        [LOCKDOWN_MMIOTRACE] = "unsafe mmio",
        [LOCKDOWN_DEBUGFS] = "debugfs access",
        [LOCKDOWN_XMON_WR] = "xmon write access",
+       [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM",
+       [LOCKDOWN_DBG_WRITE_KERNEL] = "use of kgdb/kdb to write kernel RAM",
        [LOCKDOWN_INTEGRITY_MAX] = "integrity",
        [LOCKDOWN_KCORE] = "/proc/kcore access",
        [LOCKDOWN_KPROBES] = "use of kprobes",
-       [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM",
+       [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM",
+       [LOCKDOWN_DBG_READ_KERNEL] = "use of kgdb/kdb to read kernel RAM",
        [LOCKDOWN_PERF] = "unsafe use of perf",
        [LOCKDOWN_TRACEFS] = "use of tracefs",
        [LOCKDOWN_XMON_RW] = "xmon read and write access",
@@ -746,25 +749,25 @@ static int lsm_superblock_alloc(struct super_block *sb)
 
 /* Security operations */
 
-int security_binder_set_context_mgr(struct task_struct *mgr)
+int security_binder_set_context_mgr(const struct cred *mgr)
 {
        return call_int_hook(binder_set_context_mgr, 0, mgr);
 }
 
-int security_binder_transaction(struct task_struct *from,
-                               struct task_struct *to)
+int security_binder_transaction(const struct cred *from,
+                               const struct cred *to)
 {
        return call_int_hook(binder_transaction, 0, from, to);
 }
 
-int security_binder_transfer_binder(struct task_struct *from,
-                                   struct task_struct *to)
+int security_binder_transfer_binder(const struct cred *from,
+                                   const struct cred *to)
 {
        return call_int_hook(binder_transfer_binder, 0, from, to);
 }
 
-int security_binder_transfer_file(struct task_struct *from,
-                                 struct task_struct *to, struct file *file)
+int security_binder_transfer_file(const struct cred *from,
+                                 const struct cred *to, struct file *file)
 {
        return call_int_hook(binder_transfer_file, 0, from, to, file);
 }
@@ -883,9 +886,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
        return call_int_hook(fs_context_dup, 0, fc, src_fc);
 }
 
-int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param)
+int security_fs_context_parse_param(struct fs_context *fc,
+                                   struct fs_parameter *param)
 {
-       return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param);
+       struct security_hook_list *hp;
+       int trc;
+       int rc = -ENOPARAM;
+
+       hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param,
+                            list) {
+               trc = hp->hook.fs_context_parse_param(fc, param);
+               if (trc == 0)
+                       rc = 0;
+               else if (trc != -ENOPARAM)
+                       return trc;
+       }
+       return rc;
 }
 
 int security_sb_alloc(struct super_block *sb)
@@ -1354,7 +1370,7 @@ int security_inode_setxattr(struct user_namespace *mnt_userns,
        ret = ima_inode_setxattr(dentry, name, value, size);
        if (ret)
                return ret;
-       return evm_inode_setxattr(dentry, name, value, size);
+       return evm_inode_setxattr(mnt_userns, dentry, name, value, size);
 }
 
 void security_inode_post_setxattr(struct dentry *dentry, const char *name,
@@ -1399,7 +1415,7 @@ int security_inode_removexattr(struct user_namespace *mnt_userns,
        ret = ima_inode_removexattr(dentry, name);
        if (ret)
                return ret;
-       return evm_inode_removexattr(dentry, name);
+       return evm_inode_removexattr(mnt_userns, dentry, name);
 }
 
 int security_inode_need_killpriv(struct dentry *dentry)
@@ -2466,9 +2482,9 @@ void security_xfrm_state_free(struct xfrm_state *x)
        call_void_hook(xfrm_state_free_security, x);
 }
 
-int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
+int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid)
 {
-       return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid, dir);
+       return call_int_hook(xfrm_policy_lookup, 0, ctx, fl_secid);
 }
 
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,