Merge branch 'wip-2.6.34' into old-private-masterarchived-private-master

1 files changed, 360 insertions, 305 deletions

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index ff17820d35ec..cf27b3ee1a95 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -26,6 +26,10 @@
  *
  *  Added support for bounds domain and audit messaged on masked permissions
  *
+ * Updated: Guido Trentalancia <guido@trentalancia.com>
+ *
+ *  Added support for runtime switching of the policy type
+ *
  * Copyright (C) 2008, 2009 NEC Corporation
  * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  * Copyright (C) 2004-2006 Trusted Computer Solutions, Inc.
@@ -65,16 +69,10 @@
 #include "audit.h"
 
 extern void selnl_notify_policyload(u32 seqno);
-unsigned int policydb_loaded_version;
 
 int selinux_policycap_netpeer;
 int selinux_policycap_openperm;
 
-/*
- * This is declared in avc.c
- */
-extern const struct selinux_class_perm selinux_class_perm;
-
 static DEFINE_RWLOCK(policy_rwlock);
 
 static struct sidtab sidtab;
@@ -93,11 +91,156 @@ static u32 latest_granting;
 static int context_struct_to_string(struct context *context, char **scontext,
                                     u32 *scontext_len);
 
-static int context_struct_compute_av(struct context *scontext,
-                                     struct context *tcontext,
-                                     u16 tclass,
-                                     u32 requested,
-                                     struct av_decision *avd);
+static void context_struct_compute_av(struct context *scontext,
+                                      struct context *tcontext,
+                                      u16 tclass,
+                                      struct av_decision *avd);
+
+struct selinux_mapping {
+        u16 value; /* policy value */
+        unsigned num_perms;
+        u32 perms[sizeof(u32) * 8];
+};
+
+static struct selinux_mapping *current_mapping;
+static u16 current_mapping_size;
+
+static int selinux_set_mapping(struct policydb *pol,
+                               struct security_class_mapping *map,
+                               struct selinux_mapping **out_map_p,
+                               u16 *out_map_size)
+{
+        struct selinux_mapping *out_map = NULL;
+        size_t size = sizeof(struct selinux_mapping);
+        u16 i, j;
+        unsigned k;
+        bool print_unknown_handle = false;
+
+        /* Find number of classes in the input mapping */
+        if (!map)
+                return -EINVAL;
+        i = 0;
+        while (map[i].name)
+                i++;
+
+        /* Allocate space for the class records, plus one for class zero */
+        out_map = kcalloc(++i, size, GFP_ATOMIC);
+        if (!out_map)
+                return -ENOMEM;
+
+        /* Store the raw class and permission values */
+        j = 0;
+        while (map[j].name) {
+                struct security_class_mapping *p_in = map + (j++);
+                struct selinux_mapping *p_out = out_map + j;
+
+                /* An empty class string skips ahead */
+                if (!strcmp(p_in->name, "")) {
+                        p_out->num_perms = 0;
+                        continue;
+                }
+
+                p_out->value = string_to_security_class(pol, p_in->name);
+                if (!p_out->value) {
+                        printk(KERN_INFO
+                               "SELinux:  Class %s not defined in policy.\n",
+                               p_in->name);
+                        if (pol->reject_unknown)
+                                goto err;
+                        p_out->num_perms = 0;
+                        print_unknown_handle = true;
+                        continue;
+                }
+
+                k = 0;
+                while (p_in->perms && p_in->perms[k]) {
+                        /* An empty permission string skips ahead */
+                        if (!*p_in->perms[k]) {
+                                k++;
+                                continue;
+                        }
+                        p_out->perms[k] = string_to_av_perm(pol, p_out->value,
+                                                            p_in->perms[k]);
+                        if (!p_out->perms[k]) {
+                                printk(KERN_INFO
+                                       "SELinux:  Permission %s in class %s not defined in policy.\n",
+                                       p_in->perms[k], p_in->name);
+                                if (pol->reject_unknown)
+                                        goto err;
+                                print_unknown_handle = true;
+                        }
+
+                        k++;
+                }
+                p_out->num_perms = k;
+        }
+
+        if (print_unknown_handle)
+                printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",
+                       pol->allow_unknown ? "allowed" : "denied");
+
+        *out_map_p = out_map;
+        *out_map_size = i;
+        return 0;
+err:
+        kfree(out_map);
+        return -EINVAL;
+}
+
+/*
+ * Get real, policy values from mapped values
+ */
+
+static u16 unmap_class(u16 tclass)
+{
+        if (tclass < current_mapping_size)
+                return current_mapping[tclass].value;
+
+        return tclass;
+}
+
+static void map_decision(u16 tclass, struct av_decision *avd,
+                         int allow_unknown)
+{
+        if (tclass < current_mapping_size) {
+                unsigned i, n = current_mapping[tclass].num_perms;
+                u32 result;
+
+                for (i = 0, result = 0; i < n; i++) {
+                        if (avd->allowed & current_mapping[tclass].perms[i])
+                                result |= 1<<i;
+                        if (allow_unknown && !current_mapping[tclass].perms[i])
+                                result |= 1<<i;
+                }
+                avd->allowed = result;
+
+                for (i = 0, result = 0; i < n; i++)
+                        if (avd->auditallow & current_mapping[tclass].perms[i])
+                                result |= 1<<i;
+                avd->auditallow = result;
+
+                for (i = 0, result = 0; i < n; i++) {
+                        if (avd->auditdeny & current_mapping[tclass].perms[i])
+                                result |= 1<<i;
+                        if (!allow_unknown && !current_mapping[tclass].perms[i])
+                                result |= 1<<i;
+                }
+                /*
+                 * In case the kernel has a bug and requests a permission
+                 * between num_perms and the maximum permission number, we
+                 * should audit that denial
+                 */
+                for (; i < (sizeof(u32)*8); i++)
+                        result |= 1<<i;
+                avd->auditdeny = result;
+        }
+}
+
+int security_mls_enabled(void)
+{
+        return policydb.mls_enabled;
+}
+
 /*
  * Return the boolean value of a constraint expression
  * when it is applied to the specified source and target
@@ -312,7 +455,8 @@ static void security_dump_masked_av(struct context *scontext,
         char *scontext_name = NULL;
         char *tcontext_name = NULL;
         char *permission_names[32];
-        int index, length;
+        int index;
+        u32 length;
         bool need_comma = false;
 
         if (!permissions)
@@ -379,7 +523,6 @@ out:
 static void type_attribute_bounds_av(struct context *scontext,
                                      struct context *tcontext,
                                      u16 tclass,
-                                     u32 requested,
                                      struct av_decision *avd)
 {
         struct context lo_scontext;
@@ -400,7 +543,6 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(&lo_scontext,
                                           tcontext,
                                           tclass,
-                                          requested,
                                           &lo_avd);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
@@ -416,7 +558,6 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(scontext,
                                           &lo_tcontext,
                                           tclass,
-                                          requested,
                                           &lo_avd);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
@@ -433,7 +574,6 @@ static void type_attribute_bounds_av(struct context *scontext,
                 context_struct_compute_av(&lo_scontext,
                                           &lo_tcontext,
                                           tclass,
-                                          requested,
                                           &lo_avd);
                 if ((lo_avd.allowed & avd->allowed) == avd->allowed)
                         return;         /* no masked permission */
@@ -454,11 +594,10 @@ static void type_attribute_bounds_av(struct context *scontext,
  * Compute access vectors based on a context structure pair for
  * the permissions in a particular class.
  */
-static int context_struct_compute_av(struct context *scontext,
-                                     struct context *tcontext,
-                                     u16 tclass,
-                                     u32 requested,
-                                     struct av_decision *avd)
+static void context_struct_compute_av(struct context *scontext,
+                                      struct context *tcontext,
+                                      u16 tclass,
+                                      struct av_decision *avd)
 {
         struct constraint_node *constraint;
         struct role_allow *ra;
@@ -467,56 +606,17 @@ static int context_struct_compute_av(struct context *scontext,
         struct class_datum *tclass_datum;
         struct ebitmap *sattr, *tattr;
         struct ebitmap_node *snode, *tnode;
-        const struct selinux_class_perm *kdefs = &selinux_class_perm;
         unsigned int i, j;
 
-        /*
-         * Remap extended Netlink classes for old policy versions.
-         * Do this here rather than socket_type_to_security_class()
-         * in case a newer policy version is loaded, allowing sockets
-         * to remain in the correct class.
-         */
-        if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)
-                if (tclass >= SECCLASS_NETLINK_ROUTE_SOCKET &&
-                    tclass <= SECCLASS_NETLINK_DNRT_SOCKET)
-                        tclass = SECCLASS_NETLINK_SOCKET;
-
-        /*
-         * Initialize the access vectors to the default values.
-         */
         avd->allowed = 0;
         avd->auditallow = 0;
         avd->auditdeny = 0xffffffff;
-        avd->seqno = latest_granting;
-        avd->flags = 0;
 
-        /*
-         * Check for all the invalid cases.
-         * - tclass 0
-         * - tclass > policy and > kernel
-         * - tclass > policy but is a userspace class
-         * - tclass > policy but we do not allow unknowns
-         */
-        if (unlikely(!tclass))
-                goto inval_class;
-        if (unlikely(tclass > policydb.p_classes.nprim))
-                if (tclass > kdefs->cts_len ||
-                    !kdefs->class_to_string[tclass] ||
-                    !policydb.allow_unknown)
-                        goto inval_class;
-
-        /*
-         * Kernel class and we allow unknown so pad the allow decision
-         * the pad will be all 1 for unknown classes.
-         */
-        if (tclass <= kdefs->cts_len && policydb.allow_unknown)
-                avd->allowed = policydb.undefined_perms[tclass - 1];
-
-        /*
-         * Not in policy. Since decision is completed (all 1 or all 0) return.
-         */
-        if (unlikely(tclass > policydb.p_classes.nprim))
-                return 0;
+        if (unlikely(!tclass || tclass > policydb.p_classes.nprim)) {
+                if (printk_ratelimit())
+                        printk(KERN_WARNING "SELinux:  Invalid class %hu\n", tclass);
+                return;
+        }
 
         tclass_datum = policydb.class_val_to_struct[tclass - 1];
 
@@ -568,8 +668,8 @@ static int context_struct_compute_av(struct context *scontext,
          * role is changing, then check the (current_role, new_role)
          * pair.
          */
-        if (tclass == SECCLASS_PROCESS &&
-            (avd->allowed & (PROCESS__TRANSITION | PROCESS__DYNTRANSITION)) &&
+        if (tclass == policydb.process_class &&
+            (avd->allowed & policydb.process_trans_perms) &&
             scontext->role != tcontext->role) {
                 for (ra = policydb.role_allow; ra; ra = ra->next) {
                         if (scontext->role == ra->role &&
@@ -577,8 +677,7 @@ static int context_struct_compute_av(struct context *scontext,
                                 break;
                 }
                 if (!ra)
-                        avd->allowed &= ~(PROCESS__TRANSITION |
-                                          PROCESS__DYNTRANSITION);
+                        avd->allowed &= ~policydb.process_trans_perms;
         }
 
         /*
@@ -587,24 +686,7 @@ static int context_struct_compute_av(struct context *scontext,
          * permission and notice it to userspace via audit.
          */
         type_attribute_bounds_av(scontext, tcontext,
-                                 tclass, requested, avd);
-
-        return 0;
-
-inval_class:
-        if (!tclass || tclass > kdefs->cts_len ||
-            !kdefs->class_to_string[tclass]) {
-                if (printk_ratelimit())
-                        printk(KERN_ERR "SELinux: %s:  unrecognized class %d\n",
-                               __func__, tclass);
-                return -EINVAL;
-        }
-
-        /*
-         * Known to the kernel, but not to the policy.
-         * Handle as a denial (allowed is 0).
-         */
-        return 0;
+                                 tclass, avd);
 }
 
 static int security_validtrans_handle_fail(struct context *ocontext,
@@ -636,13 +718,14 @@ out:
 }
 
 int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
-                                 u16 tclass)
+                                 u16 orig_tclass)
 {
         struct context *ocontext;
         struct context *ncontext;
         struct context *tcontext;
         struct class_datum *tclass_datum;
         struct constraint_node *constraint;
+        u16 tclass;
         int rc = 0;
 
         if (!ss_initialized)
@@ -650,16 +733,7 @@ int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,
 
         read_lock(&policy_rwlock);
 
-        /*
-         * Remap extended Netlink classes for old policy versions.
-         * Do this here rather than socket_type_to_security_class()
-         * in case a newer policy version is loaded, allowing sockets
-         * to remain in the correct class.
-         */
-        if (policydb_loaded_version < POLICYDB_VERSION_NLCLASS)
-                if (tclass >= SECCLASS_NETLINK_ROUTE_SOCKET &&
-                    tclass <= SECCLASS_NETLINK_DNRT_SOCKET)
-                        tclass = SECCLASS_NETLINK_SOCKET;
+        tclass = unmap_class(orig_tclass);
 
         if (!tclass || tclass > policydb.p_classes.nprim) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized class %d\n",
@@ -741,7 +815,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
                 goto out;
         }
 
-        /* type/domain unchaned */
+        /* type/domain unchanged */
         if (old_context->type == new_context->type) {
                 rc = 0;
                 goto out;
@@ -769,7 +843,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
         if (rc) {
                 char *old_name = NULL;
                 char *new_name = NULL;
-                int length;
+                u32 length;
 
                 if (!context_struct_to_string(old_context,
                                               &old_name, &length) &&
@@ -791,63 +865,116 @@ out:
         return rc;
 }
 
+static void avd_init(struct av_decision *avd)
+{
+        avd->allowed = 0;
+        avd->auditallow = 0;
+        avd->auditdeny = 0xffffffff;
+        avd->seqno = latest_granting;
+        avd->flags = 0;
+}
+
 
 /**
  * security_compute_av - Compute access vector decisions.
  * @ssid: source security identifier
  * @tsid: target security identifier
  * @tclass: target security class
- * @requested: requested permissions
  * @avd: access vector decisions
  *
  * Compute a set of access vector decisions based on the
  * SID pair (@ssid, @tsid) for the permissions in @tclass.
- * Return -%EINVAL if any of the parameters are invalid or %0
- * if the access vector decisions were computed successfully.
  */
-int security_compute_av(u32 ssid,
-                        u32 tsid,
-                        u16 tclass,
-                        u32 requested,
-                        struct av_decision *avd)
+void security_compute_av(u32 ssid,
+                         u32 tsid,
+                         u16 orig_tclass,
+                         struct av_decision *avd)
 {
+        u16 tclass;
         struct context *scontext = NULL, *tcontext = NULL;
-        int rc = 0;
-
-        if (!ss_initialized) {
-                avd->allowed = 0xffffffff;
-                avd->auditallow = 0;
-                avd->auditdeny = 0xffffffff;
-                avd->seqno = latest_granting;
-                return 0;
-        }
 
         read_lock(&policy_rwlock);
+        avd_init(avd);
+        if (!ss_initialized)
+                goto allow;
 
         scontext = sidtab_search(&sidtab, ssid);
         if (!scontext) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
                        __func__, ssid);
-                rc = -EINVAL;
                 goto out;
         }
+
+        /* permissive domain? */
+        if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))
+                avd->flags |= AVD_FLAGS_PERMISSIVE;
+
         tcontext = sidtab_search(&sidtab, tsid);
         if (!tcontext) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
                        __func__, tsid);
-                rc = -EINVAL;
                 goto out;
         }
 
-        rc = context_struct_compute_av(scontext, tcontext, tclass,
-                                       requested, avd);
+        tclass = unmap_class(orig_tclass);
+        if (unlikely(orig_tclass && !tclass)) {
+                if (policydb.allow_unknown)
+                        goto allow;
+                goto out;
+        }
+        context_struct_compute_av(scontext, tcontext, tclass, avd);
+        map_decision(orig_tclass, avd, policydb.allow_unknown);
+out:
+        read_unlock(&policy_rwlock);
+        return;
+allow:
+        avd->allowed = 0xffffffff;
+        goto out;
+}
+
+void security_compute_av_user(u32 ssid,
+                              u32 tsid,
+                              u16 tclass,
+                              struct av_decision *avd)
+{
+        struct context *scontext = NULL, *tcontext = NULL;
+
+        read_lock(&policy_rwlock);
+        avd_init(avd);
+        if (!ss_initialized)
+                goto allow;
+
+        scontext = sidtab_search(&sidtab, ssid);
+        if (!scontext) {
+                printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
+                       __func__, ssid);
+                goto out;
+        }
 
         /* permissive domain? */
         if (ebitmap_get_bit(&policydb.permissive_map, scontext->type))
-            avd->flags |= AVD_FLAGS_PERMISSIVE;
-out:
+                avd->flags |= AVD_FLAGS_PERMISSIVE;
+
+        tcontext = sidtab_search(&sidtab, tsid);
+        if (!tcontext) {
+                printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
+                       __func__, tsid);
+                goto out;
+        }
+
+        if (unlikely(!tclass)) {
+                if (policydb.allow_unknown)
+                        goto allow;
+                goto out;
+        }
+
+        context_struct_compute_av(scontext, tcontext, tclass, avd);
+ out:
         read_unlock(&policy_rwlock);
-        return rc;
+        return;
+allow:
+        avd->allowed = 0xffffffff;
+        goto out;
 }
 
 /*
@@ -1204,20 +1331,22 @@ out:
 
 static int security_compute_sid(u32 ssid,
                                 u32 tsid,
-                                u16 tclass,
+                                u16 orig_tclass,
                                 u32 specified,
-                                u32 *out_sid)
+                                u32 *out_sid,
+                                bool kern)
 {
         struct context *scontext = NULL, *tcontext = NULL, newcontext;
         struct role_trans *roletr = NULL;
         struct avtab_key avkey;
         struct avtab_datum *avdatum;
         struct avtab_node *node;
+        u16 tclass;
         int rc = 0;
 
         if (!ss_initialized) {
-                switch (tclass) {
-                case SECCLASS_PROCESS:
+                switch (orig_tclass) {
+                case SECCLASS_PROCESS: /* kernel value */
                         *out_sid = ssid;
                         break;
                 default:
@@ -1231,6 +1360,11 @@ static int security_compute_sid(u32 ssid,
 
         read_lock(&policy_rwlock);
 
+        if (kern)
+                tclass = unmap_class(orig_tclass);
+        else
+                tclass = orig_tclass;
+
         scontext = sidtab_search(&sidtab, ssid);
         if (!scontext) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
@@ -1260,13 +1394,11 @@ static int security_compute_sid(u32 ssid,
         }
 
         /* Set the role and type to default values. */
-        switch (tclass) {
-        case SECCLASS_PROCESS:
+        if (tclass == policydb.process_class) {
                 /* Use the current role and type of process. */
                 newcontext.role = scontext->role;
                 newcontext.type = scontext->type;
-                break;
-        default:
+        } else {
                 /* Use the well-defined object role. */
                 newcontext.role = OBJECT_R_VAL;
                 /* Use the type of the related object. */
@@ -1297,8 +1429,7 @@ static int security_compute_sid(u32 ssid,
         }
 
         /* Check for class-specific changes. */
-        switch (tclass) {
-        case SECCLASS_PROCESS:
+        if  (tclass == policydb.process_class) {
                 if (specified & AVTAB_TRANSITION) {
                         /* Look for a role transition rule. */
                         for (roletr = policydb.role_tr; roletr;
@@ -1311,9 +1442,6 @@ static int security_compute_sid(u32 ssid,
                                 }
                         }
                 }
-                break;
-        default:
-                break;
         }
 
         /* Set the MLS attributes.
@@ -1358,7 +1486,17 @@ int security_transition_sid(u32 ssid,
                             u16 tclass,
                             u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, out_sid);
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
+                                    out_sid, true);
+}
+
+int security_transition_sid_user(u32 ssid,
+                                 u32 tsid,
+                                 u16 tclass,
+                                 u32 *out_sid)
+{
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
+                                    out_sid, false);
 }
 
 /**
@@ -1379,7 +1517,8 @@ int security_member_sid(u32 ssid,
                         u16 tclass,
                         u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid);
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid,
+                                    false);
 }
 
 /**
@@ -1400,144 +1539,8 @@ int security_change_sid(u32 ssid,
                         u16 tclass,
                         u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid);
-}
-
-/*
- * Verify that each kernel class that is defined in the
- * policy is correct
- */
-static int validate_classes(struct policydb *p)
-{
-        int i, j;
-        struct class_datum *cladatum;
-        struct perm_datum *perdatum;
-        u32 nprim, tmp, common_pts_len, perm_val, pol_val;
-        u16 class_val;
-        const struct selinux_class_perm *kdefs = &selinux_class_perm;
-        const char *def_class, *def_perm, *pol_class;
-        struct symtab *perms;
-        bool print_unknown_handle = 0;
-
-        if (p->allow_unknown) {
-                u32 num_classes = kdefs->cts_len;
-                p->undefined_perms = kcalloc(num_classes, sizeof(u32), GFP_KERNEL);
-                if (!p->undefined_perms)
-                        return -ENOMEM;
-        }
-
-        for (i = 1; i < kdefs->cts_len; i++) {
-                def_class = kdefs->class_to_string[i];
-                if (!def_class)
-                        continue;
-                if (i > p->p_classes.nprim) {
-                        printk(KERN_INFO
-                               "SELinux:  class %s not defined in policy\n",
-                               def_class);
-                        if (p->reject_unknown)
-                                return -EINVAL;
-                        if (p->allow_unknown)
-                                p->undefined_perms[i-1] = ~0U;
-                        print_unknown_handle = 1;
-                        continue;
-                }
-                pol_class = p->p_class_val_to_name[i-1];
-                if (strcmp(pol_class, def_class)) {
-                        printk(KERN_ERR
-                               "SELinux:  class %d is incorrect, found %s but should be %s\n",
-                               i, pol_class, def_class);
-                        return -EINVAL;
-                }
-        }
-        for (i = 0; i < kdefs->av_pts_len; i++) {
-                class_val = kdefs->av_perm_to_string[i].tclass;
-                perm_val = kdefs->av_perm_to_string[i].value;
-                def_perm = kdefs->av_perm_to_string[i].name;
-                if (class_val > p->p_classes.nprim)
-                        continue;
-                pol_class = p->p_class_val_to_name[class_val-1];
-                cladatum = hashtab_search(p->p_classes.table, pol_class);
-                BUG_ON(!cladatum);
-                perms = &cladatum->permissions;
-                nprim = 1 << (perms->nprim - 1);
-                if (perm_val > nprim) {
-                        printk(KERN_INFO
-                               "SELinux:  permission %s in class %s not defined in policy\n",
-                               def_perm, pol_class);
-                        if (p->reject_unknown)
-                                return -EINVAL;
-                        if (p->allow_unknown)
-                                p->undefined_perms[class_val-1] |= perm_val;
-                        print_unknown_handle = 1;
-                        continue;
-                }
-                perdatum = hashtab_search(perms->table, def_perm);
-                if (perdatum == NULL) {
-                        printk(KERN_ERR
-                               "SELinux:  permission %s in class %s not found in policy, bad policy\n",
-                               def_perm, pol_class);
-                        return -EINVAL;
-                }
-                pol_val = 1 << (perdatum->value - 1);
-                if (pol_val != perm_val) {
-                        printk(KERN_ERR
-                               "SELinux:  permission %s in class %s has incorrect value\n",
-                               def_perm, pol_class);
-                        return -EINVAL;
-                }
-        }
-        for (i = 0; i < kdefs->av_inherit_len; i++) {
-                class_val = kdefs->av_inherit[i].tclass;
-                if (class_val > p->p_classes.nprim)
-                        continue;
-                pol_class = p->p_class_val_to_name[class_val-1];
-                cladatum = hashtab_search(p->p_classes.table, pol_class);
-                BUG_ON(!cladatum);
-                if (!cladatum->comdatum) {
-                        printk(KERN_ERR
-                               "SELinux:  class %s should have an inherits clause but does not\n",
-                               pol_class);
-                        return -EINVAL;
-                }
-                tmp = kdefs->av_inherit[i].common_base;
-                common_pts_len = 0;
-                while (!(tmp & 0x01)) {
-                        common_pts_len++;
-                        tmp >>= 1;
-                }
-                perms = &cladatum->comdatum->permissions;
-                for (j = 0; j < common_pts_len; j++) {
-                        def_perm = kdefs->av_inherit[i].common_pts[j];
-                        if (j >= perms->nprim) {
-                                printk(KERN_INFO
-                                       "SELinux:  permission %s in class %s not defined in policy\n",
-                                       def_perm, pol_class);
-                                if (p->reject_unknown)
-                                        return -EINVAL;
-                                if (p->allow_unknown)
-                                        p->undefined_perms[class_val-1] |= (1 << j);
-                                print_unknown_handle = 1;
-                                continue;
-                        }
-                        perdatum = hashtab_search(perms->table, def_perm);
-                        if (perdatum == NULL) {
-                                printk(KERN_ERR
-                                       "SELinux:  permission %s in class %s not found in policy, bad policy\n",
-                                       def_perm, pol_class);
-                                return -EINVAL;
-                        }
-                        if (perdatum->value != j + 1) {
-                                printk(KERN_ERR
-                                       "SELinux:  permission %s in class %s has incorrect value\n",
-                                       def_perm, pol_class);
-                                return -EINVAL;
-                        }
-                }
-        }
-        if (print_unknown_handle)
-                printk(KERN_INFO "SELinux: the above unknown classes and permissions will be %s\n",
-                        (security_get_allow_unknown() ? "allowed" : "denied"));
-        return 0;
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid,
+                                    false);
 }
 
 /* Clone the SID into the new SID table. */
@@ -1547,7 +1550,10 @@ static int clone_sid(u32 sid,
 {
         struct sidtab *s = arg;
 
-        return sidtab_insert(s, sid, context);
+        if (sid > SECINITSID_NUM)
+                return sidtab_insert(s, sid, context);
+        else
+                return 0;
 }
 
 static inline int convert_context_handle_invalid_context(struct context *context)
@@ -1588,12 +1594,17 @@ static int convert_context(u32 key,
 {
         struct convert_context_args *args;
         struct context oldc;
+        struct ocontext *oc;
+        struct mls_range *range;
         struct role_datum *role;
         struct type_datum *typdatum;
         struct user_datum *usrdatum;
         char *s;
         u32 len;
-        int rc;
+        int rc = 0;
+
+        if (key <= SECINITSID_NUM)
+                goto out;
 
         args = p;
 
@@ -1655,9 +1666,39 @@ static int convert_context(u32 key,
                 goto bad;
         c->type = typdatum->value;
 
-        rc = mls_convert_context(args->oldp, args->newp, c);
-        if (rc)
-                goto bad;
+        /* Convert the MLS fields if dealing with MLS policies */
+        if (args->oldp->mls_enabled && args->newp->mls_enabled) {
+                rc = mls_convert_context(args->oldp, args->newp, c);
+                if (rc)
+                        goto bad;
+        } else if (args->oldp->mls_enabled && !args->newp->mls_enabled) {
+                /*
+                 * Switching between MLS and non-MLS policy:
+                 * free any storage used by the MLS fields in the
+                 * context for all existing entries in the sidtab.
+                 */
+                mls_context_destroy(c);
+        } else if (!args->oldp->mls_enabled && args->newp->mls_enabled) {
+                /*
+                 * Switching between non-MLS and MLS policy:
+                 * ensure that the MLS fields of the context for all
+                 * existing entries in the sidtab are filled in with a
+                 * suitable default value, likely taken from one of the
+                 * initial SIDs.
+                 */
+                oc = args->newp->ocontexts[OCON_ISID];
+                while (oc && oc->sid[0] != SECINITSID_UNLABELED)
+                        oc = oc->next;
+                if (!oc) {
+                        printk(KERN_ERR "SELinux:  unable to look up"
+                                " the initial SIDs list\n");
+                        goto bad;
+                }
+                range = &oc->context[0].range;
+                rc = mls_range_set(c, range);
+                if (rc)
+                        goto bad;
+        }
 
         /* Check the validity of the new context. */
         if (!policydb_context_isvalid(args->newp, c)) {
@@ -1710,8 +1751,10 @@ int security_load_policy(void *data, size_t len)
 {
         struct policydb oldpolicydb, newpolicydb;
         struct sidtab oldsidtab, newsidtab;
+        struct selinux_mapping *oldmap, *map = NULL;
         struct convert_context_args args;
         u32 seqno;
+        u16 map_size;
         int rc = 0;
         struct policy_file file = { data, len }, *fp = &file;
 
@@ -1721,22 +1764,19 @@ int security_load_policy(void *data, size_t len)
                         avtab_cache_destroy();
                         return -EINVAL;
                 }
-                if (policydb_load_isids(&policydb, &sidtab)) {
+                if (selinux_set_mapping(&policydb, secclass_map,
+                                        &current_mapping,
+                                        &current_mapping_size)) {
                         policydb_destroy(&policydb);
                         avtab_cache_destroy();
                         return -EINVAL;
                 }
-                /* Verify that the kernel defined classes are correct. */
-                if (validate_classes(&policydb)) {
-                        printk(KERN_ERR
-                               "SELinux:  the definition of a class is incorrect\n");
-                        sidtab_destroy(&sidtab);
+                if (policydb_load_isids(&policydb, &sidtab)) {
                         policydb_destroy(&policydb);
                         avtab_cache_destroy();
                         return -EINVAL;
                 }
                 security_load_policycaps();
-                policydb_loaded_version = policydb.policyvers;
                 ss_initialized = 1;
                 seqno = ++latest_granting;
                 selinux_complete_init();
@@ -1754,18 +1794,22 @@ int security_load_policy(void *data, size_t len)
         if (policydb_read(&newpolicydb, fp))
                 return -EINVAL;
 
-        if (sidtab_init(&newsidtab)) {
+        /* If switching between different policy types, log MLS status */
+        if (policydb.mls_enabled && !newpolicydb.mls_enabled)
+                printk(KERN_INFO "SELinux: Disabling MLS support...\n");
+        else if (!policydb.mls_enabled && newpolicydb.mls_enabled)
+                printk(KERN_INFO "SELinux: Enabling MLS support...\n");
+
+        rc = policydb_load_isids(&newpolicydb, &newsidtab);
+        if (rc) {
+                printk(KERN_ERR "SELinux:  unable to load the initial SIDs\n");
                 policydb_destroy(&newpolicydb);
-                return -ENOMEM;
+                return rc;
         }
 
-        /* Verify that the kernel defined classes are correct. */
-        if (validate_classes(&newpolicydb)) {
-                printk(KERN_ERR
-                       "SELinux:  the definition of a class is incorrect\n");
-                rc = -EINVAL;
+        if (selinux_set_mapping(&newpolicydb, secclass_map,
+                                &map, &map_size))
                 goto err;
-        }
 
         rc = security_preserve_bools(&newpolicydb);
         if (rc) {
@@ -1787,8 +1831,12 @@ int security_load_policy(void *data, size_t len)
         args.oldp = &policydb;
         args.newp = &newpolicydb;
         rc = sidtab_map(&newsidtab, convert_context, &args);
-        if (rc)
+        if (rc) {
+                printk(KERN_ERR "SELinux:  unable to convert the internal"
+                        " representation of contexts in the new SID"
+                        " table\n");
                 goto err;
+        }
 
         /* Save the old policydb and SID table to free later. */
         memcpy(&oldpolicydb, &policydb, sizeof policydb);
@@ -1799,13 +1847,16 @@ int security_load_policy(void *data, size_t len)
         memcpy(&policydb, &newpolicydb, sizeof policydb);
         sidtab_set(&sidtab, &newsidtab);
         security_load_policycaps();
+        oldmap = current_mapping;
+        current_mapping = map;
+        current_mapping_size = map_size;
         seqno = ++latest_granting;
-        policydb_loaded_version = policydb.policyvers;
         write_unlock_irq(&policy_rwlock);
 
         /* Free the old policydb and SID table. */
         policydb_destroy(&oldpolicydb);
         sidtab_destroy(&oldsidtab);
+        kfree(oldmap);
 
         avc_ss_reset(seqno);
         selnl_notify_policyload(seqno);
@@ -1815,6 +1866,7 @@ int security_load_policy(void *data, size_t len)
         return 0;
 
 err:
+        kfree(map);
         sidtab_destroy(&newsidtab);
         policydb_destroy(&newpolicydb);
         return rc;
@@ -2091,7 +2143,7 @@ out_unlock:
         }
         for (i = 0, j = 0; i < mynel; i++) {
                 rc = avc_has_perm_noaudit(fromsid, mysids[i],
-                                          SECCLASS_PROCESS,
+                                          SECCLASS_PROCESS, /* kernel value */
                                           PROCESS__TRANSITION, AVC_STRICT,
                                           NULL);
                 if (!rc)
@@ -2119,10 +2171,11 @@ out:
  */
 int security_genfs_sid(const char *fstype,
                        char *path,
-                       u16 sclass,
+                       u16 orig_sclass,
                        u32 *sid)
 {
         int len;
+        u16 sclass;
         struct genfs *genfs;
         struct ocontext *c;
         int rc = 0, cmp = 0;
@@ -2132,6 +2185,8 @@ int security_genfs_sid(const char *fstype,
 
         read_lock(&policy_rwlock);
 
+        sclass = unmap_class(orig_sclass);
+
         for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
                 cmp = strcmp(fstype, genfs->fstype);
                 if (cmp <= 0)
@@ -2377,7 +2432,7 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
         u32 len;
         int rc = 0;
 
-        if (!ss_initialized || !selinux_mls_enabled) {
+        if (!ss_initialized || !policydb.mls_enabled) {
                 *new_sid = sid;
                 goto out;
         }
@@ -2478,7 +2533,7 @@ int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
         /* we don't need to check ss_initialized here since the only way both
          * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
          * security server was initialized and ss_initialized was true */
-        if (!selinux_mls_enabled) {
+        if (!policydb.mls_enabled) {
                 *peer_sid = SECSID_NULL;
                 return 0;
         }
@@ -2535,7 +2590,7 @@ int security_get_classes(char ***classes, int *nclasses)
         read_lock(&policy_rwlock);
 
         *nclasses = policydb.p_classes.nprim;
-        *classes = kcalloc(*nclasses, sizeof(*classes), GFP_ATOMIC);
+        *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);
         if (!*classes)
                 goto out;
 
@@ -2582,7 +2637,7 @@ int security_get_permissions(char *class, char ***perms, int *nperms)
         }
 
         *nperms = match->permissions.nprim;
-        *perms = kcalloc(*nperms, sizeof(*perms), GFP_ATOMIC);
+        *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC);
         if (!*perms)
                 goto out;