aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@woody.linux-foundation.org>2007-07-19 17:42:40 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-07-19 17:42:40 -0400
commit721e2629fa2167c0e5a9f10d704b1fee1621a8cb (patch)
treea1580ed191e710f891ef1bf25c8c1fc7d6f054a9
parentfdb64f93b38a3470fa4db8cd5720b8c731922d1a (diff)
parentf36158c410651fe66f438c17b2ab3ae813f8c060 (diff)
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6: SELinux: use SECINITSID_NETMSG instead of SECINITSID_UNLABELED for NetLabel SELinux: enable dynamic activation/deactivation of NetLabel/SELinux enforcement
-rw-r--r--include/net/netlabel.h62
-rw-r--r--net/netlabel/netlabel_cipso_v4.c5
-rw-r--r--net/netlabel/netlabel_kapi.c21
-rw-r--r--net/netlabel/netlabel_mgmt.c65
-rw-r--r--net/netlabel/netlabel_mgmt.h5
-rw-r--r--security/selinux/hooks.c21
-rw-r--r--security/selinux/netlabel.c49
7 files changed, 162 insertions, 66 deletions
diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index 9b7d6f2ac9a3..ffbc7f28335a 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -144,10 +144,9 @@ struct netlbl_lsm_secattr {
144}; 144};
145 145
146/* 146/*
147 * LSM security attribute operations 147 * LSM security attribute operations (inline)
148 */ 148 */
149 149
150
151/** 150/**
152 * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache 151 * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache
153 * @flags: the memory allocation flags 152 * @flags: the memory allocation flags
@@ -283,6 +282,9 @@ static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
283} 282}
284 283
285#ifdef CONFIG_NETLABEL 284#ifdef CONFIG_NETLABEL
285/*
286 * LSM security attribute operations
287 */
286int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap, 288int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
287 u32 offset); 289 u32 offset);
288int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap, 290int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
@@ -294,6 +296,25 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
294 u32 start, 296 u32 start,
295 u32 end, 297 u32 end,
296 gfp_t flags); 298 gfp_t flags);
299
300/*
301 * LSM protocol operations
302 */
303int netlbl_enabled(void);
304int netlbl_sock_setattr(struct sock *sk,
305 const struct netlbl_lsm_secattr *secattr);
306int netlbl_sock_getattr(struct sock *sk,
307 struct netlbl_lsm_secattr *secattr);
308int netlbl_skbuff_getattr(const struct sk_buff *skb,
309 struct netlbl_lsm_secattr *secattr);
310void netlbl_skbuff_err(struct sk_buff *skb, int error);
311
312/*
313 * LSM label mapping cache operations
314 */
315void netlbl_cache_invalidate(void);
316int netlbl_cache_add(const struct sk_buff *skb,
317 const struct netlbl_lsm_secattr *secattr);
297#else 318#else
298static inline int netlbl_secattr_catmap_walk( 319static inline int netlbl_secattr_catmap_walk(
299 struct netlbl_lsm_secattr_catmap *catmap, 320 struct netlbl_lsm_secattr_catmap *catmap,
@@ -301,14 +322,12 @@ static inline int netlbl_secattr_catmap_walk(
301{ 322{
302 return -ENOENT; 323 return -ENOENT;
303} 324}
304
305static inline int netlbl_secattr_catmap_walk_rng( 325static inline int netlbl_secattr_catmap_walk_rng(
306 struct netlbl_lsm_secattr_catmap *catmap, 326 struct netlbl_lsm_secattr_catmap *catmap,
307 u32 offset) 327 u32 offset)
308{ 328{
309 return -ENOENT; 329 return -ENOENT;
310} 330}
311
312static inline int netlbl_secattr_catmap_setbit( 331static inline int netlbl_secattr_catmap_setbit(
313 struct netlbl_lsm_secattr_catmap *catmap, 332 struct netlbl_lsm_secattr_catmap *catmap,
314 u32 bit, 333 u32 bit,
@@ -316,7 +335,6 @@ static inline int netlbl_secattr_catmap_setbit(
316{ 335{
317 return 0; 336 return 0;
318} 337}
319
320static inline int netlbl_secattr_catmap_setrng( 338static inline int netlbl_secattr_catmap_setrng(
321 struct netlbl_lsm_secattr_catmap *catmap, 339 struct netlbl_lsm_secattr_catmap *catmap,
322 u32 start, 340 u32 start,
@@ -325,59 +343,33 @@ static inline int netlbl_secattr_catmap_setrng(
325{ 343{
326 return 0; 344 return 0;
327} 345}
328#endif 346static inline int netlbl_enabled(void)
329 347{
330/* 348 return 0;
331 * LSM protocol operations 349}
332 */
333
334#ifdef CONFIG_NETLABEL
335int netlbl_sock_setattr(struct sock *sk,
336 const struct netlbl_lsm_secattr *secattr);
337int netlbl_sock_getattr(struct sock *sk,
338 struct netlbl_lsm_secattr *secattr);
339int netlbl_skbuff_getattr(const struct sk_buff *skb,
340 struct netlbl_lsm_secattr *secattr);
341void netlbl_skbuff_err(struct sk_buff *skb, int error);
342#else
343static inline int netlbl_sock_setattr(struct sock *sk, 350static inline int netlbl_sock_setattr(struct sock *sk,
344 const struct netlbl_lsm_secattr *secattr) 351 const struct netlbl_lsm_secattr *secattr)
345{ 352{
346 return -ENOSYS; 353 return -ENOSYS;
347} 354}
348
349static inline int netlbl_sock_getattr(struct sock *sk, 355static inline int netlbl_sock_getattr(struct sock *sk,
350 struct netlbl_lsm_secattr *secattr) 356 struct netlbl_lsm_secattr *secattr)
351{ 357{
352 return -ENOSYS; 358 return -ENOSYS;
353} 359}
354
355static inline int netlbl_skbuff_getattr(const struct sk_buff *skb, 360static inline int netlbl_skbuff_getattr(const struct sk_buff *skb,
356 struct netlbl_lsm_secattr *secattr) 361 struct netlbl_lsm_secattr *secattr)
357{ 362{
358 return -ENOSYS; 363 return -ENOSYS;
359} 364}
360
361static inline void netlbl_skbuff_err(struct sk_buff *skb, int error) 365static inline void netlbl_skbuff_err(struct sk_buff *skb, int error)
362{ 366{
363 return; 367 return;
364} 368}
365#endif /* CONFIG_NETLABEL */
366
367/*
368 * LSM label mapping cache operations
369 */
370
371#ifdef CONFIG_NETLABEL
372void netlbl_cache_invalidate(void);
373int netlbl_cache_add(const struct sk_buff *skb,
374 const struct netlbl_lsm_secattr *secattr);
375#else
376static inline void netlbl_cache_invalidate(void) 369static inline void netlbl_cache_invalidate(void)
377{ 370{
378 return; 371 return;
379} 372}
380
381static inline int netlbl_cache_add(const struct sk_buff *skb, 373static inline int netlbl_cache_add(const struct sk_buff *skb,
382 const struct netlbl_lsm_secattr *secattr) 374 const struct netlbl_lsm_secattr *secattr)
383{ 375{
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 24b660f16ce3..c060e3f991f1 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -41,6 +41,7 @@
41 41
42#include "netlabel_user.h" 42#include "netlabel_user.h"
43#include "netlabel_cipso_v4.h" 43#include "netlabel_cipso_v4.h"
44#include "netlabel_mgmt.h"
44 45
45/* Argument struct for cipso_v4_doi_walk() */ 46/* Argument struct for cipso_v4_doi_walk() */
46struct netlbl_cipsov4_doiwalk_arg { 47struct netlbl_cipsov4_doiwalk_arg {
@@ -419,6 +420,8 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
419 ret_val = netlbl_cipsov4_add_pass(info); 420 ret_val = netlbl_cipsov4_add_pass(info);
420 break; 421 break;
421 } 422 }
423 if (ret_val == 0)
424 netlbl_mgmt_protocount_inc();
422 425
423 audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD, 426 audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
424 &audit_info); 427 &audit_info);
@@ -694,6 +697,8 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
694 ret_val = cipso_v4_doi_remove(doi, 697 ret_val = cipso_v4_doi_remove(doi,
695 &audit_info, 698 &audit_info,
696 netlbl_cipsov4_doi_free); 699 netlbl_cipsov4_doi_free);
700 if (ret_val == 0)
701 netlbl_mgmt_protocount_dec();
697 702
698 audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL, 703 audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
699 &audit_info); 704 &audit_info);
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b165712aaa70..4f50949722a9 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -38,6 +38,7 @@
38#include "netlabel_domainhash.h" 38#include "netlabel_domainhash.h"
39#include "netlabel_unlabeled.h" 39#include "netlabel_unlabeled.h"
40#include "netlabel_user.h" 40#include "netlabel_user.h"
41#include "netlabel_mgmt.h"
41 42
42/* 43/*
43 * Security Attribute Functions 44 * Security Attribute Functions
@@ -245,6 +246,26 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
245 */ 246 */
246 247
247/** 248/**
249 * netlbl_enabled - Determine if the NetLabel subsystem is enabled
250 *
251 * Description:
252 * The LSM can use this function to determine if it should use NetLabel
253 * security attributes in it's enforcement mechanism. Currently, NetLabel is
254 * considered to be enabled when it's configuration contains a valid setup for
255 * at least one labeled protocol (i.e. NetLabel can understand incoming
256 * labeled packets of at least one type); otherwise NetLabel is considered to
257 * be disabled.
258 *
259 */
260int netlbl_enabled(void)
261{
262 /* At some point we probably want to expose this mechanism to the user
263 * as well so that admins can toggle NetLabel regardless of the
264 * configuration */
265 return (netlbl_mgmt_protocount_value() > 0 ? 1 : 0);
266}
267
268/**
248 * netlbl_socket_setattr - Label a socket using the correct protocol 269 * netlbl_socket_setattr - Label a socket using the correct protocol
249 * @sk: the socket to label 270 * @sk: the socket to label
250 * @secattr: the security attributes 271 * @secattr: the security attributes
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index e00fc219c72b..5315dacc5222 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -42,6 +42,10 @@
42#include "netlabel_user.h" 42#include "netlabel_user.h"
43#include "netlabel_mgmt.h" 43#include "netlabel_mgmt.h"
44 44
45/* NetLabel configured protocol count */
46static DEFINE_SPINLOCK(netlabel_mgmt_protocount_lock);
47static u32 netlabel_mgmt_protocount = 0;
48
45/* Argument struct for netlbl_domhsh_walk() */ 49/* Argument struct for netlbl_domhsh_walk() */
46struct netlbl_domhsh_walk_arg { 50struct netlbl_domhsh_walk_arg {
47 struct netlink_callback *nl_cb; 51 struct netlink_callback *nl_cb;
@@ -67,6 +71,67 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
67}; 71};
68 72
69/* 73/*
74 * NetLabel Misc Managment Functions
75 */
76
77/**
78 * netlbl_mgmt_protocount_inc - Increment the configured labeled protocol count
79 *
80 * Description:
81 * Increment the number of labeled protocol configurations in the current
82 * NetLabel configuration. Keep track of this for use in determining if
83 * NetLabel label enforcement should be active/enabled or not in the LSM.
84 *
85 */
86void netlbl_mgmt_protocount_inc(void)
87{
88 rcu_read_lock();
89 spin_lock(&netlabel_mgmt_protocount_lock);
90 netlabel_mgmt_protocount++;
91 spin_unlock(&netlabel_mgmt_protocount_lock);
92 rcu_read_unlock();
93}
94
95/**
96 * netlbl_mgmt_protocount_dec - Decrement the configured labeled protocol count
97 *
98 * Description:
99 * Decrement the number of labeled protocol configurations in the current
100 * NetLabel configuration. Keep track of this for use in determining if
101 * NetLabel label enforcement should be active/enabled or not in the LSM.
102 *
103 */
104void netlbl_mgmt_protocount_dec(void)
105{
106 rcu_read_lock();
107 spin_lock(&netlabel_mgmt_protocount_lock);
108 if (netlabel_mgmt_protocount > 0)
109 netlabel_mgmt_protocount--;
110 spin_unlock(&netlabel_mgmt_protocount_lock);
111 rcu_read_unlock();
112}
113
114/**
115 * netlbl_mgmt_protocount_value - Return the number of configured protocols
116 *
117 * Description:
118 * Return the number of labeled protocols in the current NetLabel
119 * configuration. This value is useful in determining if NetLabel label
120 * enforcement should be active/enabled or not in the LSM.
121 *
122 */
123u32 netlbl_mgmt_protocount_value(void)
124{
125 u32 val;
126
127 rcu_read_lock();
128 val = netlabel_mgmt_protocount;
129 rcu_read_unlock();
130
131 return val;
132}
133
134/*
70 * NetLabel Command Handlers 135 * NetLabel Command Handlers
71 */ 136 */
72 137
diff --git a/net/netlabel/netlabel_mgmt.h b/net/netlabel/netlabel_mgmt.h
index 3642d3bfc8eb..ccb2b3923591 100644
--- a/net/netlabel/netlabel_mgmt.h
+++ b/net/netlabel/netlabel_mgmt.h
@@ -168,4 +168,9 @@ enum {
168/* NetLabel protocol functions */ 168/* NetLabel protocol functions */
169int netlbl_mgmt_genl_init(void); 169int netlbl_mgmt_genl_init(void);
170 170
171/* NetLabel misc management functions */
172void netlbl_mgmt_protocount_inc(void);
173void netlbl_mgmt_protocount_dec(void);
174u32 netlbl_mgmt_protocount_value(void);
175
171#endif 176#endif
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 520b9998123e..26356e67108e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3129,17 +3129,19 @@ static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3129/** 3129/**
3130 * selinux_skb_extlbl_sid - Determine the external label of a packet 3130 * selinux_skb_extlbl_sid - Determine the external label of a packet
3131 * @skb: the packet 3131 * @skb: the packet
3132 * @base_sid: the SELinux SID to use as a context for MLS only external labels
3133 * @sid: the packet's SID 3132 * @sid: the packet's SID
3134 * 3133 *
3135 * Description: 3134 * Description:
3136 * Check the various different forms of external packet labeling and determine 3135 * Check the various different forms of external packet labeling and determine
3137 * the external SID for the packet. 3136 * the external SID for the packet. If only one form of external labeling is
3137 * present then it is used, if both labeled IPsec and NetLabel labels are
3138 * present then the SELinux type information is taken from the labeled IPsec
3139 * SA and the MLS sensitivity label information is taken from the NetLabel
3140 * security attributes. This bit of "magic" is done in the call to
3141 * selinux_netlbl_skbuff_getsid().
3138 * 3142 *
3139 */ 3143 */
3140static void selinux_skb_extlbl_sid(struct sk_buff *skb, 3144static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
3141 u32 base_sid,
3142 u32 *sid)
3143{ 3145{
3144 u32 xfrm_sid; 3146 u32 xfrm_sid;
3145 u32 nlbl_sid; 3147 u32 nlbl_sid;
@@ -3147,10 +3149,9 @@ static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3147 selinux_skb_xfrm_sid(skb, &xfrm_sid); 3149 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3148 if (selinux_netlbl_skbuff_getsid(skb, 3150 if (selinux_netlbl_skbuff_getsid(skb,
3149 (xfrm_sid == SECSID_NULL ? 3151 (xfrm_sid == SECSID_NULL ?
3150 base_sid : xfrm_sid), 3152 SECINITSID_NETMSG : xfrm_sid),
3151 &nlbl_sid) != 0) 3153 &nlbl_sid) != 0)
3152 nlbl_sid = SECSID_NULL; 3154 nlbl_sid = SECSID_NULL;
3153
3154 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid); 3155 *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3155} 3156}
3156 3157
@@ -3695,7 +3696,7 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *
3695 if (sock && sock->sk->sk_family == PF_UNIX) 3696 if (sock && sock->sk->sk_family == PF_UNIX)
3696 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid); 3697 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3697 else if (skb) 3698 else if (skb)
3698 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid); 3699 selinux_skb_extlbl_sid(skb, &peer_secid);
3699 3700
3700 if (peer_secid == SECSID_NULL) 3701 if (peer_secid == SECSID_NULL)
3701 err = -EINVAL; 3702 err = -EINVAL;
@@ -3756,7 +3757,7 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3756 u32 newsid; 3757 u32 newsid;
3757 u32 peersid; 3758 u32 peersid;
3758 3759
3759 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid); 3760 selinux_skb_extlbl_sid(skb, &peersid);
3760 if (peersid == SECSID_NULL) { 3761 if (peersid == SECSID_NULL) {
3761 req->secid = sksec->sid; 3762 req->secid = sksec->sid;
3762 req->peer_secid = SECSID_NULL; 3763 req->peer_secid = SECSID_NULL;
@@ -3794,7 +3795,7 @@ static void selinux_inet_conn_established(struct sock *sk,
3794{ 3795{
3795 struct sk_security_struct *sksec = sk->sk_security; 3796 struct sk_security_struct *sksec = sk->sk_security;
3796 3797
3797 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid); 3798 selinux_skb_extlbl_sid(skb, &sksec->peer_sid);
3798} 3799}
3799 3800
3800static void selinux_req_classify_flow(const struct request_sock *req, 3801static void selinux_req_classify_flow(const struct request_sock *req,
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index e64eca246f1a..051b14c88e2d 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -155,12 +155,15 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
155 int rc; 155 int rc;
156 struct netlbl_lsm_secattr secattr; 156 struct netlbl_lsm_secattr secattr;
157 157
158 if (!netlbl_enabled()) {
159 *sid = SECSID_NULL;
160 return 0;
161 }
162
158 netlbl_secattr_init(&secattr); 163 netlbl_secattr_init(&secattr);
159 rc = netlbl_skbuff_getattr(skb, &secattr); 164 rc = netlbl_skbuff_getattr(skb, &secattr);
160 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) 165 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
161 rc = security_netlbl_secattr_to_sid(&secattr, 166 rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);
162 base_sid,
163 sid);
164 else 167 else
165 *sid = SECSID_NULL; 168 *sid = SECSID_NULL;
166 netlbl_secattr_destroy(&secattr); 169 netlbl_secattr_destroy(&secattr);
@@ -198,7 +201,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
198 if (netlbl_sock_getattr(sk, &secattr) == 0 && 201 if (netlbl_sock_getattr(sk, &secattr) == 0 &&
199 secattr.flags != NETLBL_SECATTR_NONE && 202 secattr.flags != NETLBL_SECATTR_NONE &&
200 security_netlbl_secattr_to_sid(&secattr, 203 security_netlbl_secattr_to_sid(&secattr,
201 SECINITSID_UNLABELED, 204 SECINITSID_NETMSG,
202 &nlbl_peer_sid) == 0) 205 &nlbl_peer_sid) == 0)
203 sksec->peer_sid = nlbl_peer_sid; 206 sksec->peer_sid = nlbl_peer_sid;
204 netlbl_secattr_destroy(&secattr); 207 netlbl_secattr_destroy(&secattr);
@@ -295,38 +298,42 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
295 struct avc_audit_data *ad) 298 struct avc_audit_data *ad)
296{ 299{
297 int rc; 300 int rc;
298 u32 netlbl_sid; 301 u32 nlbl_sid;
299 u32 recv_perm; 302 u32 perm;
303 struct netlbl_lsm_secattr secattr;
304
305 if (!netlbl_enabled())
306 return 0;
300 307
301 rc = selinux_netlbl_skbuff_getsid(skb, 308 netlbl_secattr_init(&secattr);
302 SECINITSID_UNLABELED, 309 rc = netlbl_skbuff_getattr(skb, &secattr);
303 &netlbl_sid); 310 if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
311 rc = security_netlbl_secattr_to_sid(&secattr,
312 SECINITSID_NETMSG,
313 &nlbl_sid);
314 else
315 nlbl_sid = SECINITSID_UNLABELED;
316 netlbl_secattr_destroy(&secattr);
304 if (rc != 0) 317 if (rc != 0)
305 return rc; 318 return rc;
306 319
307 if (netlbl_sid == SECSID_NULL)
308 return 0;
309
310 switch (sksec->sclass) { 320 switch (sksec->sclass) {
311 case SECCLASS_UDP_SOCKET: 321 case SECCLASS_UDP_SOCKET:
312 recv_perm = UDP_SOCKET__RECVFROM; 322 perm = UDP_SOCKET__RECVFROM;
313 break; 323 break;
314 case SECCLASS_TCP_SOCKET: 324 case SECCLASS_TCP_SOCKET:
315 recv_perm = TCP_SOCKET__RECVFROM; 325 perm = TCP_SOCKET__RECVFROM;
316 break; 326 break;
317 default: 327 default:
318 recv_perm = RAWIP_SOCKET__RECVFROM; 328 perm = RAWIP_SOCKET__RECVFROM;
319 } 329 }
320 330
321 rc = avc_has_perm(sksec->sid, 331 rc = avc_has_perm(sksec->sid, nlbl_sid, sksec->sclass, perm, ad);
322 netlbl_sid,
323 sksec->sclass,
324 recv_perm,
325 ad);
326 if (rc == 0) 332 if (rc == 0)
327 return 0; 333 return 0;
328 334
329 netlbl_skbuff_err(skb, rc); 335 if (nlbl_sid != SECINITSID_UNLABELED)
336 netlbl_skbuff_err(skb, rc);
330 return rc; 337 return rc;
331} 338}
332 339