[GIT PULL] SELinux patches for 4.7

[Paul Moore <pmoore@redhat.com>]

Hi James,

A good chunk of SELinux patches for 4.7, eleven in total.  Of the eleven, two 
are bug fixes, six are performance improvements relating to the inode label 
revalidation code, and three introduce improved functionality: kernel module 
loading restrictions, better handling for userns capability checks, and 
execstack checking on thread stacks.

All the patches pass the selinux-testsuite, have been in the pcmoore/kernel-
secnext builds, and as of a few minutes ago applied cleanly on top of linux-
security#next.  Please apply.

-Paul

---
The following changes since commit 9735a22799b9214d17d3c231fe377fc852f042e9:

  Linux 4.6-rc2 (2016-04-03 09:09:40 -0500)

are available in the git repository at:

  git://git.infradead.org/users/pcmoore/selinux stable-4.7

for you to fetch changes up to c2316dbf124257ae19fd2e29cb5ec51060649d38:

  selinux: apply execstack check on thread stacks (2016-04-26 15:47:57 -0400)

----------------------------------------------------------------
Janak Desai (1):
      netlabel: fix a problem with netlbl_secattr_catmap_setrng()

Jeff Vander Stoep (1):
      selinux: restrict kernel module loading

Paul Moore (6):
      selinux: don't revalidate inodes in selinux_socket_getpeersec_dgram()
      selinux: simply inode label states to INVALID and INITIALIZED
      selinux: consolidate the ptrace parent lookup code
      selinux: don't revalidate an inode's label when explicitly setting it
      selinux: delay inode label lookup as long as possible
      selinux: check ss_initialized before revalidating an inode label

Prarit Bhargava (1):
      selinux: Change bool variable name to index.

Stephen Smalley (2):
      selinux: distinguish non-init user namespace capability checks
      selinux: apply execstack check on thread stacks

 net/netlabel/netlabel_kapi.c           |   2 +-
 security/selinux/hooks.c               | 144 +++++++++++++++++++++---------
 security/selinux/include/classmap.h    |  30 ++++---
 security/selinux/include/conditional.h |   2 +-
 security/selinux/include/objsec.h      |   5 +-
 security/selinux/ss/services.c         |   6 +-
 6 files changed, 128 insertions(+), 61 deletions(-)

-- 
paul moore
security @ redhat