Pull hp-pci-root into test branch

[linux-drm-fsl-dcu.git] / security / selinux / ss / services.c

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index b43dd803fd5e513cdc0abd4ece30201d273c6657..ca9154dc5d825bea7f680de2f42b0979e4a930a6 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -55,6 +55,7 @@
 #include "objsec.h"
 #include "selinux_netlabel.h"
 #include "xfrm.h"
+#include "ebitmap.h"
 
 extern void selnl_notify_policyload(u32 seqno);
 unsigned int policydb_loaded_version;
@@ -1298,6 +1299,7 @@ int security_load_policy(void *data, size_t len)
                avc_ss_reset(seqno);
                selnl_notify_policyload(seqno);
                selinux_netlbl_cache_invalidate();
+               selinux_xfrm_notify_policyload();
                return 0;
        }
 
@@ -1353,6 +1355,7 @@ int security_load_policy(void *data, size_t len)
        avc_ss_reset(seqno);
        selnl_notify_policyload(seqno);
        selinux_netlbl_cache_invalidate();
+       selinux_xfrm_notify_policyload();
 
        return 0;
 
@@ -1852,6 +1855,7 @@ out:
        if (!rc) {
                avc_ss_reset(seqno);
                selnl_notify_policyload(seqno);
+               selinux_xfrm_notify_policyload();
        }
        return rc;
 }
@@ -1915,11 +1919,10 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
        newcon.user = context1->user;
        newcon.role = context1->role;
        newcon.type = context1->type;
-       rc = mls_copy_context(&newcon, context2);
+       rc = mls_context_cpy(&newcon, context2);
        if (rc)
                goto out_unlock;
 
-
        /* Check the validity of the new context. */
        if (!policydb_context_isvalid(&policydb, &newcon)) {
                rc = convert_context_handle_invalid_context(&newcon);
@@ -2384,13 +2387,10 @@ static int selinux_netlbl_secattr_to_sid(struct sk_buff *skb,
                ctx_new.user = ctx->user;
                ctx_new.role = ctx->role;
                ctx_new.type = ctx->type;
-               mls_import_lvl(&ctx_new, secattr->mls_lvl, secattr->mls_lvl);
+               mls_import_netlbl_lvl(&ctx_new, secattr);
                if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
-                       if (mls_import_cat(&ctx_new,
-                                          secattr->mls_cat,
-                                          secattr->mls_cat_len,
-                                          NULL,
-                                          0) != 0)
+                       if (ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
+                                                 secattr->mls_cat) != 0)
                                goto netlbl_secattr_to_sid_return;
                        ctx_new.range.level[1].cat.highbit =
                                ctx_new.range.level[0].cat.highbit;
@@ -2486,24 +2486,17 @@ static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid)
 
        secattr.domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
                                 GFP_ATOMIC);
-       mls_export_lvl(ctx, &secattr.mls_lvl, NULL);
-       rc = mls_export_cat(ctx,
-                           &secattr.mls_cat,
-                           &secattr.mls_cat_len,
-                           NULL,
-                           NULL);
+       secattr.flags |= NETLBL_SECATTR_DOMAIN;
+       mls_export_netlbl_lvl(ctx, &secattr);
+       rc = mls_export_netlbl_cat(ctx, &secattr);
        if (rc != 0)
                goto netlbl_socket_setsid_return;
 
-       secattr.flags |= NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
-       if (secattr.mls_cat)
-               secattr.flags |= NETLBL_SECATTR_MLS_CAT;
-
        rc = netlbl_socket_setattr(sock, &secattr);
        if (rc == 0) {
-               spin_lock(&sksec->nlbl_lock);
+               spin_lock_bh(&sksec->nlbl_lock);
                sksec->nlbl_state = NLBL_LABELED;
-               spin_unlock(&sksec->nlbl_lock);
+               spin_unlock_bh(&sksec->nlbl_lock);
        }
 
 netlbl_socket_setsid_return:
@@ -2669,9 +2662,11 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
                rcu_read_unlock();
                return 0;
        }
-       lock_sock(sock->sk);
+       local_bh_disable();
+       bh_lock_sock_nested(sock->sk);
        rc = selinux_netlbl_socket_setsid(sock, sksec->sid);
-       release_sock(sock->sk);
+       bh_unlock_sock(sock->sk);
+       local_bh_enable();
        rcu_read_unlock();
 
        return rc;