Merge tag 'y2038-cleanups-5.5' of git://git.kernel.org:/pub/scm/linux/kernel/git...

[linux-2.6-microblaze.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 73986c1..116b4d6 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2549,9 +2549,8 @@ static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
 {
        const struct task_security_struct *tsec = selinux_cred(current_cred());
-       struct itimerval itimer;
        u32 osid, sid;
-       int rc, i;
+       int rc;
 
        osid = tsec->osid;
        sid = tsec->sid;
@@ -2569,11 +2568,8 @@ static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
        rc = avc_has_perm(&selinux_state,
                          osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
        if (rc) {
-               if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
-                       memset(&itimer, 0, sizeof itimer);
-                       for (i = 0; i < 3; i++)
-                               do_setitimer(i, &itimer, NULL);
-               }
+               clear_itimer();
+
                spin_lock_irq(&current->sighand->siglock);
                if (!fatal_signal_pending(current)) {
                        flush_sigqueue(&current->pending);
@@ -3144,6 +3140,9 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
                return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
        }
 
+       if (!selinux_state.initialized)
+               return (inode_owner_or_capable(inode) ? 0 : -EPERM);
+
        sbsec = inode->i_sb->s_security;
        if (!(sbsec->flags & SBLABEL_MNT))
                return -EOPNOTSUPP;
@@ -3227,6 +3226,15 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
                return;
        }
 
+       if (!selinux_state.initialized) {
+               /* If we haven't even been initialized, then we can't validate
+                * against a policy, so leave the label as invalid. It may
+                * resolve to a valid label on the next revalidation try if
+                * we've since initialized.
+                */
+               return;
+       }
+
        rc = security_context_to_sid_force(&selinux_state, value, size,
                                           &newsid);
        if (rc) {