Merge branch 'master' into next

diff --combined security/selinux/hooks.c
index 5f21a514f5811332bc2e2dcc0db98dd0a0e0fdfd,f85597a4d733f06d89e69987cf48f02606bb2d27..f71de5a64d0c9ac1f01b0f79fb43418c5d6a7343
--- 1/security/selinux/hooks.c
--- 2/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@@ -75,6 -75,7 +75,7 @@@
  #include <linux/string.h>
  #include <linux/selinux.h>
  #include <linux/mutex.h>
+ #include <linux/posix-timers.h>
  
  #include "avc.h"
  #include "objsec.h"
@@@ -325,7 -326,7 +326,7 @@@ enum 
        Opt_rootcontext = 4,
  };
  
- static match_table_t tokens = {
+ static const match_table_t tokens = {
        {Opt_context, CONTEXT_STR "%s"},
        {Opt_fscontext, FSCONTEXT_STR "%s"},
        {Opt_defcontext, DEFCONTEXT_STR "%s"},
@@@ -1686,39 -1687,15 +1687,39 @@@ static inline u32 file_mask_to_av(int m
        return av;
  }
  
 +/* Convert a Linux file to an access vector. */
 +static inline u32 file_to_av(struct file *file)
 +{
 +      u32 av = 0;
 +
 +      if (file->f_mode & FMODE_READ)
 +              av |= FILE__READ;
 +      if (file->f_mode & FMODE_WRITE) {
 +              if (file->f_flags & O_APPEND)
 +                      av |= FILE__APPEND;
 +              else
 +                      av |= FILE__WRITE;
 +      }
 +      if (!av) {
 +              /*
 +               * Special file opened with flags 3 for ioctl-only use.
 +               */
 +              av = FILE__IOCTL;
 +      }
 +
 +      return av;
 +}
 +
  /*
 - * Convert a file mask to an access vector and include the correct open
 + * Convert a file to an access vector and include the correct open
   * open permission.
   */
 -static inline u32 open_file_mask_to_av(int mode, int mask)
 +static inline u32 open_file_to_av(struct file *file)
  {
 -      u32 av = file_mask_to_av(mode, mask);
 +      u32 av = file_to_av(file);
  
        if (selinux_policycap_openperm) {
 +              mode_t mode = file->f_path.dentry->d_inode->i_mode;
                /*
                 * lnk files and socks do not really have an 'open'
                 */
@@@ -1734,11 -1711,34 +1735,11 @@@
                        av |= DIR__OPEN;
                else
                        printk(KERN_ERR "SELinux: WARNING: inside %s with "
 -                              "unknown mode:%x\n", __func__, mode);
 +                              "unknown mode:%o\n", __func__, mode);
        }
        return av;
  }
  
 -/* Convert a Linux file to an access vector. */
 -static inline u32 file_to_av(struct file *file)
 -{
 -      u32 av = 0;
 -
 -      if (file->f_mode & FMODE_READ)
 -              av |= FILE__READ;
 -      if (file->f_mode & FMODE_WRITE) {
 -              if (file->f_flags & O_APPEND)
 -                      av |= FILE__APPEND;
 -              else
 -                      av |= FILE__WRITE;
 -      }
 -      if (!av) {
 -              /*
 -               * Special file opened with flags 3 for ioctl-only use.
 -               */
 -              av = FILE__IOCTL;
 -      }
 -
 -      return av;
 -}
 -
  /* Hook functions begin here. */
  
  static int selinux_ptrace_may_access(struct task_struct *child,
@@@ -2123,26 -2123,27 +2124,27 @@@ static inline void flush_unauthorized_f
        long j = -1;
        int drop_tty = 0;
  
-       mutex_lock(&tty_mutex);
        tty = get_current_tty();
        if (tty) {
                file_list_lock();
-               file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
-               if (file) {
+               if (!list_empty(&tty->tty_files)) {
+                       struct inode *inode;
+ 
                        /* Revalidate access to controlling tty.
                           Use inode_has_perm on the tty inode directly rather
                           than using file_has_perm, as this particular open
                           file may belong to another process and we are only
                           interested in the inode-based check here. */
-                       struct inode *inode = file->f_path.dentry->d_inode;
+                       file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
+                       inode = file->f_path.dentry->d_inode;
                        if (inode_has_perm(current, inode,
                                           FILE__READ | FILE__WRITE, NULL)) {
                                drop_tty = 1;
                        }
                }
                file_list_unlock();
+               tty_kref_put(tty);
        }
-       mutex_unlock(&tty_mutex);
        /* Reset controlling tty. */
        if (drop_tty)
                no_tty();
@@@ -2268,9 -2269,7 +2270,9 @@@ static void selinux_bprm_post_apply_cre
        struct rlimit *rlim, *initrlim;
        struct itimerval itimer;
        struct bprm_security_struct *bsec;
 +      struct sighand_struct *psig;
        int rc, i;
 +      unsigned long flags;
  
        tsec = current->security;
        bsec = bprm->security;
@@@ -2326,23 -2325,12 +2328,17 @@@
                        initrlim = init_task.signal->rlim+i;
                        rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
                }
-               if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
-                       /*
-                        * This will cause RLIMIT_CPU calculations
-                        * to be refigured.
-                        */
-                       current->it_prof_expires = jiffies_to_cputime(1);
-               }
+               update_rlimit_cpu(rlim->rlim_cur);
        }
  
        /* Wake up the parent if it is waiting so that it can
           recheck wait permission to the new task SID. */
 +      read_lock_irq(&tasklist_lock);
 +      psig = current->parent->sighand;
 +      spin_lock_irqsave(&psig->siglock, flags);
        wake_up_interruptible(&current->parent->signal->wait_chldexit);
 +      spin_unlock_irqrestore(&psig->siglock, flags);
 +      read_unlock_irq(&tasklist_lock);
  }
  
  /* superblock security operations */
@@@ -2662,7 -2650,7 +2658,7 @@@ static int selinux_inode_permission(str
        }
  
        return inode_has_perm(current, inode,
 -                             open_file_mask_to_av(inode->i_mode, mask), NULL);
 +                            file_mask_to_av(inode->i_mode, mask), NULL);
  }
  
  static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
@@@ -3178,7 -3166,7 +3174,7 @@@ static int selinux_dentry_open(struct f
         * new inode label or new policy.
         * This check is not redundant - do not remove.
         */
 -      return inode_has_perm(current, inode, file_to_av(file), NULL);
 +      return inode_has_perm(current, inode, open_file_to_av(file), NULL);
  }
  
  /* task security operations */