kernel: smack security backport from kernel 4

Here is the backport of all patches relating to smack support
on kernel side. For more details, see file:

  meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README

Please note that patches are applied only if "smack" is in the
ditro features. Here are the 2 lines to add in the local.conf

OVERRIDES .= ":smack"
DISTRO_FEATURES_append = " smack"

Change-Id: I147a3532aec531f977d6ec34c576261835711f1e
Signed-off-by: Yannick GICQUEL <yannick.gicquel@iot.bzh>
Signed-off-by: José Bollo <jose.bollo@iot.bzh>

1 files changed, 82 insertions, 0 deletions

diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch
new file mode 100644
index 0000000..802c575
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch
@@ -0,0 +1,82 @@
+From f2b14844c3072a3f58ddd8096569e189afc308aa Mon Sep 17 00:00:00 2001
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Thu, 21 Nov 2013 10:55:10 +0200
+Subject: [PATCH 22/39] Smack: Cgroup filesystem access
+
+The cgroup filesystems are not mounted using conventional
+mechanisms. This prevents the use of mount options to
+set Smack attributes. This patch makes the behavior
+of cgroup filesystems compatable with the way systemd
+uses them.
+
+Change-Id: I1e0429f133db9e14117dc754d682dec08221354c
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
+---
+ security/smack/smack_lsm.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 14f52be..acd8574 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2713,6 +2713,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ 	 * of the superblock.
+ 	 */
+ 	if (opt_dentry->d_parent == opt_dentry) {
++		if (sbp->s_magic == CGROUP_SUPER_MAGIC) {
++			/*
++			 * The cgroup filesystem is never mounted,
++			 * so there's no opportunity to set the mount
++			 * options.
++			 */
++			sbsp->smk_root = smack_known_star.smk_known;
++			sbsp->smk_default = smack_known_star.smk_known;
++		}
+ 		isp->smk_inode = sbsp->smk_root;
+ 		isp->smk_flags |= SMK_INODE_INSTANT;
+ 		goto unlockandout;
+@@ -2726,16 +2735,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ 	 */
+ 	switch (sbp->s_magic) {
+ 	case SMACK_MAGIC:
++	case PIPEFS_MAGIC:
++	case SOCKFS_MAGIC:
++	case CGROUP_SUPER_MAGIC:
+ 		/*
+ 		 * Casey says that it's a little embarrassing
+ 		 * that the smack file system doesn't do
+ 		 * extended attributes.
+-		 */
+-		final = smack_known_star.smk_known;
+-		break;
+-	case PIPEFS_MAGIC:
+-		/*
++		 *
+ 		 * Casey says pipes are easy (?)
++		 *
++		 * Socket access is controlled by the socket
++		 * structures associated with the task involved.
++		 *
++		 * Cgroupfs is special
+ 		 */
+ 		final = smack_known_star.smk_known;
+ 		break;
+@@ -2747,13 +2760,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ 		 */
+ 		final = ckp->smk_known;
+ 		break;
+-	case SOCKFS_MAGIC:
+-		/*
+-		 * Socket access is controlled by the socket
+-		 * structures associated with the task involved.
+-		 */
+-		final = smack_known_star.smk_known;
+-		break;
+ 	case PROC_SUPER_MAGIC:
+ 		/*
+ 		 * Casey says procfs appears not to care.
+-- 
+1.9.1
+