Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: (71 commits)
  SELinux: inode_doinit_with_dentry drop no dentry printk
  SELinux: new permission between tty audit and audit socket
  SELinux: open perm for sock files
  smack: fixes for unlabeled host support
  keys: make procfiles per-user-namespace
  keys: skip keys from another user namespace
  keys: consider user namespace in key_permission
  keys: distinguish per-uid keys in different namespaces
  integrity: ima iint radix_tree_lookup locking fix
  TOMOYO: Do not call tomoyo_realpath_init unless registered.
  integrity: ima scatterlist bug fix
  smack: fix lots of kernel-doc notation
  TOMOYO: Don't create securityfs entries unless registered.
  TOMOYO: Fix exception policy read failure.
  SELinux: convert the avc cache hash list to an hlist
  SELinux: code readability with avc_cache
  SELinux: remove unused av.decided field
  SELinux: more careful use of avd in avc_has_perm_noaudit
  SELinux: remove the unused ae.used
  SELinux: check seqno when updating an avc_node
  ...

diff --combined fs/inode.c
index 6ac0cef6c5f5aefd420af822c774b7122740065e,8a47ccd9fc381f89c78282ccce531abb0e0f026b..643ac43e5a5c7d6f43fe938fd4c0df6c91e2e0ce
--- 1/fs/inode.c
--- 2/fs/inode.c
+++ b/fs/inode.c
@@@ -17,6 -17,7 +17,7 @@@
  #include <linux/hash.h>
  #include <linux/swap.h>
  #include <linux/security.h>
+ #include <linux/ima.h>
  #include <linux/pagemap.h>
  #include <linux/cdev.h>
  #include <linux/bootmem.h>
@@@ -147,13 -148,13 +148,13 @@@ struct inode *inode_init_always(struct 
        inode->i_cdev = NULL;
        inode->i_rdev = 0;
        inode->dirtied_when = 0;
-       if (security_inode_alloc(inode)) {
-               if (inode->i_sb->s_op->destroy_inode)
-                       inode->i_sb->s_op->destroy_inode(inode);
-               else
-                       kmem_cache_free(inode_cachep, (inode));
-               return NULL;
-       }
+ 
+       if (security_inode_alloc(inode))
+               goto out_free_inode;
+ 
+       /* allocate and initialize an i_integrity */
+       if (ima_inode_alloc(inode))
+               goto out_free_security;
  
        spin_lock_init(&inode->i_lock);
        lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
@@@ -189,6 -190,15 +190,15 @@@
        inode->i_mapping = mapping;
  
        return inode;
+ 
+ out_free_security:
+       security_inode_free(inode);
+ out_free_inode:
+       if (inode->i_sb->s_op->destroy_inode)
+               inode->i_sb->s_op->destroy_inode(inode);
+       else
+               kmem_cache_free(inode_cachep, (inode));
+       return NULL;
  }
  EXPORT_SYMBOL(inode_init_always);
  
@@@ -1290,40 -1300,6 +1300,40 @@@ sector_t bmap(struct inode * inode, sec
  }
  EXPORT_SYMBOL(bmap);
  
 +/*
 + * With relative atime, only update atime if the previous atime is
 + * earlier than either the ctime or mtime or if at least a day has
 + * passed since the last atime update.
 + */
 +static int relatime_need_update(struct vfsmount *mnt, struct inode *inode,
 +                           struct timespec now)
 +{
 +
 +      if (!(mnt->mnt_flags & MNT_RELATIME))
 +              return 1;
 +      /*
 +       * Is mtime younger than atime? If yes, update atime:
 +       */
 +      if (timespec_compare(&inode->i_mtime, &inode->i_atime) >= 0)
 +              return 1;
 +      /*
 +       * Is ctime younger than atime? If yes, update atime:
 +       */
 +      if (timespec_compare(&inode->i_ctime, &inode->i_atime) >= 0)
 +              return 1;
 +
 +      /*
 +       * Is the previous atime value older than a day? If yes,
 +       * update atime:
 +       */
 +      if ((long)(now.tv_sec - inode->i_atime.tv_sec) >= 24*60*60)
 +              return 1;
 +      /*
 +       * Good, we can skip the atime update:
 +       */
 +      return 0;
 +}
 +
  /**
   *    touch_atime     -       update the access time
   *    @mnt: mount the inode is accessed on
@@@ -1351,12 -1327,17 +1361,12 @@@ void touch_atime(struct vfsmount *mnt, 
                goto out;
        if ((mnt->mnt_flags & MNT_NODIRATIME) && S_ISDIR(inode->i_mode))
                goto out;
 -      if (mnt->mnt_flags & MNT_RELATIME) {
 -              /*
 -               * With relative atime, only update atime if the previous
 -               * atime is earlier than either the ctime or mtime.
 -               */
 -              if (timespec_compare(&inode->i_mtime, &inode->i_atime) < 0 &&
 -                  timespec_compare(&inode->i_ctime, &inode->i_atime) < 0)
 -                      goto out;
 -      }
  
        now = current_fs_time(inode->i_sb);
 +
 +      if (!relatime_need_update(mnt, inode, now))
 +              goto out;
 +
        if (timespec_equal(&inode->i_atime, &now))
                goto out;