1 files changed, 27 insertions, 5 deletions

diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 62c6773be0b7..18643bf9894d 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -15,6 +15,7 @@
 
 #include "security.h"
 #include "conditional.h"
+#include "services.h"
 
 /*
  * cond_evaluate_expr evaluates a conditional expr
@@ -612,21 +613,39 @@ int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
 
         return 0;
 }
+
+void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
+                struct extended_perms_decision *xpermd)
+{
+        struct avtab_node *node;
+
+        if (!ctab || !key || !xpermd)
+                return;
+
+        for (node = avtab_search_node(ctab, key); node;
+                        node = avtab_search_node_next(node, key->specified)) {
+                if (node->key.specified & AVTAB_ENABLED)
+                        services_compute_xperms_decision(xpermd, node);
+        }
+        return;
+
+}
 /* Determine whether additional permissions are granted by the conditional
  * av table, and if so, add them to the result
  */
-void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
+void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
+                struct av_decision *avd, struct extended_perms *xperms)
 {
         struct avtab_node *node;
 
-        if (!ctab || !key || !avd)
+        if (!ctab || !key || !avd || !xperms)
                 return;
 
         for (node = avtab_search_node(ctab, key); node;
                                 node = avtab_search_node_next(node, key->specified)) {
                 if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
-                        avd->allowed |= node->datum.data;
+                        avd->allowed |= node->datum.u.data;
                 if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
                         /* Since a '0' in an auditdeny mask represents a
@@ -634,10 +653,13 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decisi
                          * the '&' operand to ensure that all '0's in the mask
                          * are retained (much unlike the allow and auditallow cases).
                          */
-                        avd->auditdeny &= node->datum.data;
+                        avd->auditdeny &= node->datum.u.data;
                 if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
                     (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
-                        avd->auditallow |= node->datum.data;
+                        avd->auditallow |= node->datum.u.data;
+                if ((node->key.specified & AVTAB_ENABLED) &&
+                                (node->key.specified & AVTAB_XPERMS))
+                        services_compute_xperms_drivers(xperms, node);
         }
         return;
 }