Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/selinux into for...

diff --combined security/selinux/hooks.c
index 6231081,692e3cc..564079c
--- 1/security/selinux/hooks.c
--- 2/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@@ -1578,7 -1578,7 +1578,7 @@@ static int cred_has_capability(const st
  
        rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
        if (audit == SECURITY_CAP_AUDIT) {
 -              int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
 +              int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
                if (rc2)
                        return rc2;
        }
@@@ -2842,23 -2842,11 +2842,23 @@@ static int selinux_inode_readlink(struc
        return dentry_has_perm(cred, dentry, FILE__READ);
  }
  
 -static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
 +static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
 +                                   bool rcu)
  {
        const struct cred *cred = current_cred();
 +      struct common_audit_data ad;
 +      struct inode_security_struct *isec;
 +      u32 sid;
  
 -      return dentry_has_perm(cred, dentry, FILE__READ);
 +      validate_creds(cred);
 +
 +      ad.type = LSM_AUDIT_DATA_DENTRY;
 +      ad.u.dentry = dentry;
 +      sid = cred_sid(cred);
 +      isec = inode->i_security;
 +
 +      return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
 +                                rcu ? MAY_NOT_BLOCK : 0);
  }
  
  static noinline int audit_inode_permission(struct inode *inode,
@@@ -3283,7 -3271,8 +3283,8 @@@ static int file_map_prot_check(struct f
        int rc = 0;
  
        if (default_noexec &&
-           (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
+           (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
+                                  (!shared && (prot & PROT_WRITE)))) {
                /*
                 * We are making executable an anonymous mapping or a
                 * private file mapping that will also be writable.