Merge branch 'master' into next

diff --combined security/security.c
index d953d251fdca709956252ddc147199658940e303,3a4b4f55b33f373d5a85145d61e6de95cce4bf3c..255b08559b2b62e057d5fda7a8b4396b2bdbb065
--- 1/security/security.c
--- 2/security/security.c
+++ b/security/security.c
@@@ -82,8 -82,8 +82,8 @@@ __setup("security=", choose_lsm)
   *
   * Return true if:
   *    -The passed LSM is the one chosen by user at boot time,
 - *    -or user didsn't specify a specific LSM and we're the first to ask
 - *     for registeration permissoin,
 + *    -or user didn't specify a specific LSM and we're the first to ask
 + *     for registration permission,
   *    -or the passed LSM is currently loaded.
   * Otherwise, return false.
   */
@@@ -101,13 -101,13 +101,13 @@@ int __init security_module_enable(struc
   * register_security - registers a security framework with the kernel
   * @ops: a pointer to the struct security_options that is to be registered
   *
 - * This function is to allow a security module to register itself with the
 + * This function allows a security module to register itself with the
   * kernel security subsystem.  Some rudimentary checking is done on the @ops
   * value passed to this function. You'll need to check first if your LSM
   * is allowed to register its @ops by calling security_module_enable(@ops).
   *
   * If there is already a security module registered with the kernel,
 - * an error will be returned.  Otherwise 0 is returned on success.
 + * an error will be returned.  Otherwise %0 is returned on success.
   */
  int register_security(struct security_operations *ops)
  {
@@@ -127,10 -127,14 +127,14 @@@
  
  /* Security operations */
  
- int security_ptrace(struct task_struct *parent, struct task_struct *child,
-                   unsigned int mode)
+ int security_ptrace_may_access(struct task_struct *child, unsigned int mode)
  {
-       return security_ops->ptrace(parent, child, mode);
+       return security_ops->ptrace_may_access(child, mode);
+ }
+ 
+ int security_ptrace_traceme(struct task_struct *parent)
+ {
+       return security_ops->ptrace_traceme(parent);
  }
  
  int security_capget(struct task_struct *target,

diff --combined security/selinux/hooks.c
index 3eae30609702a098aa00e8c7b0dabfa1649432a2,03fc6a81ae32bd783ddd96eca85f118a2ba79bd8..6b5790bba8f94ec95b47d8e922562838eb3c0c47
--- 1/security/selinux/hooks.c
--- 2/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@@ -957,8 -957,7 +957,8 @@@ out_err
        return rc;
  }
  
 -void selinux_write_opts(struct seq_file *m, struct security_mnt_opts *opts)
 +static void selinux_write_opts(struct seq_file *m,
 +                             struct security_mnt_opts *opts)
  {
        int i;
        char *prefix;
@@@ -1739,24 -1738,34 +1739,34 @@@ static inline u32 file_to_av(struct fil
  
  /* Hook functions begin here. */
  
- static int selinux_ptrace(struct task_struct *parent,
-                         struct task_struct *child,
-                         unsigned int mode)
+ static int selinux_ptrace_may_access(struct task_struct *child,
+                                    unsigned int mode)
  {
        int rc;
  
-       rc = secondary_ops->ptrace(parent, child, mode);
+       rc = secondary_ops->ptrace_may_access(child, mode);
        if (rc)
                return rc;
  
        if (mode == PTRACE_MODE_READ) {
-               struct task_security_struct *tsec = parent->security;
+               struct task_security_struct *tsec = current->security;
                struct task_security_struct *csec = child->security;
                return avc_has_perm(tsec->sid, csec->sid,
                                    SECCLASS_FILE, FILE__READ, NULL);
        }
  
-       return task_has_perm(parent, child, PROCESS__PTRACE);
+       return task_has_perm(current, child, PROCESS__PTRACE);
+ }
+ 
+ static int selinux_ptrace_traceme(struct task_struct *parent)
+ {
+       int rc;
+ 
+       rc = secondary_ops->ptrace_traceme(parent);
+       if (rc)
+               return rc;
+ 
+       return task_has_perm(parent, current, PROCESS__PTRACE);
  }
  
  static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
@@@ -3539,44 -3548,38 +3549,44 @@@ out
  #endif /* IPV6 */
  
  static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
 -                           char **addrp, int src, u8 *proto)
 +                           char **_addrp, int src, u8 *proto)
  {
 -      int ret = 0;
 +      char *addrp;
 +      int ret;
  
        switch (ad->u.net.family) {
        case PF_INET:
                ret = selinux_parse_skb_ipv4(skb, ad, proto);
 -              if (ret || !addrp)
 -                      break;
 -              *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
 -                                      &ad->u.net.v4info.daddr);
 -              break;
 +              if (ret)
 +                      goto parse_error;
 +              addrp = (char *)(src ? &ad->u.net.v4info.saddr :
 +                                     &ad->u.net.v4info.daddr);
 +              goto okay;
  
  #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
        case PF_INET6:
                ret = selinux_parse_skb_ipv6(skb, ad, proto);
 -              if (ret || !addrp)
 -                      break;
 -              *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
 -                                      &ad->u.net.v6info.daddr);
 -              break;
 +              if (ret)
 +                      goto parse_error;
 +              addrp = (char *)(src ? &ad->u.net.v6info.saddr :
 +                                     &ad->u.net.v6info.daddr);
 +              goto okay;
  #endif        /* IPV6 */
        default:
 -              break;
 +              addrp = NULL;
 +              goto okay;
        }
  
 -      if (unlikely(ret))
 -              printk(KERN_WARNING
 -                     "SELinux: failure in selinux_parse_skb(),"
 -                     " unable to parse packet\n");
 -
 +parse_error:
 +      printk(KERN_WARNING
 +             "SELinux: failure in selinux_parse_skb(),"
 +             " unable to parse packet\n");
        return ret;
 +
 +okay:
 +      if (_addrp)
 +              *_addrp = addrp;
 +      return 0;
  }
  
  /**
@@@ -5353,7 -5356,8 +5363,8 @@@ static int selinux_key_getsecurity(stru
  static struct security_operations selinux_ops = {
        .name =                         "selinux",
  
-       .ptrace =                       selinux_ptrace,
+       .ptrace_may_access =            selinux_ptrace_may_access,
+       .ptrace_traceme =               selinux_ptrace_traceme,
        .capget =                       selinux_capget,
        .capset_check =                 selinux_capset_check,
        .capset_set =                   selinux_capset_set,