[GIT PULL] Security subsystem updates for 4.9

[James Morris]

Summary:

o SELinux/LSM: overlayfs support, necessary for container filesystems
o LSM: finally remove the kernel_module_from_file hook
o Smack: treat signal delivery as an 'append' operation
o TPM: lots of bugfixes & updates
o Audit: new audit data type: LSM_AUDIT_DATA_FILE


Please pull.

---

The following changes since commit 29b4817d4018df78086157ea3a55c1d9424a7cfc:

  Linux 4.8-rc1 (2016-08-07 18:18:00 -0700)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git next

for you to fetch changes up to 1306d8e1c09fdc8ecb9ef235e2116352f810f9c5:

  Merge tag 'tpmdd-next-20160927' of git://git.infradead.org/users/jjs/linux-tpmdd into ra-next (2016-09-27 19:21:37 +1000)

----------------------------------------------------------------
Casey Schaufler (1):
      Smack: Signal delivery as an append operation

James Morris (4):
      Merge branch 'smack-for-4.9' of http://github.com/cschaufler/smack-next into next
      Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/selinux into next
      Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/selinux into next
      Merge tag 'tpmdd-next-20160927' of git://git.infradead.org/users/jjs/linux-tpmdd into ra-next

Jarkko Sakkinen (15):
      tpm: invalid self test error message
      tpm: fix a race condition in tpm2_unseal_trusted()
      tpm: remove unnecessary externs from tpm.h
      tpm: replace tpm_gen_interrupt() with tpm_tis_gen_interrupt()
      tpm: use tpm_transmit_cmd() in tpm2_probe()
      tpm: use tpm_pcr_read_dev() in tpm_do_selftest()
      tpm_crb: fix crb_req_canceled behavior
      tpm_crb: remove wmb()'s
      tpm_crb: refine the naming of constants
      tpm_crb: fix incorrect values of cmdReady and goIdle bits
      tpm: add check for minimum buffer size in tpm_transmit()
      Revert "tmp/tpm_crb: implement runtime pm for tpm_crb"
      Revert "tpm/tpm_crb: open code the crb_init into acpi_add"
      Revert "tmp/tpm_crb: fix Intel PTT hw bug during idle state"
      Revert "tpm/tpm_crb: implement tpm crb idle state"

Jason Gunthorpe (1):
      tpm/st33zp24: Remove useless tpm_gen_interrupt

Javier Martinez Canillas (1):
      security: Use IS_ENABLED() instead of checking for built-in or module

Julia Lawall (1):
      tpm: constify TPM 1.x header structures

Markus Elfring (1):
      Smack: Use memdup_user() rather than duplicating its implementation

Mickaël Salaün (4):
      module: Fully remove the kernel_module_from_file hook
      um/ptrace: Fix the syscall_trace_leave call
      um/ptrace: Fix the syscall number update after a ptrace
      seccomp: Remove 2-phase API documentation

Tomas Winkler (5):
      tpm/tpm_tis: remove unused itpm variable
      tmp/tpm_crb: drop include to platform_device
      tpm/tpm_crb: cache cmd_size register value.
      tpm/tpm_crb: drop useless cpu_to_le32 when writing to registers
      tpm/tpm_crb: fix the over 80 characters checkpatch warring

Vivek Goyal (8):
      security, overlayfs: provide copy up security hook for unioned files
      selinux: Implementation for inode_copy_up() hook
      security,overlayfs: Provide security hook for copy up of xattrs for overlay file
      selinux: Implementation for inode_copy_up_xattr() hook
      selinux: Pass security pointer to determine_inode_label()
      security, overlayfs: Provide hook to correctly label newly created files
      selinux: Implement dentry_create_files_as() hook
      lsm,audit,selinux: Introduce a new audit data type LSM_AUDIT_DATA_FILE

Wei Yongjun (1):
      selinux: fix error return code in policydb_read()

William Roberts (5):
      selinux: print leading 0x on ioctlcmd audits
      selinux: drop SECURITY_SELINUX_POLICYDB_VERSION_MAX
      selinux: detect invalid ebitmap
      selinux: initialize structures
      selinux: fix overflow and 0 length allocations

Winkler, Tomas (4):
      tpm/tpm_crb: implement tpm crb idle state
      tmp/tpm_crb: fix Intel PTT hw bug during idle state
      tpm/tpm_crb: open code the crb_init into acpi_add
      tmp/tpm_crb: implement runtime pm for tpm_crb

 arch/Kconfig                         |  11 ----
 arch/um/kernel/skas/syscall.c        |  10 +--
 arch/x86/um/ptrace_32.c              |   3 +
 arch/x86/um/ptrace_64.c              |   4 ++
 drivers/char/tpm/st33zp24/st33zp24.c |   2 -
 drivers/char/tpm/tpm-dev.c           |   2 +-
 drivers/char/tpm/tpm-interface.c     |  84 +++++++++++-------------
 drivers/char/tpm/tpm-sysfs.c         |   4 +-
 drivers/char/tpm/tpm.h               |  46 ++++++-------
 drivers/char/tpm/tpm2-cmd.c          | 124 +++++++++++++++++++----------------
 drivers/char/tpm/tpm_crb.c           |  50 +++++++-------
 drivers/char/tpm/tpm_tis_core.c      |  24 ++++---
 fs/overlayfs/copy_up.c               |  22 +++++++
 fs/overlayfs/dir.c                   |  10 +++
 include/linux/lsm_audit.h            |   2 +
 include/linux/lsm_hooks.h            |  37 ++++++++++-
 include/linux/security.h             |  25 ++++++-
 security/lsm_audit.c                 |  17 ++++-
 security/security.c                  |  27 ++++++++
 security/selinux/Kconfig             |  38 -----------
 security/selinux/hooks.c             | 106 +++++++++++++++++++++++-------
 security/selinux/include/security.h  |   4 --
 security/selinux/ss/conditional.c    |   2 +
 security/selinux/ss/ebitmap.c        |   3 +
 security/selinux/ss/policydb.c       |  12 ++--
 security/smack/Kconfig               |  12 ++++
 security/smack/smack.h               |  10 +++
 security/smack/smack_lsm.c           |  14 ++--
 security/smack/smack_netfilter.c     |   4 +-
 security/smack/smackfs.c             |  11 +---
 30 files changed, 447 insertions(+), 273 deletions(-)