Merge git://git.infradead.org/mtd-2.6

[linux-2.6] / security / selinux / xfrm.c

diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index c750ef7af66f0c960c1cd3c6164f39b6dba83386..3e742b850af6e9632ecfd5e4d8b08b02fa0f00cd 100644 (file)
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -208,10 +208,8 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
 
        BUG_ON(uctx && pol);
 
-       if (pol)
-               goto from_policy;
-
-       BUG_ON(!uctx);
+       if (!uctx)
+               goto not_from_user;
 
        if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX)
                return -EINVAL;
@@ -251,11 +249,14 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
 
        return rc;
 
-from_policy:
-       BUG_ON(!pol);
-       rc = security_sid_mls_copy(pol->ctx_sid, sid, &ctx_sid);
-       if (rc)
-               goto out;
+not_from_user:
+       if (pol) {
+               rc = security_sid_mls_copy(pol->ctx_sid, sid, &ctx_sid);
+               if (rc)
+                       goto out;
+       }
+       else
+               ctx_sid = sid;
 
        rc = security_sid_to_context(ctx_sid, &ctx_str, &str_len);
        if (rc)
@@ -270,7 +271,6 @@ from_policy:
                goto out;
        }
 
-
        ctx->ctx_doi = XFRM_SC_DOI_LSM;
        ctx->ctx_alg = XFRM_SC_ALG_SELINUX;
        ctx->ctx_sid = ctx_sid;
@@ -293,13 +293,23 @@ out2:
  * LSM hook implementation that allocs and transfers uctx spec to
  * xfrm_policy.
  */
-int selinux_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *uctx)
+int selinux_xfrm_policy_alloc(struct xfrm_policy *xp,
+               struct xfrm_user_sec_ctx *uctx, struct sock *sk)
 {
        int err;
+       u32 sid;
 
        BUG_ON(!xp);
+       BUG_ON(uctx && sk);
+
+       if (sk) {
+               struct sk_security_struct *ssec = sk->sk_security;
+               sid = ssec->sid;
+       }
+       else
+               sid = SECSID_NULL;
 
-       err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, NULL, 0);
+       err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, NULL, sid);
        return err;
 }