From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 3 May 2017 15:50:52 +0000 (-0700)
Subject: Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux... 
X-Git-Tag: v4.12-rc1~123
X-Git-Url: https://git.kernelconcepts.de/?a=commitdiff_plain;h=0302e28dee643932ee7b3c112ebccdbb9f8ec32c;p=karo-tx-linux.git

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security subsystem updates from James Morris:
 "Highlights:

  IMA:
   - provide ">" and "<" operators for fowner/uid/euid rules

  KEYS:
   - add a system blacklist keyring

   - add KEYCTL_RESTRICT_KEYRING, exposes keyring link restriction
     functionality to userland via keyctl()

  LSM:
   - harden LSM API with __ro_after_init

   - add prlmit security hook, implement for SELinux

   - revive security_task_alloc hook

  TPM:
   - implement contextual TPM command 'spaces'"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (98 commits)
  tpm: Fix reference count to main device
  tpm_tis: convert to using locality callbacks
  tpm: fix handling of the TPM 2.0 event logs
  tpm_crb: remove a cruft constant
  keys: select CONFIG_CRYPTO when selecting DH / KDF
  apparmor: Make path_max parameter readonly
  apparmor: fix parameters so that the permission test is bypassed at boot
  apparmor: fix invalid reference to index variable of iterator line 836
  apparmor: use SHASH_DESC_ON_STACK
  security/apparmor/lsm.c: set debug messages
  apparmor: fix boolreturn.cocci warnings
  Smack: Use GFP_KERNEL for smk_netlbl_mls().
  smack: fix double free in smack_parse_opts_str()
  KEYS: add SP800-56A KDF support for DH
  KEYS: Keyring asymmetric key restrict method with chaining
  KEYS: Restrict asymmetric key linkage using a specific keychain
  KEYS: Add a lookup_restriction function for the asymmetric key type
  KEYS: Add KEYCTL_RESTRICT_KEYRING
  KEYS: Consistent ordering for __key_link_begin and restrict check
  KEYS: Add an optional lookup_restriction hook to key_type
  ...
---

0302e28dee643932ee7b3c112ebccdbb9f8ec32c
diff --cc include/linux/init_task.h
index 82be96564266,926f2f553cc5..e049526bc188
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@@ -297,7 -294,7 +303,8 @@@ extern struct cred init_cred
  	INIT_VTIME(tsk)							\
  	INIT_NUMA_BALANCING(tsk)					\
  	INIT_KASAN(tsk)							\
 +	INIT_LIVEPATCH(tsk)						\
+ 	INIT_TASK_SECURITY						\
  }
  
  
diff --cc include/linux/sched.h
index 1e590c3bd581,71b8df306bb0..3d4fa448223f
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@@ -1044,8 -1038,9 +1044,12 @@@ struct task_struct 
  	/* A live task holds one reference: */
  	atomic_t			stack_refcount;
  #endif
 +#ifdef CONFIG_LIVEPATCH
 +	int patch_state;
++#endif
+ #ifdef CONFIG_SECURITY
+ 	/* Used by LSM modules for access restriction: */
+ 	void				*security;
  #endif
  	/* CPU-specific state of this task: */
  	struct thread_struct		thread;