Enable setting security contexts on rootfs inodes.

rootfs (ramfs) can support setting of security contexts
by userspace due to the vfs fallback behavior of calling
the security module to set the in-core inode state
for security.* attributes when the filesystem does not
provide an xattr handler.  No xattr handler required
as the inodes are pinned in memory and have no backing
store.

This is useful in allowing early userspace to label individual
files within a rootfs while still providing a policy-defined
default via genfs.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Change-Id: I3436cf9ae27ade445e37376d7b9125746b1e506f
Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

With this change, calling
  prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)
disables privilege granting operations at execve-time.  For example, a
process will not be able to execute a setuid binary to change their uid
or gid if this bit is set.  The same is true for file capabilities.

Additionally, LSM_UNSAFE_NO_NEW_PRIVS is defined to ensure that
LSMs respect the requested behavior.

To determine if the NO_NEW_PRIVS bit is set, a task may call
  prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
It returns 1 if set and 0 if it is not set. If any of the arguments are
non-zero, it will return -1 and set errno to -EINVAL.
(PR_SET_NO_NEW_PRIVS behaves similarly.)

This functionality is desired for the proposed seccomp filter patch
series.  By using PR_SET_NO_NEW_PRIVS, it allows a task to modify the
system call behavior for itself and its child tasks without being
able to impact the behavior of a more privileged task.

Another potential use is making certain privileged operations
unprivileged.  For example, chroot may be considered "safe" if it cannot
affect privileged tasks.

Note, this patch causes execve to fail when PR_SET_NO_NEW_PRIVS is
set and AppArmor is in use.  It is fixed in a subsequent patch.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Eric Paris <eparis@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>

v18: updated change desc
v17: using new define values as per 3.4
Signed-off-by: James Morris <james.l.morris@oracle.com>
Fix execve behavior apparmor for PR_{GET,SET}_NO_NEW_PRIVS

Add support for AppArmor to explicitly fail requested domain transitions
if NO_NEW_PRIVS is set and the task is not unconfined.

Transitions from unconfined are still allowed because this always results
in a reduction of privileges.

Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>

v18: new acked-by, new description
Signed-off-by: James Morris <james.l.morris@oracle.com>
msm: vidc: add support for the bitstream_restrict flag

Adds support for the MFC core to add the bitstream_restrict flag in the
sps/pps for H264 codecs.  This allows for the decoder to determine how
many frames to buffer when decoding.

Change-Id: Ic0de960d92a771d74c303dac7100734d6411fc45
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Don't free shared memory on channel close

The driver already frees the memory in vcd_ddl.c at ddl_close().
No need to prematurely free the memory here.

Change-Id: If1ddacf68770113423d4aeb2b72e79caf5ca07ce
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: Reset stop_called state when START is called

The driver needs to reset the stop_called field once START called.
Otherwise in START, STOP, START, STOP sequences the secondary STOP will
be treated as a duplicate STOP and ignored.

Change-Id: I8b7d069236027a01103c80b7deeb19c331ede05a
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
vidc: Fix EOS handling if video h/w has a frame in transaction

In case of video hardware is encoding a frame and EOS buffer with
with zero data length arrived, set the EOS flag to the transaction
available in the transaction table which will be passed to the
client in frame done callback from the video hardware.

Change-Id: I03862906be603ff769fb6aa0a2191a9ea87529ca
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
msm: vidc: set EOS on output buffer pending transaction

If EOS is signalled while an output buffer is in transaction,
mark EOS when that buffer is returned.
This is observed in case client sends an empty buffer with EOS

Change-Id: I9b4ce6331eb7a70886c1802d1f99e1d77d65fa64
Signed-off-by: Deepak Verma <dverma@codeaurora.org>