kernel: smack security backport from kernel 4

Here is the backport of all patches relating to smack support
on kernel side. For more details, see file:

  meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README

Please note that patches are applied only if "smack" is in the
ditro features. Here are the 2 lines to add in the local.conf

OVERRIDES .= ":smack"
DISTRO_FEATURES_append = " smack"

Change-Id: I147a3532aec531f977d6ec34c576261835711f1e
Signed-off-by: Yannick GICQUEL <yannick.gicquel@iot.bzh>
Signed-off-by: José Bollo <jose.bollo@iot.bzh>

1 files changed, 80 insertions, 0 deletions

diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch
new file mode 100644
index 0000000..cb40c2f
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch
@@ -0,0 +1,80 @@
+From d7ad31586a99cf4a7715589e36e9e8cde2365ae1 Mon Sep 17 00:00:00 2001
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Mon, 28 Apr 2014 15:23:01 -0700
+Subject: [PATCH 32/54] Smack: Label cgroup files for systemd
+
+The cgroup filesystem isn't ready for an LSM to
+properly use extented attributes. This patch makes
+files created in the cgroup filesystem usable by
+a system running Smack and systemd.
+
+Targeted for git://git.gitorious.org/smack-next/kernel.git
+
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+---
+ security/smack/smack_lsm.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 6776130..1085bb7 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2821,6 +2821,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ 	 * of the superblock.
+ 	 */
+ 	if (opt_dentry->d_parent == opt_dentry) {
++		if (sbp->s_magic == CGROUP_SUPER_MAGIC) {
++			/*
++			 * The cgroup filesystem is never mounted,
++			 * so there's no opportunity to set the mount
++			 * options.
++			 */
++			sbsp->smk_root = smack_known_star.smk_known;
++			sbsp->smk_default = smack_known_star.smk_known;
++		}
+ 		isp->smk_inode = sbsp->smk_root;
+ 		isp->smk_flags |= SMK_INODE_INSTANT;
+ 		goto unlockandout;
+@@ -2834,16 +2843,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ 	 */
+ 	switch (sbp->s_magic) {
+ 	case SMACK_MAGIC:
++	case PIPEFS_MAGIC:
++	case SOCKFS_MAGIC:
++	case CGROUP_SUPER_MAGIC:
+ 		/*
+ 		 * Casey says that it's a little embarrassing
+ 		 * that the smack file system doesn't do
+ 		 * extended attributes.
+-		 */
+-		final = smack_known_star.smk_known;
+-		break;
+-	case PIPEFS_MAGIC:
+-		/*
++		 *
+ 		 * Casey says pipes are easy (?)
++		 *
++		 * Socket access is controlled by the socket
++		 * structures associated with the task involved.
++		 *
++		 * Cgroupfs is special
+ 		 */
+ 		final = smack_known_star.smk_known;
+ 		break;
+@@ -2855,13 +2868,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ 		 */
+ 		final = ckp->smk_known;
+ 		break;
+-	case SOCKFS_MAGIC:
+-		/*
+-		 * Socket access is controlled by the socket
+-		 * structures associated with the task involved.
+-		 */
+-		final = smack_known_star.smk_known;
+-		break;
+ 	case PROC_SUPER_MAGIC:
+ 		/*
+ 		 * Casey says procfs appears not to care.
+-- 
+2.1.4
+