7 files changed, 357 insertions, 42 deletions

diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
index b64f2772b030..3628d3a868b6 100644
--- a/security/selinux/ss/avtab.c
+++ b/security/selinux/ss/avtab.c
@@ -24,6 +24,7 @@
 #include "policydb.h"
 
 static struct kmem_cache *avtab_node_cachep;
+static struct kmem_cache *avtab_xperms_cachep;
 
 /* Based on MurmurHash3, written by Austin Appleby and placed in the
  * public domain.
@@ -70,11 +71,24 @@ avtab_insert_node(struct avtab *h, int hvalue,
                   struct avtab_key *key, struct avtab_datum *datum)
 {
         struct avtab_node *newnode;
+        struct avtab_extended_perms *xperms;
         newnode = kmem_cache_zalloc(avtab_node_cachep, GFP_KERNEL);
         if (newnode == NULL)
                 return NULL;
         newnode->key = *key;
-        newnode->datum = *datum;
+
+        if (key->specified & AVTAB_XPERMS) {
+                xperms = kmem_cache_zalloc(avtab_xperms_cachep, GFP_KERNEL);
+                if (xperms == NULL) {
+                        kmem_cache_free(avtab_node_cachep, newnode);
+                        return NULL;
+                }
+                *xperms = *(datum->u.xperms);
+                newnode->datum.u.xperms = xperms;
+        } else {
+                newnode->datum.u.data = datum->u.data;
+        }
+
         if (prev) {
                 newnode->next = prev->next;
                 prev->next = newnode;
@@ -107,8 +121,12 @@ static int avtab_insert(struct avtab *h, struct avtab_key *key, struct avtab_dat
                 if (key->source_type == cur->key.source_type &&
                     key->target_type == cur->key.target_type &&
                     key->target_class == cur->key.target_class &&
-                    (specified & cur->key.specified))
+                    (specified & cur->key.specified)) {
+                        /* extended perms may not be unique */
+                        if (specified & AVTAB_XPERMS)
+                                break;
                         return -EEXIST;
+                }
                 if (key->source_type < cur->key.source_type)
                         break;
                 if (key->source_type == cur->key.source_type &&
@@ -271,6 +289,9 @@ void avtab_destroy(struct avtab *h)
                 while (cur) {
                         temp = cur;
                         cur = cur->next;
+                        if (temp->key.specified & AVTAB_XPERMS)
+                                kmem_cache_free(avtab_xperms_cachep,
+                                                temp->datum.u.xperms);
                         kmem_cache_free(avtab_node_cachep, temp);
                 }
         }
@@ -359,7 +380,10 @@ static uint16_t spec_order[] = {
         AVTAB_AUDITALLOW,
         AVTAB_TRANSITION,
         AVTAB_CHANGE,
-        AVTAB_MEMBER
+        AVTAB_MEMBER,
+        AVTAB_XPERMS_ALLOWED,
+        AVTAB_XPERMS_AUDITALLOW,
+        AVTAB_XPERMS_DONTAUDIT
 };
 
 int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
@@ -369,10 +393,11 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
 {
         __le16 buf16[4];
         u16 enabled;
-        __le32 buf32[7];
         u32 items, items2, val, vers = pol->policyvers;
         struct avtab_key key;
         struct avtab_datum datum;
+        struct avtab_extended_perms xperms;
+        __le32 buf32[ARRAY_SIZE(xperms.perms.p)];
         int i, rc;
         unsigned set;
 
@@ -429,11 +454,15 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
                         printk(KERN_ERR "SELinux: avtab: entry has both access vectors and types\n");
                         return -EINVAL;
                 }
+                if (val & AVTAB_XPERMS) {
+                        printk(KERN_ERR "SELinux: avtab: entry has extended permissions\n");
+                        return -EINVAL;
+                }
 
                 for (i = 0; i < ARRAY_SIZE(spec_order); i++) {
                         if (val & spec_order[i]) {
                                 key.specified = spec_order[i] | enabled;
-                                datum.data = le32_to_cpu(buf32[items++]);
+                                datum.u.data = le32_to_cpu(buf32[items++]);
                                 rc = insertf(a, &key, &datum, p);
                                 if (rc)
                                         return rc;
@@ -476,14 +505,42 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
                 return -EINVAL;
         }
 
-        rc = next_entry(buf32, fp, sizeof(u32));
-        if (rc) {
-                printk(KERN_ERR "SELinux: avtab: truncated entry\n");
-                return rc;
+        if ((vers < POLICYDB_VERSION_XPERMS_IOCTL) &&
+                        (key.specified & AVTAB_XPERMS)) {
+                printk(KERN_ERR "SELinux:  avtab:  policy version %u does not "
+                                "support extended permissions rules and one "
+                                "was specified\n", vers);
+                return -EINVAL;
+        } else if (key.specified & AVTAB_XPERMS) {
+                memset(&xperms, 0, sizeof(struct avtab_extended_perms));
+                rc = next_entry(&xperms.specified, fp, sizeof(u8));
+                if (rc) {
+                        printk(KERN_ERR "SELinux: avtab: truncated entry\n");
+                        return rc;
+                }
+                rc = next_entry(&xperms.driver, fp, sizeof(u8));
+                if (rc) {
+                        printk(KERN_ERR "SELinux: avtab: truncated entry\n");
+                        return rc;
+                }
+                rc = next_entry(buf32, fp, sizeof(u32)*ARRAY_SIZE(xperms.perms.p));
+                if (rc) {
+                        printk(KERN_ERR "SELinux: avtab: truncated entry\n");
+                        return rc;
+                }
+                for (i = 0; i < ARRAY_SIZE(xperms.perms.p); i++)
+                        xperms.perms.p[i] = le32_to_cpu(buf32[i]);
+                datum.u.xperms = &xperms;
+        } else {
+                rc = next_entry(buf32, fp, sizeof(u32));
+                if (rc) {
+                        printk(KERN_ERR "SELinux: avtab: truncated entry\n");
+                        return rc;
+                }
+                datum.u.data = le32_to_cpu(*buf32);
         }
-        datum.data = le32_to_cpu(*buf32);
         if ((key.specified & AVTAB_TYPE) &&
-            !policydb_type_isvalid(pol, datum.data)) {
+            !policydb_type_isvalid(pol, datum.u.data)) {
                 printk(KERN_ERR "SELinux: avtab: invalid type\n");
                 return -EINVAL;
         }
@@ -543,8 +600,9 @@ bad:
 int avtab_write_item(struct policydb *p, struct avtab_node *cur, void *fp)
 {
         __le16 buf16[4];
-        __le32 buf32[1];
+        __le32 buf32[ARRAY_SIZE(cur->datum.u.xperms->perms.p)];
         int rc;
+        unsigned int i;
 
         buf16[0] = cpu_to_le16(cur->key.source_type);
         buf16[1] = cpu_to_le16(cur->key.target_type);
@@ -553,8 +611,22 @@ int avtab_write_item(struct policydb *p, struct avtab_node *cur, void *fp)
         rc = put_entry(buf16, sizeof(u16), 4, fp);
         if (rc)
                 return rc;
-        buf32[0] = cpu_to_le32(cur->datum.data);
-        rc = put_entry(buf32, sizeof(u32), 1, fp);
+
+        if (cur->key.specified & AVTAB_XPERMS) {
+                rc = put_entry(&cur->datum.u.xperms->specified, sizeof(u8), 1, fp);
+                if (rc)
+                        return rc;
+                rc = put_entry(&cur->datum.u.xperms->driver, sizeof(u8), 1, fp);
+                if (rc)
+                        return rc;
+                for (i = 0; i < ARRAY_SIZE(cur->datum.u.xperms->perms.p); i++)
+                        buf32[i] = cpu_to_le32(cur->datum.u.xperms->perms.p[i]);
+                rc = put_entry(buf32, sizeof(u32),
+                                ARRAY_SIZE(cur->datum.u.xperms->perms.p), fp);
+        } else {
+                buf32[0] = cpu_to_le32(cur->datum.u.data);
+                rc = put_entry(buf32, sizeof(u32), 1, fp);
+        }
         if (rc)
                 return rc;
         return 0;
@@ -588,9 +660,13 @@ void avtab_cache_init(void)
         avtab_node_cachep = kmem_cache_create("avtab_node",
                                               sizeof(struct avtab_node),
                                               0, SLAB_PANIC, NULL);
+        avtab_xperms_cachep = kmem_cache_create("avtab_extended_perms",
+                                                sizeof(struct avtab_extended_perms),
+                                                0, SLAB_PANIC, NULL);
 }
 
 void avtab_cache_destroy(void)
 {
         kmem_cache_destroy(avtab_node_cachep);
+        kmem_cache_destroy(avtab_xperms_cachep);
 }
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index adb451cd44f9..d946c9dc3c9c 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -23,6 +23,7 @@
 #ifndef _SS_AVTAB_H_
 #define _SS_AVTAB_H_
 
+#include "security.h"
 #include <linux/flex_array.h>
 
 struct avtab_key {
@@ -37,13 +38,43 @@ struct avtab_key {
 #define AVTAB_MEMBER            0x0020
 #define AVTAB_CHANGE            0x0040
 #define AVTAB_TYPE              (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
+/* extended permissions */
+#define AVTAB_XPERMS_ALLOWED    0x0100
+#define AVTAB_XPERMS_AUDITALLOW 0x0200
+#define AVTAB_XPERMS_DONTAUDIT  0x0400
+#define AVTAB_XPERMS            (AVTAB_XPERMS_ALLOWED | \
+                                AVTAB_XPERMS_AUDITALLOW | \
+                                AVTAB_XPERMS_DONTAUDIT)
 #define AVTAB_ENABLED_OLD   0x80000000 /* reserved for used in cond_avtab */
 #define AVTAB_ENABLED           0x8000 /* reserved for used in cond_avtab */
         u16 specified;  /* what field is specified */
 };
 
+/*
+ * For operations that require more than the 32 permissions provided by the avc
+ * extended permissions may be used to provide 256 bits of permissions.
+ */
+struct avtab_extended_perms {
+/* These are not flags. All 256 values may be used */
+#define AVTAB_XPERMS_IOCTLFUNCTION      0x01
+#define AVTAB_XPERMS_IOCTLDRIVER        0x02
+        /* extension of the avtab_key specified */
+        u8 specified; /* ioctl, netfilter, ... */
+        /*
+         * if 256 bits is not adequate as is often the case with ioctls, then
+         * multiple extended perms may be used and the driver field
+         * specifies which permissions are included.
+         */
+        u8 driver;
+        /* 256 bits of permissions */
+        struct extended_perms_data perms;
+};
+
 struct avtab_datum {
-        u32 data; /* access vector or type value */
+        union {
+                u32 data; /* access vector or type value */
+                struct avtab_extended_perms *xperms;
+        } u;
 };
 
 struct avtab_node {
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 62c6773be0b7..18643bf9894d 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -15,6 +15,7 @@
 
 #include "security.h"
 #include "conditional.h"
+#include "services.h"
 
 /*
  * cond_evaluate_expr evaluates a conditional expr
@@ -612,21 +613,39 @@ int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
 
         return 0;
 }
+
+void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
+                struct extended_perms_decision *xpermd)
+{
+        struct avtab_node *node;
+
+        if (!ctab || !key || !xpermd)
+                return;
+
+        for (node = avtab_search_node(ctab, key); node;
+                        node = avtab_search_node_next(node, key->specified)) {
+                if (node->key.specified & AVTAB_ENABLED)
+                        services_compute_xperms_decision(xpermd, node);
+        }
+        return;
+
+}
 /* Determine whether additional permissions are granted by the conditional
  * av table, and if so, add them to the result
  */
-void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
+void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
+                struct av_decision *avd, struct extended_perms *xperms)
 {
         struct avtab_node *node;
 
-        if (!ctab || !key || !avd)
+        if (!ctab || !key || !avd || !xperms)
                 return;
 
         for (node = avtab_search_node(ctab, key); node;
                                 node = avtab_search_node_next(node, key->specified)) {
                 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
-                        avd->allowed |= node->datum.data;
+                        avd->allowed |= node->datum.u.data;
                 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
                         /* Since a '0' in an auditdeny mask represents a
@@ -634,10 +653,13 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decisi
                          * the '&' operand to ensure that all '0's in the mask
                          * are retained (much unlike the allow and auditallow cases).
                          */
-                        avd->auditdeny &= node->datum.data;
+                        avd->auditdeny &= node->datum.u.data;
                 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
-                        avd->auditallow |= node->datum.data;
+                        avd->auditallow |= node->datum.u.data;
+                if ((node->key.specified & AVTAB_ENABLED) &&
+                                (node->key.specified & AVTAB_XPERMS))
+                        services_compute_xperms_drivers(xperms, node);
         }
         return;
 }
diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h
index 4d1f87466508..ddb43e7e1c75 100644
--- a/security/selinux/ss/conditional.h
+++ b/security/selinux/ss/conditional.h
@@ -73,8 +73,10 @@ int cond_read_list(struct policydb *p, void *fp);
 int cond_write_bool(void *key, void *datum, void *ptr);
 int cond_write_list(struct policydb *p, struct cond_node *list, void *fp);
 
-void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd);
-
+void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
+                struct av_decision *avd, struct extended_perms *xperms);
+void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
+                struct extended_perms_decision *xpermd);
 int evaluate_cond_node(struct policydb *p, struct cond_node *node);
 
 #endif /* _CONDITIONAL_H_ */
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 74aa224267c1..992a31530825 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -148,6 +148,11 @@ static struct policydb_compat_info policydb_compat[] = {
                 .sym_num        = SYM_NUM,
                 .ocon_num       = OCON_NUM,
         },
+        {
+                .version        = POLICYDB_VERSION_XPERMS_IOCTL,
+                .sym_num        = SYM_NUM,
+                .ocon_num       = OCON_NUM,
+        },
 };
 
 static struct policydb_compat_info *policydb_lookup_compat(int version)
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 9e2d82070915..b7df12ba61d8 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -93,9 +93,10 @@ static int context_struct_to_string(struct context *context, char **scontext,
                                     u32 *scontext_len);
 
 static void context_struct_compute_av(struct context *scontext,
-                                      struct context *tcontext,
-                                      u16 tclass,
-                                      struct av_decision *avd);
+                                        struct context *tcontext,
+                                        u16 tclass,
+                                        struct av_decision *avd,
+                                        struct extended_perms *xperms);
 
 struct selinux_mapping {
         u16 value; /* policy value */
@@ -565,7 +566,8 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(&lo_scontext,
                                           tcontext,
                                           tclass,
-                                          &lo_avd);
+                                          &lo_avd,
+                                          NULL);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
                 masked = ~lo_avd.allowed & avd->allowed;
@@ -580,7 +582,8 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(scontext,
                                           &lo_tcontext,
                                           tclass,
-                                          &lo_avd);
+                                          &lo_avd,
+                                          NULL);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
                 masked = ~lo_avd.allowed & avd->allowed;
@@ -596,7 +599,8 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(&lo_scontext,
                                           &lo_tcontext,
                                           tclass,
-                                          &lo_avd);
+                                          &lo_avd,
+                                          NULL);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
                 masked = ~lo_avd.allowed & avd->allowed;
@@ -613,13 +617,39 @@ static void type_attribute_bounds_av(struct context *scontext,
 }
 
 /*
- * Compute access vectors based on a context structure pair for
- * the permissions in a particular class.
+ * flag which drivers have permissions
+ * only looking for ioctl based extended permssions
+ */
+void services_compute_xperms_drivers(
+                struct extended_perms *xperms,
+                struct avtab_node *node)
+{
+        unsigned int i;
+
+        if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) {
+                /* if one or more driver has all permissions allowed */
+                for (i = 0; i < ARRAY_SIZE(xperms->drivers.p); i++)
+                        xperms->drivers.p[i] |= node->datum.u.xperms->perms.p[i];
+        } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) {
+                /* if allowing permissions within a driver */
+                security_xperm_set(xperms->drivers.p,
+                                        node->datum.u.xperms->driver);
+        }
+
+        /* If no ioctl commands are allowed, ignore auditallow and auditdeny */
+        if (node->key.specified & AVTAB_XPERMS_ALLOWED)
+                xperms->len = 1;
+}
+
+/*
+ * Compute access vectors and extended permissions based on a context
+ * structure pair for the permissions in a particular class.
  */
 static void context_struct_compute_av(struct context *scontext,
-                                      struct context *tcontext,
-                                      u16 tclass,
-                                      struct av_decision *avd)
+                                        struct context *tcontext,
+                                        u16 tclass,
+                                        struct av_decision *avd,
+                                        struct extended_perms *xperms)
 {
         struct constraint_node *constraint;
         struct role_allow *ra;
@@ -633,6 +663,10 @@ static void context_struct_compute_av(struct context *scontext,
         avd->allowed = 0;
         avd->auditallow = 0;
         avd->auditdeny = 0xffffffff;
+        if (xperms) {
+                memset(&xperms->drivers, 0, sizeof(xperms->drivers));
+                xperms->len = 0;
+        }
 
         if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {
                 if (printk_ratelimit())
@@ -647,7 +681,7 @@ static void context_struct_compute_av(struct context *scontext,
          * this permission check, then use it.
          */
         avkey.target_class = tclass;
-        avkey.specified = AVTAB_AV;
+        avkey.specified = AVTAB_AV | AVTAB_XPERMS;
         sattr = flex_array_get(policydb.type_attr_map_array, scontext->type - 1);
         BUG_ON(!sattr);
         tattr = flex_array_get(policydb.type_attr_map_array, tcontext->type - 1);
@@ -660,15 +694,18 @@ static void context_struct_compute_av(struct context *scontext,
                              node;
                              node = avtab_search_node_next(node, avkey.specified)) {
                                 if (node->key.specified == AVTAB_ALLOWED)
-                                        avd->allowed |= node->datum.data;
+                                        avd->allowed |= node->datum.u.data;
                                 else if (node->key.specified == AVTAB_AUDITALLOW)
-                                        avd->auditallow |= node->datum.data;
+                                        avd->auditallow |= node->datum.u.data;
                                 else if (node->key.specified == AVTAB_AUDITDENY)
-                                        avd->auditdeny &= node->datum.data;
+                                        avd->auditdeny &= node->datum.u.data;
+                                else if (xperms && (node->key.specified & AVTAB_XPERMS))
+                                        services_compute_xperms_drivers(xperms, node);
                         }
 
                         /* Check conditional av table for additional permissions */
-                        cond_compute_av(&policydb.te_cond_avtab, &avkey, avd);
+                        cond_compute_av(&policydb.te_cond_avtab, &avkey,
+                                        avd, xperms);
 
                 }
         }
@@ -899,6 +936,139 @@ static void avd_init(struct av_decision *avd)
         avd->flags = 0;
 }
 
+void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
+                                        struct avtab_node *node)
+{
+        unsigned int i;
+
+        if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) {
+                if (xpermd->driver != node->datum.u.xperms->driver)
+                        return;
+        } else if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) {
+                if (!security_xperm_test(node->datum.u.xperms->perms.p,
+                                        xpermd->driver))
+                        return;
+        } else {
+                BUG();
+        }
+
+        if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
+                xpermd->used |= XPERMS_ALLOWED;
+                if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) {
+                        memset(xpermd->allowed->p, 0xff,
+                                        sizeof(xpermd->allowed->p));
+                }
+                if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) {
+                        for (i = 0; i < ARRAY_SIZE(xpermd->allowed->p); i++)
+                                xpermd->allowed->p[i] |=
+                                        node->datum.u.xperms->perms.p[i];
+                }
+        } else if (node->key.specified == AVTAB_XPERMS_AUDITALLOW) {
+                xpermd->used |= XPERMS_AUDITALLOW;
+                if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) {
+                        memset(xpermd->auditallow->p, 0xff,
+                                        sizeof(xpermd->auditallow->p));
+                }
+                if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) {
+                        for (i = 0; i < ARRAY_SIZE(xpermd->auditallow->p); i++)
+                                xpermd->auditallow->p[i] |=
+                                        node->datum.u.xperms->perms.p[i];
+                }
+        } else if (node->key.specified == AVTAB_XPERMS_DONTAUDIT) {
+                xpermd->used |= XPERMS_DONTAUDIT;
+                if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLDRIVER) {
+                        memset(xpermd->dontaudit->p, 0xff,
+                                        sizeof(xpermd->dontaudit->p));
+                }
+                if (node->datum.u.xperms->specified == AVTAB_XPERMS_IOCTLFUNCTION) {
+                        for (i = 0; i < ARRAY_SIZE(xpermd->dontaudit->p); i++)
+                                xpermd->dontaudit->p[i] |=
+                                        node->datum.u.xperms->perms.p[i];
+                }
+        } else {
+                BUG();
+        }
+}
+
+void security_compute_xperms_decision(u32 ssid,
+                                u32 tsid,
+                                u16 orig_tclass,
+                                u8 driver,
+                                struct extended_perms_decision *xpermd)
+{
+        u16 tclass;
+        struct context *scontext, *tcontext;
+        struct avtab_key avkey;
+        struct avtab_node *node;
+        struct ebitmap *sattr, *tattr;
+        struct ebitmap_node *snode, *tnode;
+        unsigned int i, j;
+
+        xpermd->driver = driver;
+        xpermd->used = 0;
+        memset(xpermd->allowed->p, 0, sizeof(xpermd->allowed->p));
+        memset(xpermd->auditallow->p, 0, sizeof(xpermd->auditallow->p));
+        memset(xpermd->dontaudit->p, 0, sizeof(xpermd->dontaudit->p));
+
+        read_lock(&policy_rwlock);
+        if (!ss_initialized)
+                goto allow;
+
+        scontext = sidtab_search(&sidtab, ssid);
+        if (!scontext) {
+                printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
+                       __func__, ssid);
+                goto out;
+        }
+
+        tcontext = sidtab_search(&sidtab, tsid);
+        if (!tcontext) {
+                printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
+                       __func__, tsid);
+                goto out;
+        }
+
+        tclass = unmap_class(orig_tclass);
+        if (unlikely(orig_tclass && !tclass)) {
+                if (policydb.allow_unknown)
+                        goto allow;
+                goto out;
+        }
+
+
+        if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {
+                pr_warn_ratelimited("SELinux:  Invalid class %hu\n", tclass);
+                goto out;
+        }
+
+        avkey.target_class = tclass;
+        avkey.specified = AVTAB_XPERMS;
+        sattr = flex_array_get(policydb.type_attr_map_array,
+                                scontext->type - 1);
+        BUG_ON(!sattr);
+        tattr = flex_array_get(policydb.type_attr_map_array,
+                                tcontext->type - 1);
+        BUG_ON(!tattr);
+        ebitmap_for_each_positive_bit(sattr, snode, i) {
+                ebitmap_for_each_positive_bit(tattr, tnode, j) {
+                        avkey.source_type = i + 1;
+                        avkey.target_type = j + 1;
+                        for (node = avtab_search_node(&policydb.te_avtab, &avkey);
+                             node;
+                             node = avtab_search_node_next(node, avkey.specified))
+                                services_compute_xperms_decision(xpermd, node);
+
+                        cond_compute_xperms(&policydb.te_cond_avtab,
+                                                &avkey, xpermd);
+                }
+        }
+out:
+        read_unlock(&policy_rwlock);
+        return;
+allow:
+        memset(xpermd->allowed->p, 0xff, sizeof(xpermd->allowed->p));
+        goto out;
+}
 
 /**
  * security_compute_av - Compute access vector decisions.
@@ -906,6 +1076,7 @@ static void avd_init(struct av_decision *avd)
  * @tsid: target security identifier
  * @tclass: target security class
  * @avd: access vector decisions
+ * @xperms: extended permissions
  *
  * Compute a set of access vector decisions based on the
  * SID pair (@ssid, @tsid) for the permissions in @tclass.
@@ -913,13 +1084,15 @@ static void avd_init(struct av_decision *avd)
 void security_compute_av(u32 ssid,
                          u32 tsid,
                          u16 orig_tclass,
-                         struct av_decision *avd)
+                         struct av_decision *avd,
+                         struct extended_perms *xperms)
 {
         u16 tclass;
         struct context *scontext = NULL, *tcontext = NULL;
 
         read_lock(&policy_rwlock);
         avd_init(avd);
+        xperms->len = 0;
         if (!ss_initialized)
                 goto allow;
 
@@ -947,7 +1120,7 @@ void security_compute_av(u32 ssid,
                         goto allow;
                 goto out;
         }
-        context_struct_compute_av(scontext, tcontext, tclass, avd);
+        context_struct_compute_av(scontext, tcontext, tclass, avd, xperms);
         map_decision(orig_tclass, avd, policydb.allow_unknown);
 out:
         read_unlock(&policy_rwlock);
@@ -993,7 +1166,7 @@ void security_compute_av_user(u32 ssid,
                 goto out;
         }
 
-        context_struct_compute_av(scontext, tcontext, tclass, avd);
+        context_struct_compute_av(scontext, tcontext, tclass, avd, NULL);
  out:
         read_unlock(&policy_rwlock);
         return;
@@ -1515,7 +1688,7 @@ static int security_compute_sid(u32 ssid,
 
         if (avdatum) {
                 /* Use the type from the type transition/member/change rule. */
-                newcontext.type = avdatum->data;
+                newcontext.type = avdatum->u.data;
         }
 
         /* if we have a objname this is a file trans check so check those rules */
diff --git a/security/selinux/ss/services.h b/security/selinux/ss/services.h
index e8d907e903cd..6abcd8729ec3 100644
--- a/security/selinux/ss/services.h
+++ b/security/selinux/ss/services.h
@@ -11,5 +11,11 @@
 
 extern struct policydb policydb;
 
+void services_compute_xperms_drivers(struct extended_perms *xperms,
+                                struct avtab_node *node);
+
+void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
+                                        struct avtab_node *node);
+
 #endif  /* _SS_SERVICES_H_ */