Merge branch 'stable-3.16' of git://git.infradead.org/users/pcmoore/selinux into...

[mirror_ubuntu-artful-kernel.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 2c7341dbc5d68d1948ad0efa713ad3a85307608e..a1ac1c5c729b0818d43ea26e03e8c1ca6eb23afa 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2123,11 +2123,13 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
                new_tsec->exec_sid = 0;
 
                /*
-                * Minimize confusion: if no_new_privs and a transition is
-                * explicitly requested, then fail the exec.
+                * Minimize confusion: if no_new_privs or nosuid and a
+                * transition is explicitly requested, then fail the exec.
                 */
                if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
                        return -EPERM;
+               if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
+                       return -EACCES;
        } else {
                /* Check for a default transition on this program. */
                rc = security_transition_sid(old_tsec->sid, isec->sid,
@@ -2770,6 +2772,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
 
 static noinline int audit_inode_permission(struct inode *inode,
                                           u32 perms, u32 audited, u32 denied,
+                                          int result,
                                           unsigned flags)
 {
        struct common_audit_data ad;
@@ -2780,7 +2783,7 @@ static noinline int audit_inode_permission(struct inode *inode,
        ad.u.inode = inode;
 
        rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
-                           audited, denied, &ad, flags);
+                           audited, denied, result, &ad, flags);
        if (rc)
                return rc;
        return 0;
@@ -2822,7 +2825,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
        if (likely(!audited))
                return rc;
 
-       rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
+       rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
        if (rc2)
                return rc2;
        return rc;
@@ -4496,9 +4499,18 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent)
        struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
        struct sk_security_struct *sksec = sk->sk_security;
 
-       if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
-           sk->sk_family == PF_UNIX)
+       switch (sk->sk_family) {
+       case PF_INET:
+       case PF_INET6:
+       case PF_UNIX:
                isec->sid = sksec->sid;
+               break;
+       default:
+               /* by default there is no special labeling mechanism for the
+                * sksec label so inherit the label from the parent socket */
+               BUG_ON(sksec->sid != SECINITSID_UNLABELED);
+               sksec->sid = isec->sid;
+       }
        sksec->sclass = isec->sclass;
 }
 
@@ -5722,7 +5734,7 @@ static void selinux_key_free(struct key *k)
 
 static int selinux_key_permission(key_ref_t key_ref,
                                  const struct cred *cred,
-                                 key_perm_t perm)
+                                 unsigned perm)
 {
        struct key *key;
        struct key_security_struct *ksec;