[PATCH] SELinux: fix selinux_inode_setattr hook

This fixes the selinux_inode_setattr hook function to honor the ATTR_FORCE
flag, skipping any permission checking in that case.  Otherwise, it is
possible though unlikely for a denial from the hook to prevent proper
updating, e.g.  for remove_suid upon writing to a file.  This would only
occur if the process had write permission to a suid file but lacked setattr
permission to it.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

security/selinux/hooks.c

@@ -2140,6 +2140,9 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
 	if (rc)
 		return rc;
 
+	if (iattr->ia_valid & ATTR_FORCE)
+		return 0;
+
 	if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
 			       ATTR_ATIME_SET | ATTR_MTIME_SET))
 		return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);