Merge tag 'apparmor-pr-2017-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git...

Pull apparmor updates from John Johansen:
 "No features this time, just minor cleanups and bug fixes.

  Cleanups:
   - fix spelling mistake: "resoure" -> "resource"
   - remove unused redundant variable stop
   - Fix bool initialization/comparison

  Bug Fixes:
   - initialized returned struct aa_perms
   - fix leak of null profile name if profile allocation fails
   - ensure that undecidable profile attachments fail
   - fix profile attachment for special unconfined profiles
   - fix locking when creating a new complain profile.
   - fix possible recursive lock warning in __aa_create_ns"

* tag 'apparmor-pr-2017-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
  apparmor: fix possible recursive lock warning in __aa_create_ns
  apparmor: fix locking when creating a new complain profile.
  apparmor: fix profile attachment for special unconfined profiles
  apparmor: ensure that undecidable profile attachments fail
  apparmor: fix leak of null profile name if profile allocation fails
  apparmor: remove unused redundant variable stop
  apparmor: Fix bool initialization/comparison
  apparmor: initialized returned struct aa_perms
  apparmor: fix spelling mistake: "resoure" -> "resource"

diff --combined security/apparmor/label.c
index ad28e03a6f30341ab013e23cc2641f144ab44ea1,f5df9eaba4df4058d04b228c0692b42dd28dfd41..324fe5c60f8781c952138d0a764a5c2223f6353b
--- 1/security/apparmor/label.c
--- 2/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@@ -80,7 -80,7 +80,7 @@@ void __aa_proxy_redirect(struct aa_labe
  
        AA_BUG(!orig);
        AA_BUG(!new);
 -      AA_BUG(!write_is_locked(&labels_set(orig)->lock));
 +      lockdep_assert_held_exclusive(&labels_set(orig)->lock);
  
        tmp = rcu_dereference_protected(orig->proxy->label,
                                        &labels_ns(orig)->lock);
@@@ -571,7 -571,7 +571,7 @@@ static bool __label_remove(struct aa_la
  
        AA_BUG(!ls);
        AA_BUG(!label);
 -      AA_BUG(!write_is_locked(&ls->lock));
 +      lockdep_assert_held_exclusive(&ls->lock);
  
        if (new)
                __aa_proxy_redirect(label, new);
@@@ -608,7 -608,7 +608,7 @@@ static bool __label_replace(struct aa_l
        AA_BUG(!ls);
        AA_BUG(!old);
        AA_BUG(!new);
 -      AA_BUG(!write_is_locked(&ls->lock));
 +      lockdep_assert_held_exclusive(&ls->lock);
        AA_BUG(new->flags & FLAG_IN_TREE);
  
        if (!label_is_stale(old))
@@@ -645,7 -645,7 +645,7 @@@ static struct aa_label *__label_insert(
        AA_BUG(!ls);
        AA_BUG(!label);
        AA_BUG(labels_set(label) != ls);
 -      AA_BUG(!write_is_locked(&ls->lock));
 +      lockdep_assert_held_exclusive(&ls->lock);
        AA_BUG(label->flags & FLAG_IN_TREE);
  
        /* Figure out where to put new node */
@@@ -2115,7 -2115,7 +2115,7 @@@ void __aa_labelset_update_subtree(struc
        __labelset_update(ns);
  
        list_for_each_entry(child, &ns->sub_ns, base.list) {
-               mutex_lock(&child->lock);
+               mutex_lock_nested(&child->lock, child->level);
                __aa_labelset_update_subtree(child);
                mutex_unlock(&child->lock);
        }

diff --combined security/apparmor/lsm.c
index 17893fde44873ade4c28a62b7a3729e73d7c161d,a2fb2de5611a6341161a9506f0ef33ff610ca1b6..9a65eeaf7dfa22ab3b76d05b1445c56031195cd3
--- 1/security/apparmor/lsm.c
--- 2/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@@ -813,11 -813,11 +813,11 @@@ static const struct kernel_param_ops pa
        .get = param_get_aalockpolicy
  };
  
 -static int param_set_audit(const char *val, struct kernel_param *kp);
 -static int param_get_audit(char *buffer, struct kernel_param *kp);
 +static int param_set_audit(const char *val, const struct kernel_param *kp);
 +static int param_get_audit(char *buffer, const struct kernel_param *kp);
  
 -static int param_set_mode(const char *val, struct kernel_param *kp);
 -static int param_get_mode(char *buffer, struct kernel_param *kp);
 +static int param_set_mode(const char *val, const struct kernel_param *kp);
 +static int param_get_mode(char *buffer, const struct kernel_param *kp);
  
  /* Flag values, also controllable via /sys/module/apparmor/parameters
   * We define special types as we want to do additional mediation.
@@@ -846,7 -846,7 +846,7 @@@ module_param_call(audit, param_set_audi
  /* Determines if audit header is included in audited messages.  This
   * provides more context if the audit daemon is not running
   */
- bool aa_g_audit_header = 1;
+ bool aa_g_audit_header = true;
  module_param_named(audit_header, aa_g_audit_header, aabool,
                   S_IRUSR | S_IWUSR);
  
@@@ -871,7 -871,7 +871,7 @@@ module_param_named(path_max, aa_g_path_
   * DEPRECATED: read only as strict checking of load is always done now
   * that none root users (user namespaces) can load policy.
   */
- bool aa_g_paranoid_load = 1;
+ bool aa_g_paranoid_load = true;
  module_param_named(paranoid_load, aa_g_paranoid_load, aabool, S_IRUGO);
  
  /* Boot time disable flag */
@@@ -951,7 -951,7 +951,7 @@@ static int param_get_aauint(char *buffe
        return param_get_uint(buffer, kp);
  }
  
 -static int param_get_audit(char *buffer, struct kernel_param *kp)
 +static int param_get_audit(char *buffer, const struct kernel_param *kp)
  {
        if (!apparmor_enabled)
                return -EINVAL;
@@@ -960,7 -960,7 +960,7 @@@
        return sprintf(buffer, "%s", audit_mode_names[aa_g_audit]);
  }
  
 -static int param_set_audit(const char *val, struct kernel_param *kp)
 +static int param_set_audit(const char *val, const struct kernel_param *kp)
  {
        int i;
  
@@@ -981,7 -981,7 +981,7 @@@
        return -EINVAL;
  }
  
 -static int param_get_mode(char *buffer, struct kernel_param *kp)
 +static int param_get_mode(char *buffer, const struct kernel_param *kp)
  {
        if (!apparmor_enabled)
                return -EINVAL;
@@@ -991,7 -991,7 +991,7 @@@
        return sprintf(buffer, "%s", aa_profile_mode_names[aa_g_profile_mode]);
  }
  
 -static int param_set_mode(const char *val, struct kernel_param *kp)
 +static int param_set_mode(const char *val, const struct kernel_param *kp)
  {
        int i;
  
@@@ -1119,7 -1119,7 +1119,7 @@@ static int __init apparmor_init(void
  
        if (!apparmor_enabled || !security_module_enable("apparmor")) {
                aa_info_message("AppArmor disabled by boot time parameter");
-               apparmor_enabled = 0;
+               apparmor_enabled = false;
                return 0;
        }
  
@@@ -1175,7 -1175,7 +1175,7 @@@ alloc_out
        aa_destroy_aafs();
        aa_teardown_dfa_engine();
  
-       apparmor_enabled = 0;
+       apparmor_enabled = false;
        return error;
  }