Smack: remove unneeded NULL-termination from securtity label

[pandora-kernel.git] / security / smack / smack_lsm.c

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 7bcf9ed..16ae853 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -672,7 +672,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
        }
 
        if (len)
-               *len = strlen(isp) + 1;
+               *len = strlen(isp);
 
        return 0;
 }
@@ -923,7 +923,7 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
                rc = -EPERM;
 
        if (rc == 0 && check_import) {
-               skp = smk_import_entry(value, size);
+               skp = size ? smk_import_entry(value, size) : NULL;
                if (skp == NULL || (check_star &&
                    (skp == &smack_known_star || skp == &smack_known_web)))
                        rc = -EINVAL;
@@ -1076,7 +1076,7 @@ static int smack_inode_getsecurity(const struct inode *inode,
 
        if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
                isp = smk_of_inode(inode);
-               ilen = strlen(isp) + 1;
+               ilen = strlen(isp);
                *buffer = isp;
                return ilen;
        }
@@ -1101,7 +1101,7 @@ static int smack_inode_getsecurity(const struct inode *inode,
        else
                return -EOPNOTSUPP;
 
-       ilen = strlen(isp) + 1;
+       ilen = strlen(isp);
        if (rc == 0) {
                *buffer = isp;
                rc = ilen;
@@ -1122,13 +1122,12 @@ static int smack_inode_getsecurity(const struct inode *inode,
 static int smack_inode_listsecurity(struct inode *inode, char *buffer,
                                    size_t buffer_size)
 {
-       int len = strlen(XATTR_NAME_SMACK);
+       int len = sizeof(XATTR_NAME_SMACK);
 
-       if (buffer != NULL && len <= buffer_size) {
+       if (buffer != NULL && len <= buffer_size)
                memcpy(buffer, XATTR_NAME_SMACK, len);
-               return len;
-       }
-       return -EINVAL;
+
+       return len;
 }
 
 /**
@@ -2821,6 +2820,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
         * of the superblock.
         */
        if (opt_dentry->d_parent == opt_dentry) {
+               if (sbp->s_magic == CGROUP_SUPER_MAGIC) {
+                       /*
+                        * The cgroup filesystem is never mounted,
+                        * so there's no opportunity to set the mount
+                        * options.
+                        */
+                       sbsp->smk_root = smack_known_star.smk_known;
+                       sbsp->smk_default = smack_known_star.smk_known;
+               }
                isp->smk_inode = sbsp->smk_root;
                isp->smk_flags |= SMK_INODE_INSTANT;
                goto unlockandout;
@@ -2834,16 +2842,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
         */
        switch (sbp->s_magic) {
        case SMACK_MAGIC:
+       case PIPEFS_MAGIC:
+       case SOCKFS_MAGIC:
+       case CGROUP_SUPER_MAGIC:
                /*
                 * Casey says that it's a little embarrassing
                 * that the smack file system doesn't do
                 * extended attributes.
-                */
-               final = smack_known_star.smk_known;
-               break;
-       case PIPEFS_MAGIC:
-               /*
+                *
                 * Casey says pipes are easy (?)
+                *
+                * Socket access is controlled by the socket
+                * structures associated with the task involved.
+                *
+                * Cgroupfs is special
                 */
                final = smack_known_star.smk_known;
                break;
@@ -2855,13 +2867,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
                 */
                final = ckp->smk_known;
                break;
-       case SOCKFS_MAGIC:
-               /*
-                * Socket access is controlled by the socket
-                * structures associated with the task involved.
-                */
-               final = smack_known_star.smk_known;
-               break;
        case PROC_SUPER_MAGIC:
                /*
                 * Casey says procfs appears not to care.
@@ -3203,9 +3208,9 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
                                break;
                        }
                        for (acat = -1, kcat = -1; acat == kcat; ) {
-                               acat = netlbl_secattr_catmap_walk(
-                                       sap->attr.mls.cat, acat + 1);
-                               kcat = netlbl_secattr_catmap_walk(
+                               acat = netlbl_catmap_walk(sap->attr.mls.cat,
+                                                         acat + 1);
+                               kcat = netlbl_catmap_walk(
                                        skp->smk_netlabel.attr.mls.cat,
                                        kcat + 1);
                                if (acat < 0 || kcat < 0)
@@ -3618,11 +3623,12 @@ static void smack_key_free(struct key *key)
  * an error code otherwise
  */
 static int smack_key_permission(key_ref_t key_ref,
-                               const struct cred *cred, key_perm_t perm)
+                               const struct cred *cred, unsigned perm)
 {
        struct key *keyp;
        struct smk_audit_info ad;
        struct smack_known *tkp = smk_of_task(cred->security);
+       int request = 0;
 
        keyp = key_ref_to_ptr(key_ref);
        if (keyp == NULL)
@@ -3643,7 +3649,11 @@ static int smack_key_permission(key_ref_t key_ref,
        ad.a.u.key_struct.key = keyp->serial;
        ad.a.u.key_struct.key_desc = keyp->description;
 #endif
-       return smk_access(tkp, keyp->security, MAY_READWRITE, &ad);
+       if (perm & KEY_NEED_READ)
+               request = MAY_READ;
+       if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
+               request = MAY_WRITE;
+       return smk_access(tkp, keyp->security, request, &ad);
 }
 #endif /* CONFIG_KEYS */
 
@@ -3728,9 +3738,8 @@ static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule,
        struct smack_known *skp;
        char *rule = vrule;
 
-       if (!rule) {
-               audit_log(actx, GFP_ATOMIC, AUDIT_SELINUX_ERR,
-                         "Smack: missing rule\n");
+       if (unlikely(!rule)) {
+               WARN_ONCE(1, "Smack: missing rule\n");
                return -ENOENT;
        }