Merge branch 'smack-for-4.17' of git://github.com/cschaufler/next-smack into next...

[sfrench/cifs-2.6.git] / security / smack / smack_lsm.c

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 03fdecba93bb2b238d91e0e29efa0783c7e84b72..432e5ca4251c8bc3471a1a9c686350001e1c7fb9 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2228,15 +2228,13 @@ static int smack_task_movememory(struct task_struct *p)
  * @p: the task object
  * @info: unused
  * @sig: unused
- * @secid: identifies the smack to use in lieu of current's
+ * @cred: identifies the cred to use in lieu of current's
  *
  * Return 0 if write access is permitted
  *
- * The secid behavior is an artifact of an SELinux hack
- * in the USB code. Someday it may go away.
  */
 static int smack_task_kill(struct task_struct *p, struct siginfo *info,
-                          int sig, u32 secid)
+                          int sig, const struct cred *cred)
 {
        struct smk_audit_info ad;
        struct smack_known *skp;
@@ -2252,17 +2250,17 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
         * Sending a signal requires that the sender
         * can write the receiver.
         */
-       if (secid == 0) {
+       if (cred == NULL) {
                rc = smk_curacc(tkp, MAY_DELIVER, &ad);
                rc = smk_bu_task(p, MAY_DELIVER, rc);
                return rc;
        }
        /*
-        * If the secid isn't 0 we're dealing with some USB IO
+        * If the cred isn't NULL we're dealing with some USB IO
         * specific behavior. This is not clean. For one thing
         * we can't take privilege into account.
         */
-       skp = smack_from_secid(secid);
+       skp = smk_of_task(cred->security);
        rc = smk_access(skp, tkp, MAY_DELIVER, &ad);
        rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc);
        return rc;
@@ -3431,6 +3429,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
        if (opt_dentry->d_parent == opt_dentry) {
                switch (sbp->s_magic) {
                case CGROUP_SUPER_MAGIC:
+               case CGROUP2_SUPER_MAGIC:
                        /*
                         * The cgroup filesystem is never mounted,
                         * so there's no opportunity to set the mount
@@ -3474,6 +3473,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
        switch (sbp->s_magic) {
        case SMACK_MAGIC:
        case CGROUP_SUPER_MAGIC:
+       case CGROUP2_SUPER_MAGIC:
                /*
                 * Casey says that it's a little embarrassing
                 * that the smack file system doesn't do