- Update to 2.6.25-rc3.

[linux-flexiantxendom0-3.2.10.git] / security / selinux / netlabel.c

diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 66e013d..0fa2be4 100644 (file)
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -36,6 +36,33 @@
 #include "security.h"
 
 /**
+ * selinux_netlbl_sidlookup_cached - Cache a SID lookup
+ * @skb: the packet
+ * @secattr: the NetLabel security attributes
+ * @sid: the SID
+ *
+ * Description:
+ * Query the SELinux security server to lookup the correct SID for the given
+ * security attributes.  If the query is successful, cache the result to speed
+ * up future lookups.  Returns zero on success, negative values on failure.
+ *
+ */
+static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
+                                          struct netlbl_lsm_secattr *secattr,
+                                          u32 *sid)
+{
+       int rc;
+
+       rc = security_netlbl_secattr_to_sid(secattr, sid);
+       if (rc == 0 &&
+           (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
+           (secattr->flags & NETLBL_SECATTR_CACHE))
+               netlbl_cache_add(skb, secattr);
+
+       return rc;
+}
+
+/**
  * selinux_netlbl_sock_setsid - Label a socket using the NetLabel mechanism
  * @sk: the socket to label
  * @sid: the SID to use
@@ -137,14 +164,14 @@ void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
         * lock as other threads could have access to ssec */
        rcu_read_lock();
        selinux_netlbl_sk_security_reset(newssec, ssec->sk->sk_family);
-       newssec->sclass = ssec->sclass;
        rcu_read_unlock();
 }
 
 /**
  * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
  * @skb: the packet
- * @base_sid: the SELinux SID to use as a context for MLS only attributes
+ * @family: protocol family
+ * @type: NetLabel labeling protocol type
  * @sid: the SID
  *
  * Description:
@@ -153,7 +180,10 @@ void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
  * assign to the packet.  Returns zero on success, negative values on failure.
  *
  */
-int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
+int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
+                                u16 family,
+                                u32 *type,
+                                u32 *sid)
 {
        int rc;
        struct netlbl_lsm_secattr secattr;
@@ -164,15 +194,12 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
        }
 
        netlbl_secattr_init(&secattr);
-       rc = netlbl_skbuff_getattr(skb, &secattr);
-       if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
-               rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);
-               if (rc == 0 &&
-                   (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
-                   (secattr.flags & NETLBL_SECATTR_CACHE))
-                       netlbl_cache_add(skb, &secattr);
-       } else
+       rc = netlbl_skbuff_getattr(skb, family, &secattr);
+       if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
+               rc = selinux_netlbl_sidlookup_cached(skb, &secattr, sid);
+       else
                *sid = SECSID_NULL;
+       *type = secattr.type;
        netlbl_secattr_destroy(&secattr);
 
        return rc;
@@ -190,13 +217,10 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
  */
 void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
 {
-       struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
        struct sk_security_struct *sksec = sk->sk_security;
        struct netlbl_lsm_secattr secattr;
        u32 nlbl_peer_sid;
 
-       sksec->sclass = isec->sclass;
-
        rcu_read_lock();
 
        if (sksec->nlbl_state != NLBL_REQUIRE) {
@@ -207,9 +231,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
        netlbl_secattr_init(&secattr);
        if (netlbl_sock_getattr(sk, &secattr) == 0 &&
            secattr.flags != NETLBL_SECATTR_NONE &&
-           security_netlbl_secattr_to_sid(&secattr,
-                                          SECINITSID_NETMSG,
-                                          &nlbl_peer_sid) == 0)
+           security_netlbl_secattr_to_sid(&secattr, &nlbl_peer_sid) == 0)
                sksec->peer_sid = nlbl_peer_sid;
        netlbl_secattr_destroy(&secattr);
 
@@ -234,11 +256,8 @@ int selinux_netlbl_socket_post_create(struct socket *sock)
 {
        int rc = 0;
        struct sock *sk = sock->sk;
-       struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
        struct sk_security_struct *sksec = sk->sk_security;
 
-       sksec->sclass = isec->sclass;
-
        rcu_read_lock();
        if (sksec->nlbl_state == NLBL_REQUIRE)
                rc = selinux_netlbl_sock_setsid(sk, sksec->sid);
@@ -292,6 +311,7 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
  * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
  * @sksec: the sock's sk_security_struct
  * @skb: the packet
+ * @family: protocol family
  * @ad: the audit data
  *
  * Description:
@@ -302,6 +322,7 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
  */
 int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
                                struct sk_buff *skb,
+                               u16 family,
                                struct avc_audit_data *ad)
 {
        int rc;
@@ -313,16 +334,10 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
                return 0;
 
        netlbl_secattr_init(&secattr);
-       rc = netlbl_skbuff_getattr(skb, &secattr);
-       if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
-               rc = security_netlbl_secattr_to_sid(&secattr,
-                                                   SECINITSID_NETMSG,
-                                                   &nlbl_sid);
-               if (rc == 0 &&
-                   (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
-                   (secattr.flags & NETLBL_SECATTR_CACHE))
-                       netlbl_cache_add(skb, &secattr);
-       } else
+       rc = netlbl_skbuff_getattr(skb, family, &secattr);
+       if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
+               rc = selinux_netlbl_sidlookup_cached(skb, &secattr, &nlbl_sid);
+       else
                nlbl_sid = SECINITSID_UNLABELED;
        netlbl_secattr_destroy(&secattr);
        if (rc != 0)