Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp

Conflicts:
	litmus/sched_cedf.c

29 files changed, 3308 insertions, 1399 deletions

diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index 58d80f3bd6f6..ad5cd76ec231 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -2,25 +2,20 @@
 # Makefile for building the SELinux module as part of the kernel tree.
 #
 
-obj-$(CONFIG_SECURITY_SELINUX) := selinux.o ss/
-
-selinux-y := avc.o \
-             hooks.o \
-             selinuxfs.o \
-             netlink.o \
-             nlmsgtab.o \
-             netif.o \
-             netnode.o \
-             netport.o \
-             exports.o
+obj-$(CONFIG_SECURITY_SELINUX) := selinux.o
+
+selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o \
+             netnode.o netport.o exports.o \
+             ss/ebitmap.o ss/hashtab.o ss/symtab.o ss/sidtab.o ss/avtab.o \
+             ss/policydb.o ss/services.o ss/conditional.o ss/mls.o ss/status.o
 
 selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o
 
 selinux-$(CONFIG_NETLABEL) += netlabel.o
 
-EXTRA_CFLAGS += -Isecurity/selinux -Isecurity/selinux/include
+ccflags-y := -Isecurity/selinux -Isecurity/selinux/include
 
-$(obj)/avc.o: $(obj)/flask.h
+$(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
 
 quiet_cmd_flask = GEN     $(obj)/flask.h $(obj)/av_permissions.h
       cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 9da6420e2056..d515b2128a4e 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -38,11 +38,7 @@
 #define AVC_CACHE_RECLAIM               16
 
 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
-#define avc_cache_stats_incr(field)                             \
-do {                                                            \
-        per_cpu(avc_cache_stats, get_cpu()).field++;            \
-        put_cpu();                                              \
-} while (0)
+#define avc_cache_stats_incr(field)     this_cpu_inc(avc_cache_stats.field)
 #else
 #define avc_cache_stats_incr(field)     do {} while (0)
 #endif
@@ -347,11 +343,10 @@ static struct avc_node *avc_lookup(u32 ssid, u32 tsid, u16 tclass)
         node = avc_search_node(ssid, tsid, tclass);
 
         if (node)
-                avc_cache_stats_incr(hits);
-        else
-                avc_cache_stats_incr(misses);
+                return node;
 
-        return node;
+        avc_cache_stats_incr(misses);
+        return NULL;
 }
 
 static int avc_latest_notif_update(int seqno, int is_insert)
@@ -471,6 +466,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
  * @avd: access vector decisions
  * @result: result from avc_has_perm_noaudit
  * @a:  auxiliary audit data
+ * @flags: VFS walk flags
  *
  * Audit the granting or denial of permissions in accordance
  * with the policy.  This function is typically called by
@@ -481,9 +477,10 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
  * be performed under a lock, to allow the lock to be released
  * before calling the auditing code.
  */
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
-               struct av_decision *avd, int result, struct common_audit_data *a)
+               struct av_decision *avd, int result, struct common_audit_data *a,
+               unsigned flags)
 {
         struct common_audit_data stack_data;
         u32 denied, audited;
@@ -515,11 +512,24 @@ void avc_audit(u32 ssid, u32 tsid,
         else
                 audited = requested & avd->auditallow;
         if (!audited)
-                return;
+                return 0;
+
         if (!a) {
                 a = &stack_data;
                 COMMON_AUDIT_DATA_INIT(a, NONE);
         }
+
+        /*
+         * When in a RCU walk do the audit on the RCU retry.  This is because
+         * the collection of the dname in an inode audit message is not RCU
+         * safe.  Note this may drop some audits when the situation changes
+         * during retry. However this is logically just as if the operation
+         * happened a little later.
+         */
+        if ((a->type == LSM_AUDIT_DATA_INODE) &&
+            (flags & IPERM_FLAG_RCU))
+                return -ECHILD;
+
         a->selinux_audit_data.tclass = tclass;
         a->selinux_audit_data.requested = requested;
         a->selinux_audit_data.ssid = ssid;
@@ -529,6 +539,7 @@ void avc_audit(u32 ssid, u32 tsid,
         a->lsm_pre_audit = avc_audit_pre_callback;
         a->lsm_post_audit = avc_audit_post_callback;
         common_lsm_audit(a);
+        return 0;
 }
 
 /**
@@ -741,10 +752,9 @@ int avc_ss_reset(u32 seqno)
 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                          u16 tclass, u32 requested,
                          unsigned flags,
-                         struct av_decision *in_avd)
+                         struct av_decision *avd)
 {
         struct avc_node *node;
-        struct av_decision avd_entry, *avd;
         int rc = 0;
         u32 denied;
 
@@ -753,20 +763,13 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
         rcu_read_lock();
 
         node = avc_lookup(ssid, tsid, tclass);
-        if (!node) {
+        if (unlikely(!node)) {
                 rcu_read_unlock();
-
-                if (in_avd)
-                        avd = in_avd;
-                else
-                        avd = &avd_entry;
-
                 security_compute_av(ssid, tsid, tclass, avd);
                 rcu_read_lock();
                 node = avc_insert(ssid, tsid, tclass, avd);
         } else {
-                if (in_avd)
-                        memcpy(in_avd, &node->ae.avd, sizeof(*in_avd));
+                memcpy(avd, &node->ae.avd, sizeof(*avd));
                 avd = &node->ae.avd;
         }
 
@@ -793,6 +796,7 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * @tclass: target security class
  * @requested: requested permissions, interpreted based on @tclass
  * @auditdata: auxiliary audit data
+ * @flags: VFS walk flags
  *
  * Check the AVC to determine whether the @requested permissions are granted
  * for the SID pair (@ssid, @tsid), interpreting the permissions
@@ -802,14 +806,19 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * permissions are granted, -%EACCES if any permissions are denied, or
  * another -errno upon other errors.
  */
-int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
-                 u32 requested, struct common_audit_data *auditdata)
+int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
+                       u32 requested, struct common_audit_data *auditdata,
+                       unsigned flags)
 {
         struct av_decision avd;
-        int rc;
+        int rc, rc2;
 
         rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
-        avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
+
+        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata,
+                        flags);
+        if (rc2)
+                return rc2;
         return rc;
 }
 
diff --git a/security/selinux/exports.c b/security/selinux/exports.c
index c0a454aee1e0..90664385dead 100644
--- a/security/selinux/exports.c
+++ b/security/selinux/exports.c
@@ -11,58 +11,9 @@
  * it under the terms of the GNU General Public License version 2,
  * as published by the Free Software Foundation.
  */
-#include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/selinux.h>
-#include <linux/fs.h>
-#include <linux/ipc.h>
-#include <asm/atomic.h>
 
 #include "security.h"
-#include "objsec.h"
-
-/* SECMARK reference count */
-extern atomic_t selinux_secmark_refcount;
-
-int selinux_string_to_sid(char *str, u32 *sid)
-{
-        if (selinux_enabled)
-                return security_context_to_sid(str, strlen(str), sid);
-        else {
-                *sid = 0;
-                return 0;
-        }
-}
-EXPORT_SYMBOL_GPL(selinux_string_to_sid);
-
-int selinux_secmark_relabel_packet_permission(u32 sid)
-{
-        if (selinux_enabled) {
-                const struct task_security_struct *__tsec;
-                u32 tsid;
-
-                __tsec = current_security();
-                tsid = __tsec->sid;
-
-                return avc_has_perm(tsid, sid, SECCLASS_PACKET,
-                                    PACKET__RELABELTO, NULL);
-        }
-        return 0;
-}
-EXPORT_SYMBOL_GPL(selinux_secmark_relabel_packet_permission);
-
-void selinux_secmark_refcount_inc(void)
-{
-        atomic_inc(&selinux_secmark_refcount);
-}
-EXPORT_SYMBOL_GPL(selinux_secmark_refcount_inc);
-
-void selinux_secmark_refcount_dec(void)
-{
-        atomic_dec(&selinux_secmark_refcount);
-}
-EXPORT_SYMBOL_GPL(selinux_secmark_refcount_dec);
 
 bool selinux_is_enabled(void)
 {
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4796ddd4e721..20219ef5439a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -24,9 +24,11 @@
  */
 
 #include <linux/init.h>
+#include <linux/kd.h>
 #include <linux/kernel.h>
 #include <linux/tracehook.h>
 #include <linux/errno.h>
+#include <linux/ext2_fs.h>
 #include <linux/sched.h>
 #include <linux/security.h>
 #include <linux/xattr.h>
@@ -36,14 +38,15 @@
 #include <linux/mman.h>
 #include <linux/slab.h>
 #include <linux/pagemap.h>
+#include <linux/proc_fs.h>
 #include <linux/swap.h>
 #include <linux/spinlock.h>
 #include <linux/syscalls.h>
+#include <linux/dcache.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
-#include <linux/proc_fs.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/tty.h>
@@ -70,13 +73,13 @@
 #include <net/ipv6.h>
 #include <linux/hugetlb.h>
 #include <linux/personality.h>
-#include <linux/sysctl.h>
 #include <linux/audit.h>
 #include <linux/string.h>
 #include <linux/selinux.h>
 #include <linux/mutex.h>
 #include <linux/posix-timers.h>
 #include <linux/syslog.h>
+#include <linux/user_namespace.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -987,6 +990,7 @@ static void selinux_write_opts(struct seq_file *m,
                         continue;
                 default:
                         BUG();
+                        return;
                 };
                 /* we need a comma before each option */
                 seq_putc(m, ',');
@@ -1120,39 +1124,35 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
 }
 
 #ifdef CONFIG_PROC_FS
-static int selinux_proc_get_sid(struct proc_dir_entry *de,
+static int selinux_proc_get_sid(struct dentry *dentry,
                                 u16 tclass,
                                 u32 *sid)
 {
-        int buflen, rc;
-        char *buffer, *path, *end;
+        int rc;
+        char *buffer, *path;
 
         buffer = (char *)__get_free_page(GFP_KERNEL);
         if (!buffer)
                 return -ENOMEM;
 
-        buflen = PAGE_SIZE;
-        end = buffer+buflen;
-        *--end = '\0';
-        buflen--;
-        path = end-1;
-        *path = '/';
-        while (de && de != de->parent) {
-                buflen -= de->namelen + 1;
-                if (buflen < 0)
-                        break;
-                end -= de->namelen;
-                memcpy(end, de->name, de->namelen);
-                *--end = '/';
-                path = end;
-                de = de->parent;
+        path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
+        if (IS_ERR(path))
+                rc = PTR_ERR(path);
+        else {
+                /* each process gets a /proc/PID/ entry. Strip off the
+                 * PID part to get a valid selinux labeling.
+                 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
+                while (path[1] >= '0' && path[1] <= '9') {
+                        path[1] = '/';
+                        path++;
+                }
+                rc = security_genfs_sid("proc", path, tclass, sid);
         }
-        rc = security_genfs_sid("proc", path, tclass, sid);
         free_page((unsigned long)buffer);
         return rc;
 }
 #else
-static int selinux_proc_get_sid(struct proc_dir_entry *de,
+static int selinux_proc_get_sid(struct dentry *dentry,
                                 u16 tclass,
                                 u32 *sid)
 {
@@ -1300,10 +1300,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 
                 /* Try to obtain a transition SID. */
                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
-                rc = security_transition_sid(isec->task_sid,
-                                             sbsec->sid,
-                                             isec->sclass,
-                                             &sid);
+                rc = security_transition_sid(isec->task_sid, sbsec->sid,
+                                             isec->sclass, NULL, &sid);
                 if (rc)
                         goto out_unlock;
                 isec->sid = sid;
@@ -1316,10 +1314,9 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                 isec->sid = sbsec->sid;
 
                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
-                        struct proc_inode *proci = PROC_I(inode);
-                        if (proci->pde) {
+                        if (opt_dentry) {
                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
-                                rc = selinux_proc_get_sid(proci->pde,
+                                rc = selinux_proc_get_sid(opt_dentry,
                                                           isec->sclass,
                                                           &sid);
                                 if (rc)
@@ -1447,11 +1444,15 @@ static int task_has_capability(struct task_struct *tsk,
                 printk(KERN_ERR
                        "SELinux:  out of range capability %d\n", cap);
                 BUG();
+                return -EINVAL;
         }
 
         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
-        if (audit == SECURITY_CAP_AUDIT)
-                avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
+        if (audit == SECURITY_CAP_AUDIT) {
+                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+                if (rc2)
+                        return rc2;
+        }
         return rc;
 }
 
@@ -1471,10 +1472,10 @@ static int task_has_system(struct task_struct *tsk,
 static int inode_has_perm(const struct cred *cred,
                           struct inode *inode,
                           u32 perms,
-                          struct common_audit_data *adp)
+                          struct common_audit_data *adp,
+                          unsigned flags)
 {
         struct inode_security_struct *isec;
-        struct common_audit_data ad;
         u32 sid;
 
         validate_creds(cred);
@@ -1485,30 +1486,49 @@ static int inode_has_perm(const struct cred *cred,
         sid = cred_sid(cred);
         isec = inode->i_security;
 
-        if (!adp) {
-                adp = &ad;
-                COMMON_AUDIT_DATA_INIT(&ad, FS);
-                ad.u.fs.inode = inode;
-        }
+        return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
+}
 
-        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
+static int inode_has_perm_noadp(const struct cred *cred,
+                                struct inode *inode,
+                                u32 perms,
+                                unsigned flags)
+{
+        struct common_audit_data ad;
+
+        COMMON_AUDIT_DATA_INIT(&ad, INODE);
+        ad.u.inode = inode;
+        return inode_has_perm(cred, inode, perms, &ad, flags);
 }
 
 /* Same as inode_has_perm, but pass explicit audit data containing
    the dentry to help the auditing code to more easily generate the
    pathname if needed. */
 static inline int dentry_has_perm(const struct cred *cred,
-                                  struct vfsmount *mnt,
                                   struct dentry *dentry,
                                   u32 av)
 {
         struct inode *inode = dentry->d_inode;
         struct common_audit_data ad;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path.mnt = mnt;
-        ad.u.fs.path.dentry = dentry;
-        return inode_has_perm(cred, inode, av, &ad);
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.u.dentry = dentry;
+        return inode_has_perm(cred, inode, av, &ad, 0);
+}
+
+/* Same as inode_has_perm, but pass explicit audit data containing
+   the path to help the auditing code to more easily generate the
+   pathname if needed. */
+static inline int path_has_perm(const struct cred *cred,
+                                struct path *path,
+                                u32 av)
+{
+        struct inode *inode = path->dentry->d_inode;
+        struct common_audit_data ad;
+
+        COMMON_AUDIT_DATA_INIT(&ad, PATH);
+        ad.u.path = *path;
+        return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
 /* Check whether a task can use an open file descriptor to
@@ -1529,8 +1549,8 @@ static int file_has_perm(const struct cred *cred,
         u32 sid = cred_sid(cred);
         int rc;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path = file->f_path;
+        COMMON_AUDIT_DATA_INIT(&ad, PATH);
+        ad.u.path = file->f_path;
 
         if (sid != fsec->sid) {
                 rc = avc_has_perm(sid, fsec->sid,
@@ -1544,7 +1564,7 @@ static int file_has_perm(const struct cred *cred,
         /* av is zero if only checking access to the descriptor. */
         rc = 0;
         if (av)
-                rc = inode_has_perm(cred, inode, av, &ad);
+                rc = inode_has_perm(cred, inode, av, &ad, 0);
 
 out:
         return rc;
@@ -1568,8 +1588,8 @@ static int may_create(struct inode *dir,
         sid = tsec->sid;
         newsid = tsec->create_sid;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path.dentry = dentry;
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.u.dentry = dentry;
 
         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
                           DIR__ADD_NAME | DIR__SEARCH,
@@ -1578,7 +1598,8 @@ static int may_create(struct inode *dir,
                 return rc;
 
         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
-                rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
+                rc = security_transition_sid(sid, dsec->sid, tclass,
+                                             &dentry->d_name, &newsid);
                 if (rc)
                         return rc;
         }
@@ -1620,8 +1641,8 @@ static int may_link(struct inode *dir,
         dsec = dir->i_security;
         isec = dentry->d_inode->i_security;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path.dentry = dentry;
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.u.dentry = dentry;
 
         av = DIR__SEARCH;
         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
@@ -1666,9 +1687,9 @@ static inline int may_rename(struct inode *old_dir,
         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
         new_dsec = new_dir->i_security;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
 
-        ad.u.fs.path.dentry = old_dentry;
+        ad.u.dentry = old_dentry;
         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
         if (rc)
@@ -1684,7 +1705,7 @@ static inline int may_rename(struct inode *old_dir,
                         return rc;
         }
 
-        ad.u.fs.path.dentry = new_dentry;
+        ad.u.dentry = new_dentry;
         av = DIR__ADD_NAME | DIR__SEARCH;
         if (new_dentry->d_inode)
                 av |= DIR__REMOVE_NAME;
@@ -1851,93 +1872,17 @@ static int selinux_capset(struct cred *new, const struct cred *old,
  */
 
 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
-                           int cap, int audit)
+                           struct user_namespace *ns, int cap, int audit)
 {
         int rc;
 
-        rc = cap_capable(tsk, cred, cap, audit);
+        rc = cap_capable(tsk, cred, ns, cap, audit);
         if (rc)
                 return rc;
 
         return task_has_capability(tsk, cred, cap, audit);
 }
 
-static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
-{
-        int buflen, rc;
-        char *buffer, *path, *end;
-
-        rc = -ENOMEM;
-        buffer = (char *)__get_free_page(GFP_KERNEL);
-        if (!buffer)
-                goto out;
-
-        buflen = PAGE_SIZE;
-        end = buffer+buflen;
-        *--end = '\0';
-        buflen--;
-        path = end-1;
-        *path = '/';
-        while (table) {
-                const char *name = table->procname;
-                size_t namelen = strlen(name);
-                buflen -= namelen + 1;
-                if (buflen < 0)
-                        goto out_free;
-                end -= namelen;
-                memcpy(end, name, namelen);
-                *--end = '/';
-                path = end;
-                table = table->parent;
-        }
-        buflen -= 4;
-        if (buflen < 0)
-                goto out_free;
-        end -= 4;
-        memcpy(end, "/sys", 4);
-        path = end;
-        rc = security_genfs_sid("proc", path, tclass, sid);
-out_free:
-        free_page((unsigned long)buffer);
-out:
-        return rc;
-}
-
-static int selinux_sysctl(ctl_table *table, int op)
-{
-        int error = 0;
-        u32 av;
-        u32 tsid, sid;
-        int rc;
-
-        sid = current_sid();
-
-        rc = selinux_sysctl_get_sid(table, (op == 0001) ?
-                                    SECCLASS_DIR : SECCLASS_FILE, &tsid);
-        if (rc) {
-                /* Default to the well-defined sysctl SID. */
-                tsid = SECINITSID_SYSCTL;
-        }
-
-        /* The op values are "defined" in sysctl.c, thereby creating
-         * a bad coupling between this module and sysctl.c */
-        if (op == 001) {
-                error = avc_has_perm(sid, tsid,
-                                     SECCLASS_DIR, DIR__SEARCH, NULL);
-        } else {
-                av = 0;
-                if (op & 004)
-                        av |= FILE__READ;
-                if (op & 002)
-                        av |= FILE__WRITE;
-                if (av)
-                        error = avc_has_perm(sid, tsid,
-                                             SECCLASS_FILE, av, NULL);
-        }
-
-        return error;
-}
-
 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
 {
         const struct cred *cred = current_cred();
@@ -1970,17 +1915,13 @@ static int selinux_quota_on(struct dentry *dentry)
 {
         const struct cred *cred = current_cred();
 
-        return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
+        return dentry_has_perm(cred, dentry, FILE__QUOTAON);
 }
 
-static int selinux_syslog(int type, bool from_file)
+static int selinux_syslog(int type)
 {
         int rc;
 
-        rc = cap_syslog(type, from_file);
-        if (rc)
-                return rc;
-
         switch (type) {
         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
@@ -2016,7 +1957,8 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int rc, cap_sys_admin = 0;
 
-        rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
+        rc = selinux_capable(current, current_cred(),
+                             &init_user_ns, CAP_SYS_ADMIN,
                              SECURITY_CAP_NOAUDIT);
         if (rc == 0)
                 cap_sys_admin = 1;
@@ -2064,13 +2006,14 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
         } else {
                 /* Check for a default transition on this program. */
                 rc = security_transition_sid(old_tsec->sid, isec->sid,
-                                             SECCLASS_PROCESS, &new_tsec->sid);
+                                             SECCLASS_PROCESS, NULL,
+                                             &new_tsec->sid);
                 if (rc)
                         return rc;
         }
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path = bprm->file->f_path;
+        COMMON_AUDIT_DATA_INIT(&ad, PATH);
+        ad.u.path = bprm->file->f_path;
 
         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
                 new_tsec->sid = old_tsec->sid;
@@ -2184,8 +2127,8 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                                                 struct tty_file_private, list);
                         file = file_priv->file;
                         inode = file->f_path.dentry->d_inode;
-                        if (inode_has_perm(cred, inode,
-                                           FILE__READ | FILE__WRITE, NULL)) {
+                        if (inode_has_perm_noadp(cred, inode,
+                                           FILE__READ | FILE__WRITE, 0)) {
                                 drop_tty = 1;
                         }
                 }
@@ -2198,7 +2141,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
 
         /* Revalidate access to inherited open files. */
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
+        COMMON_AUDIT_DATA_INIT(&ad, INODE);
 
         spin_lock(&files->file_lock);
         for (;;) {
@@ -2447,6 +2390,91 @@ out:
         return rc;
 }
 
+static int selinux_sb_remount(struct super_block *sb, void *data)
+{
+        int rc, i, *flags;
+        struct security_mnt_opts opts;
+        char *secdata, **mount_options;
+        struct superblock_security_struct *sbsec = sb->s_security;
+
+        if (!(sbsec->flags & SE_SBINITIALIZED))
+                return 0;
+
+        if (!data)
+                return 0;
+
+        if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
+                return 0;
+
+        security_init_mnt_opts(&opts);
+        secdata = alloc_secdata();
+        if (!secdata)
+                return -ENOMEM;
+        rc = selinux_sb_copy_data(data, secdata);
+        if (rc)
+                goto out_free_secdata;
+
+        rc = selinux_parse_opts_str(secdata, &opts);
+        if (rc)
+                goto out_free_secdata;
+
+        mount_options = opts.mnt_opts;
+        flags = opts.mnt_opts_flags;
+
+        for (i = 0; i < opts.num_mnt_opts; i++) {
+                u32 sid;
+                size_t len;
+
+                if (flags[i] == SE_SBLABELSUPP)
+                        continue;
+                len = strlen(mount_options[i]);
+                rc = security_context_to_sid(mount_options[i], len, &sid);
+                if (rc) {
+                        printk(KERN_WARNING "SELinux: security_context_to_sid"
+                               "(%s) failed for (dev %s, type %s) errno=%d\n",
+                               mount_options[i], sb->s_id, sb->s_type->name, rc);
+                        goto out_free_opts;
+                }
+                rc = -EINVAL;
+                switch (flags[i]) {
+                case FSCONTEXT_MNT:
+                        if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+                                goto out_bad_option;
+                        break;
+                case CONTEXT_MNT:
+                        if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+                                goto out_bad_option;
+                        break;
+                case ROOTCONTEXT_MNT: {
+                        struct inode_security_struct *root_isec;
+                        root_isec = sb->s_root->d_inode->i_security;
+
+                        if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+                                goto out_bad_option;
+                        break;
+                }
+                case DEFCONTEXT_MNT:
+                        if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+                                goto out_bad_option;
+                        break;
+                default:
+                        goto out_free_opts;
+                }
+        }
+
+        rc = 0;
+out_free_opts:
+        security_free_mnt_opts(&opts);
+out_free_secdata:
+        free_secdata(secdata);
+        return rc;
+out_bad_option:
+        printk(KERN_WARNING "SELinux: unable to change security options "
+               "during remount (dev %s, type=%s)\n", sb->s_id,
+               sb->s_type->name);
+        goto out_free_opts;
+}
+
 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
 {
         const struct cred *cred = current_cred();
@@ -2461,8 +2489,8 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
         if (flags & MS_KERNMOUNT)
                 return 0;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path.dentry = sb->s_root;
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.u.dentry = sb->s_root;
         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
 }
 
@@ -2471,8 +2499,8 @@ static int selinux_sb_statfs(struct dentry *dentry)
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path.dentry = dentry->d_sb->s_root;
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.u.dentry = dentry->d_sb->s_root;
         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
 }
 
@@ -2488,8 +2516,7 @@ static int selinux_mount(char *dev_name,
                 return superblock_has_perm(cred, path->mnt->mnt_sb,
                                            FILESYSTEM__REMOUNT, NULL);
         else
-                return dentry_has_perm(cred, path->mnt, path->dentry,
-                                       FILE__MOUNTON);
+                return path_has_perm(cred, path, FILE__MOUNTON);
 }
 
 static int selinux_umount(struct vfsmount *mnt, int flags)
@@ -2513,8 +2540,8 @@ static void selinux_inode_free_security(struct inode *inode)
 }
 
 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
-                                       char **name, void **value,
-                                       size_t *len)
+                                       const struct qstr *qstr, char **name,
+                                       void **value, size_t *len)
 {
         const struct task_security_struct *tsec = current_security();
         struct inode_security_struct *dsec;
@@ -2529,10 +2556,13 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
         sid = tsec->sid;
         newsid = tsec->create_sid;
 
-        if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
+        if ((sbsec->flags & SE_SBINITIALIZED) &&
+            (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
+                newsid = sbsec->mntpoint_sid;
+        else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
                 rc = security_transition_sid(sid, dsec->sid,
                                              inode_mode_to_security_class(inode->i_mode),
-                                             &newsid);
+                                             qstr, &newsid);
                 if (rc) {
                         printk(KERN_WARNING "%s:  "
                                "security_transition_sid failed, rc=%d (dev=%s "
@@ -2619,17 +2649,17 @@ static int selinux_inode_readlink(struct dentry *dentry)
 {
         const struct cred *cred = current_cred();
 
-        return dentry_has_perm(cred, NULL, dentry, FILE__READ);
+        return dentry_has_perm(cred, dentry, FILE__READ);
 }
 
 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
 {
         const struct cred *cred = current_cred();
 
-        return dentry_has_perm(cred, NULL, dentry, FILE__READ);
+        return dentry_has_perm(cred, dentry, FILE__READ);
 }
 
-static int selinux_inode_permission(struct inode *inode, int mask)
+static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
 {
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
@@ -2643,15 +2673,15 @@ static int selinux_inode_permission(struct inode *inode, int mask)
         if (!mask)
                 return 0;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.inode = inode;
+        COMMON_AUDIT_DATA_INIT(&ad, INODE);
+        ad.u.inode = inode;
 
         if (from_access)
                 ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
 
         perms = file_mask_to_av(inode->i_mode, mask);
 
-        return inode_has_perm(cred, inode, perms, &ad);
+        return inode_has_perm(cred, inode, perms, &ad, flags);
 }
 
 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
@@ -2669,16 +2699,20 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
 
         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
-                return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
+                return dentry_has_perm(cred, dentry, FILE__SETATTR);
 
-        return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
+        return dentry_has_perm(cred, dentry, FILE__WRITE);
 }
 
 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 {
         const struct cred *cred = current_cred();
+        struct path path;
+
+        path.dentry = dentry;
+        path.mnt = mnt;
 
-        return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
+        return path_has_perm(cred, &path, FILE__GETATTR);
 }
 
 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
@@ -2699,7 +2733,7 @@ static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
 
         /* Not an attribute we recognize, so just check the
            ordinary setattr permission. */
-        return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
+        return dentry_has_perm(cred, dentry, FILE__SETATTR);
 }
 
 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
@@ -2719,11 +2753,11 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         if (!(sbsec->flags & SE_SBLABELSUPP))
                 return -EOPNOTSUPP;
 
-        if (!is_owner_or_cap(inode))
+        if (!inode_owner_or_capable(inode))
                 return -EPERM;
 
-        COMMON_AUDIT_DATA_INIT(&ad, FS);
-        ad.u.fs.path.dentry = dentry;
+        COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.u.dentry = dentry;
 
         rc = avc_has_perm(sid, isec->sid, isec->sclass,
                           FILE__RELABELFROM, &ad);
@@ -2786,14 +2820,14 @@ static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
 {
         const struct cred *cred = current_cred();
 
-        return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
+        return dentry_has_perm(cred, dentry, FILE__GETATTR);
 }
 
 static int selinux_inode_listxattr(struct dentry *dentry)
 {
         const struct cred *cred = current_cred();
 
-        return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
+        return dentry_has_perm(cred, dentry, FILE__GETATTR);
 }
 
 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
@@ -2830,7 +2864,8 @@ static int selinux_inode_getsecurity(const struct inode *inode, const char *name
          * and lack of permission just means that we fall back to the
          * in-core context value, not a denial.
          */
-        error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
+        error = selinux_capable(current, current_cred(),
+                                &init_user_ns, CAP_MAC_ADMIN,
                                 SECURITY_CAP_NOAUDIT);
         if (!error)
                 error = security_sid_to_context_force(isec->sid, &context,
@@ -2933,16 +2968,47 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
                               unsigned long arg)
 {
         const struct cred *cred = current_cred();
-        u32 av = 0;
+        int error = 0;
 
-        if (_IOC_DIR(cmd) & _IOC_WRITE)
-                av |= FILE__WRITE;
-        if (_IOC_DIR(cmd) & _IOC_READ)
-                av |= FILE__READ;
-        if (!av)
-                av = FILE__IOCTL;
+        switch (cmd) {
+        case FIONREAD:
+        /* fall through */
+        case FIBMAP:
+        /* fall through */
+        case FIGETBSZ:
+        /* fall through */
+        case EXT2_IOC_GETFLAGS:
+        /* fall through */
+        case EXT2_IOC_GETVERSION:
+                error = file_has_perm(cred, file, FILE__GETATTR);
+                break;
 
-        return file_has_perm(cred, file, av);
+        case EXT2_IOC_SETFLAGS:
+        /* fall through */
+        case EXT2_IOC_SETVERSION:
+                error = file_has_perm(cred, file, FILE__SETATTR);
+                break;
+
+        /* sys_ioctl() checks */
+        case FIONBIO:
+        /* fall through */
+        case FIOASYNC:
+                error = file_has_perm(cred, file, 0);
+                break;
+
+        case KDSKBENT:
+        case KDSKBSENT:
+                error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
+                                        SECURITY_CAP_AUDIT);
+                break;
+
+        /* default case assumes that the command will go
+         * to the file's ioctl() function.
+         */
+        default:
+                error = file_has_perm(cred, file, FILE__IOCTL);
+        }
+        return error;
 }
 
 static int default_noexec;
@@ -3167,7 +3233,7 @@ static int selinux_dentry_open(struct file *file, const struct cred *cred)
          * new inode label or new policy.
          * This check is not redundant - do not remove.
          */
-        return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
+        return inode_has_perm_noadp(cred, inode, open_file_to_av(file), 0);
 }
 
 /* task security operations */
@@ -3199,7 +3265,11 @@ static void selinux_cred_free(struct cred *cred)
 {
         struct task_security_struct *tsec = cred->security;
 
-        BUG_ON((unsigned long) cred->security < PAGE_SIZE);
+        /*
+         * cred->security == NULL if security_cred_alloc_blank() or
+         * security_prepare_creds() returned an error.
+         */
+        BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
         cred->security = (void *) 0x7UL;
         kfree(tsec);
 }
@@ -3354,11 +3424,11 @@ static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
         return 0;
 }
 
-static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
+static int selinux_task_setscheduler(struct task_struct *p)
 {
         int rc;
 
-        rc = cap_task_setscheduler(p, policy, lp);
+        rc = cap_task_setscheduler(p);
         if (rc)
                 return rc;
 
@@ -3641,9 +3711,16 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
 
 /* socket security operations */
 
-static u32 socket_sockcreate_sid(const struct task_security_struct *tsec)
+static int socket_sockcreate_sid(const struct task_security_struct *tsec,
+                                 u16 secclass, u32 *socksid)
 {
-        return tsec->sockcreate_sid ? : tsec->sid;
+        if (tsec->sockcreate_sid > SECSID_NULL) {
+                *socksid = tsec->sockcreate_sid;
+                return 0;
+        }
+
+        return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
+                                       socksid);
 }
 
 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
@@ -3667,12 +3744,16 @@ static int selinux_socket_create(int family, int type,
         const struct task_security_struct *tsec = current_security();
         u32 newsid;
         u16 secclass;
+        int rc;
 
         if (kern)
                 return 0;
 
-        newsid = socket_sockcreate_sid(tsec);
         secclass = socket_type_to_security_class(family, type, protocol);
+        rc = socket_sockcreate_sid(tsec, secclass, &newsid);
+        if (rc)
+                return rc;
+
         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
 }
 
@@ -3684,12 +3765,16 @@ static int selinux_socket_post_create(struct socket *sock, int family,
         struct sk_security_struct *sksec;
         int err = 0;
 
+        isec->sclass = socket_type_to_security_class(family, type, protocol);
+
         if (kern)
                 isec->sid = SECINITSID_KERNEL;
-        else
-                isec->sid = socket_sockcreate_sid(tsec);
+        else {
+                err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
+                if (err)
+                        return err;
+        }
 
-        isec->sclass = socket_type_to_security_class(family, type, protocol);
         isec->initialized = 1;
 
         if (sock->sk) {
@@ -3925,18 +4010,18 @@ static int selinux_socket_shutdown(struct socket *sock, int how)
         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
 }
 
-static int selinux_socket_unix_stream_connect(struct socket *sock,
-                                              struct socket *other,
+static int selinux_socket_unix_stream_connect(struct sock *sock,
+                                              struct sock *other,
                                               struct sock *newsk)
 {
-        struct sk_security_struct *sksec_sock = sock->sk->sk_security;
-        struct sk_security_struct *sksec_other = other->sk->sk_security;
+        struct sk_security_struct *sksec_sock = sock->sk_security;
+        struct sk_security_struct *sksec_other = other->sk_security;
         struct sk_security_struct *sksec_new = newsk->sk_security;
         struct common_audit_data ad;
         int err;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.sk = other->sk;
+        ad.u.net.sk = other;
 
         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
                            sksec_other->sclass,
@@ -3999,7 +4084,6 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
 {
         int err = 0;
         struct sk_security_struct *sksec = sk->sk_security;
-        u32 peer_sid;
         u32 sk_sid = sksec->sid;
         struct common_audit_data ad;
         char *addrp;
@@ -4018,20 +4102,10 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
                         return err;
         }
 
-        if (selinux_policycap_netpeer) {
-                err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
-                if (err)
-                        return err;
-                err = avc_has_perm(sk_sid, peer_sid,
-                                   SECCLASS_PEER, PEER__RECV, &ad);
-                if (err)
-                        selinux_netlbl_err(skb, err, 0);
-        } else {
-                err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
-                if (err)
-                        return err;
-                err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
-        }
+        err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
+        if (err)
+                return err;
+        err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
 
         return err;
 }
@@ -4279,10 +4353,31 @@ static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
 }
 
+static int selinux_secmark_relabel_packet(u32 sid)
+{
+        const struct task_security_struct *__tsec;
+        u32 tsid;
+
+        __tsec = current_security();
+        tsid = __tsec->sid;
+
+        return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
+}
+
+static void selinux_secmark_refcount_inc(void)
+{
+        atomic_inc(&selinux_secmark_refcount);
+}
+
+static void selinux_secmark_refcount_dec(void)
+{
+        atomic_dec(&selinux_secmark_refcount);
+}
+
 static void selinux_req_classify_flow(const struct request_sock *req,
                                       struct flowi *fl)
 {
-        fl->secid = req->secid;
+        fl->flowi_secid = req->secid;
 }
 
 static int selinux_tun_dev_create(void)
@@ -4503,11 +4598,10 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
         if (selinux_secmark_enabled())
                 if (avc_has_perm(sksec->sid, skb->secmark,
                                  SECCLASS_PACKET, PACKET__SEND, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
-        if (selinux_policycap_netpeer)
-                if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
-                        return NF_DROP;
+        if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
+                return NF_DROP_ERR(-ECONNREFUSED);
 
         return NF_ACCEPT;
 }
@@ -4550,27 +4644,14 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
          * from the sending socket, otherwise use the kernel's sid */
         sk = skb->sk;
         if (sk == NULL) {
-                switch (family) {
-                case PF_INET:
-                        if (IPCB(skb)->flags & IPSKB_FORWARDED)
-                                secmark_perm = PACKET__FORWARD_OUT;
-                        else
-                                secmark_perm = PACKET__SEND;
-                        break;
-                case PF_INET6:
-                        if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
-                                secmark_perm = PACKET__FORWARD_OUT;
-                        else
-                                secmark_perm = PACKET__SEND;
-                        break;
-                default:
-                        return NF_DROP;
-                }
-                if (secmark_perm == PACKET__FORWARD_OUT) {
+                if (skb->skb_iif) {
+                        secmark_perm = PACKET__FORWARD_OUT;
                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
                                 return NF_DROP;
-                } else
+                } else {
+                        secmark_perm = PACKET__SEND;
                         peer_sid = SECINITSID_KERNEL;
+                }
         } else {
                 struct sk_security_struct *sksec = sk->sk_security;
                 peer_sid = sksec->sid;
@@ -4586,7 +4667,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
         if (secmark_active)
                 if (avc_has_perm(peer_sid, skb->secmark,
                                  SECCLASS_PACKET, secmark_perm, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
         if (peerlbl_active) {
                 u32 if_sid;
@@ -4596,13 +4677,13 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                         return NF_DROP;
                 if (avc_has_perm(peer_sid, if_sid,
                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
 
                 if (sel_netnode_sid(addrp, family, &node_sid))
                         return NF_DROP;
                 if (avc_has_perm(peer_sid, node_sid,
                                  SECCLASS_NODE, NODE__SENDTO, &ad))
-                        return NF_DROP;
+                        return NF_DROP_ERR(-ECONNREFUSED);
         }
 
         return NF_ACCEPT;
@@ -4645,6 +4726,7 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
 {
         int err;
         struct common_audit_data ad;
+        u32 sid;
 
         err = cap_netlink_recv(skb, capability);
         if (err)
@@ -4653,8 +4735,9 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
         COMMON_AUDIT_DATA_INIT(&ad, CAP);
         ad.u.cap = capability;
 
-        return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
-                            SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
+        security_task_getsecid(current, &sid);
+        return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
+                            CAP_TO_MASK(capability), &ad);
 }
 
 static int ipc_alloc_security(struct task_struct *task,
@@ -4824,7 +4907,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
                  * message queue this message will be stored in
                  */
                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
-                                             &msec->sid);
+                                             NULL, &msec->sid);
                 if (rc)
                         return rc;
         }
@@ -5378,7 +5461,6 @@ static struct security_operations selinux_ops = {
         .ptrace_traceme =               selinux_ptrace_traceme,
         .capget =                       selinux_capget,
         .capset =                       selinux_capset,
-        .sysctl =                       selinux_sysctl,
         .capable =                      selinux_capable,
         .quotactl =                     selinux_quotactl,
         .quota_on =                     selinux_quota_on,
@@ -5396,6 +5478,7 @@ static struct security_operations selinux_ops = {
         .sb_alloc_security =            selinux_sb_alloc_security,
         .sb_free_security =             selinux_sb_free_security,
         .sb_copy_data =                 selinux_sb_copy_data,
+        .sb_remount =                   selinux_sb_remount,
         .sb_kern_mount =                selinux_sb_kern_mount,
         .sb_show_options =              selinux_sb_show_options,
         .sb_statfs =                    selinux_sb_statfs,
@@ -5533,6 +5616,9 @@ static struct security_operations selinux_ops = {
         .inet_conn_request =            selinux_inet_conn_request,
         .inet_csk_clone =               selinux_inet_csk_clone,
         .inet_conn_established =        selinux_inet_conn_established,
+        .secmark_relabel_packet =       selinux_secmark_relabel_packet,
+        .secmark_refcount_inc =         selinux_secmark_refcount_inc,
+        .secmark_refcount_dec =         selinux_secmark_refcount_dec,
         .req_classify_flow =            selinux_req_classify_flow,
         .tun_dev_create =               selinux_tun_dev_create,
         .tun_dev_post_create =          selinux_tun_dev_post_create,
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index e94e82f73818..47fda963495d 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -15,7 +15,6 @@
 #include <linux/audit.h>
 #include <linux/lsm_audit.h>
 #include <linux/in6.h>
-#include <linux/path.h>
 #include <asm/system.h>
 #include "flask.h"
 #include "av_permissions.h"
@@ -42,7 +41,6 @@ struct sk_buff;
  */
 struct avc_cache_stats {
         unsigned int lookups;
-        unsigned int hits;
         unsigned int misses;
         unsigned int allocations;
         unsigned int reclaims;
@@ -55,11 +53,11 @@ struct avc_cache_stats {
 
 void __init avc_init(void);
 
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
                struct av_decision *avd,
                int result,
-               struct common_audit_data *a);
+              struct common_audit_data *a, unsigned flags);
 
 #define AVC_STRICT 1 /* Ignore permissive mode. */
 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
@@ -67,9 +65,17 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                          unsigned flags,
                          struct av_decision *avd);
 
-int avc_has_perm(u32 ssid, u32 tsid,
-                 u16 tclass, u32 requested,
-                 struct common_audit_data *auditdata);
+int avc_has_perm_flags(u32 ssid, u32 tsid,
+                       u16 tclass, u32 requested,
+                       struct common_audit_data *auditdata,
+                       unsigned);
+
+static inline int avc_has_perm(u32 ssid, u32 tsid,
+                               u16 tclass, u32 requested,
+                               struct common_audit_data *auditdata)
+{
+        return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
+}
 
 u32 avc_policy_seqno(void);
 
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index b4c9eb4bd6f9..b8c53723e09b 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -12,12 +12,16 @@
 #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
             "write", "associate", "unix_read", "unix_write"
 
+/*
+ * Note: The name for any socket class should be suffixed by "socket",
+ *       and doesn't contain more than one substr of "socket".
+ */
 struct security_class_mapping secclass_map[] = {
         { "security",
           { "compute_av", "compute_create", "compute_member",
             "check_context", "load_policy", "compute_relabel",
             "compute_user", "setenforce", "setbool", "setsecparam",
-            "setcheckreqprot", NULL } },
+            "setcheckreqprot", "read_policy", NULL } },
         { "process",
           { "fork", "transition", "sigchld", "sigkill",
             "sigstop", "signull", "signal", "ptrace", "getsched", "setsched",
@@ -132,8 +136,7 @@ struct security_class_mapping secclass_map[] = {
         { "appletalk_socket",
           { COMMON_SOCK_PERMS, NULL } },
         { "packet",
-          { "send", "recv", "relabelto", "flow_in", "flow_out",
-            "forward_in", "forward_out", NULL } },
+          { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
         { "key",
           { "view", "read", "write", "search", "link", "setattr", "create",
             NULL } },
@@ -142,7 +145,7 @@ struct security_class_mapping secclass_map[] = {
             "node_bind", "name_connect", NULL } },
         { "memprotect", { "mmap_zero", NULL } },
         { "peer", { "recv", NULL } },
-        { "capability2", { "mac_override", "mac_admin", NULL } },
+        { "capability2", { "mac_override", "mac_admin", "syslog", NULL } },
         { "kernel_service", { "use_as_override", "create_files_as", NULL } },
         { "tun_socket",
           { COMMON_SOCK_PERMS, NULL } },
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 1f7c2491d3dc..3ba4feba048a 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -8,7 +8,9 @@
 #ifndef _SELINUX_SECURITY_H_
 #define _SELINUX_SECURITY_H_
 
+#include <linux/dcache.h>
 #include <linux/magic.h>
+#include <linux/types.h>
 #include "flask.h"
 
 #define SECSID_NULL                     0x00000000 /* unspecified SID */
@@ -27,13 +29,15 @@
 #define POLICYDB_VERSION_POLCAP         22
 #define POLICYDB_VERSION_PERMISSIVE     23
 #define POLICYDB_VERSION_BOUNDARY       24
+#define POLICYDB_VERSION_FILENAME_TRANS 25
+#define POLICYDB_VERSION_ROLETRANS      26
 
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
 #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
 #define POLICYDB_VERSION_MAX    CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
 #else
-#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_BOUNDARY
+#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_ROLETRANS
 #endif
 
 /* Mask for just the mount related flags */
@@ -82,6 +86,8 @@ extern int selinux_policycap_openperm;
 int security_mls_enabled(void);
 
 int security_load_policy(void *data, size_t len);
+int security_read_policy(void **data, size_t *len);
+size_t security_policydb_len(void);
 
 int security_policycap_supported(unsigned int req_cap);
 
@@ -103,11 +109,11 @@ void security_compute_av(u32 ssid, u32 tsid,
 void security_compute_av_user(u32 ssid, u32 tsid,
                              u16 tclass, struct av_decision *avd);
 
-int security_transition_sid(u32 ssid, u32 tsid,
-                            u16 tclass, u32 *out_sid);
+int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
+                            const struct qstr *qstr, u32 *out_sid);
 
-int security_transition_sid_user(u32 ssid, u32 tsid,
-                                 u16 tclass, u32 *out_sid);
+int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
+                                 const char *objname, u32 *out_sid);
 
 int security_member_sid(u32 ssid, u32 tsid,
         u16 tclass, u32 *out_sid);
@@ -191,5 +197,25 @@ static inline int security_netlbl_sid_to_secattr(u32 sid,
 
 const char *security_get_initial_sid_context(u32 sid);
 
+/*
+ * status notifier using mmap interface
+ */
+extern struct page *selinux_kernel_status_page(void);
+
+#define SELINUX_KERNEL_STATUS_VERSION   1
+struct selinux_kernel_status {
+        u32     version;        /* version number of thie structure */
+        u32     sequence;       /* sequence number of seqlock logic */
+        u32     enforcing;      /* current setting of enforcing mode */
+        u32     policyload;     /* times of policy reloaded */
+        u32     deny_unknown;   /* current setting of deny_unknown */
+        /*
+         * The version > 0 supports above members.
+         */
+} __attribute__((packed));
+
+extern void selinux_status_update_setenforce(int enforcing);
+extern void selinux_status_update_policyload(int seqno);
+
 #endif /* _SELINUX_SECURITY_H_ */
 
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 13128f9a3e5a..b43813c9e049 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -19,7 +19,7 @@ void selinux_xfrm_state_free(struct xfrm_state *x);
 int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                        struct xfrm_policy *xp, struct flowi *fl);
+                        struct xfrm_policy *xp, const struct flowi *fl);
 
 /*
  * Extract the security blob from the sock (it's actually on the socket)
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index d6095d63d831..58cc481c93d5 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -104,22 +104,6 @@ static int sel_netif_insert(struct sel_netif *netif)
 }
 
 /**
- * sel_netif_free - Frees an interface entry
- * @p: the entry's RCU field
- *
- * Description:
- * This function is designed to be used as a callback to the call_rcu()
- * function so that memory allocated to a hash table interface entry can be
- * released safely.
- *
- */
-static void sel_netif_free(struct rcu_head *p)
-{
-        struct sel_netif *netif = container_of(p, struct sel_netif, rcu_head);
-        kfree(netif);
-}
-
-/**
  * sel_netif_destroy - Remove an interface record from the table
  * @netif: the existing interface record
  *
@@ -131,7 +115,7 @@ static void sel_netif_destroy(struct sel_netif *netif)
 {
         list_del_rcu(&netif->list);
         sel_netif_total--;
-        call_rcu(&netif->rcu_head, sel_netif_free);
+        kfree_rcu(netif, rcu_head);
 }
 
 /**
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 1c2fc46544bf..c3bf3ed07b06 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -151,7 +151,7 @@ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
  *
  * Description:
  * Called when the NetLabel state of a sk_security_struct needs to be reset.
- * The caller is responsibile for all the NetLabel sk_security_struct locking.
+ * The caller is responsible for all the NetLabel sk_security_struct locking.
  *
  */
 void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 65ebfe954f85..3618251d0fdb 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -141,6 +141,7 @@ static struct sel_netnode *sel_netnode_find(const void *addr, u16 family)
                 break;
         default:
                 BUG();
+                return NULL;
         }
 
         list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list)
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index 75ec0c6ebacd..8b02b2137da2 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -65,6 +65,8 @@ static struct nlmsg_perm nlmsg_route_perms[] =
         { RTM_NEWADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
         { RTM_DELADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
         { RTM_GETADDRLABEL,     NETLINK_ROUTE_SOCKET__NLMSG_READ  },
+        { RTM_GETDCB,           NETLINK_ROUTE_SOCKET__NLMSG_READ  },
+        { RTM_SETDCB,           NETLINK_ROUTE_SOCKET__NLMSG_WRITE },
 };
 
 static struct nlmsg_perm nlmsg_firewall_perms[] =
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 79a1bb635662..35459340019e 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -28,6 +28,8 @@
 #include <linux/percpu.h>
 #include <linux/audit.h>
 #include <linux/uaccess.h>
+#include <linux/kobject.h>
+#include <linux/ctype.h>
 
 /* selinuxfs pseudo filesystem for exporting the security policy API.
    Based on the proc code and the fs/nfsd/nfsctl.c code. */
@@ -68,6 +70,8 @@ static int *bool_pending_values;
 static struct dentry *class_dir;
 static unsigned long last_class_ino;
 
+static char policy_opened;
+
 /* global data for policy capabilities */
 static struct dentry *policycap_dir;
 
@@ -110,6 +114,8 @@ enum sel_inos {
         SEL_COMPAT_NET, /* whether to use old compat network packet controls */
         SEL_REJECT_UNKNOWN, /* export unknown reject handling to userspace */
         SEL_DENY_UNKNOWN, /* export unknown deny handling to userspace */
+        SEL_STATUS,     /* export current status using mmap() */
+        SEL_POLICY,     /* allow userspace to read the in kernel policy */
         SEL_INO_NEXT,   /* The next inode number to use */
 };
 
@@ -137,19 +143,24 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
                                  size_t count, loff_t *ppos)
 
 {
-        char *page;
+        char *page = NULL;
         ssize_t length;
         int new_value;
 
+        length = -ENOMEM;
         if (count >= PAGE_SIZE)
-                return -ENOMEM;
-        if (*ppos != 0) {
-                /* No partial writes. */
-                return -EINVAL;
-        }
+                goto out;
+
+        /* No partial writes. */
+        length = EINVAL;
+        if (*ppos != 0)
+                goto out;
+
+        length = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
         if (!page)
-                return -ENOMEM;
+                goto out;
+
         length = -EFAULT;
         if (copy_from_user(page, buf, count))
                 goto out;
@@ -171,6 +182,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
                 if (selinux_enforcing)
                         avc_ss_reset(0);
                 selnl_notify_setenforce(selinux_enforcing);
+                selinux_status_update_setenforce(selinux_enforcing);
         }
         length = count;
 out:
@@ -205,25 +217,83 @@ static const struct file_operations sel_handle_unknown_ops = {
         .llseek         = generic_file_llseek,
 };
 
+static int sel_open_handle_status(struct inode *inode, struct file *filp)
+{
+        struct page    *status = selinux_kernel_status_page();
+
+        if (!status)
+                return -ENOMEM;
+
+        filp->private_data = status;
+
+        return 0;
+}
+
+static ssize_t sel_read_handle_status(struct file *filp, char __user *buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct page    *status = filp->private_data;
+
+        BUG_ON(!status);
+
+        return simple_read_from_buffer(buf, count, ppos,
+                                       page_address(status),
+                                       sizeof(struct selinux_kernel_status));
+}
+
+static int sel_mmap_handle_status(struct file *filp,
+                                  struct vm_area_struct *vma)
+{
+        struct page    *status = filp->private_data;
+        unsigned long   size = vma->vm_end - vma->vm_start;
+
+        BUG_ON(!status);
+
+        /* only allows one page from the head */
+        if (vma->vm_pgoff > 0 || size != PAGE_SIZE)
+                return -EIO;
+        /* disallow writable mapping */
+        if (vma->vm_flags & VM_WRITE)
+                return -EPERM;
+        /* disallow mprotect() turns it into writable */
+        vma->vm_flags &= ~VM_MAYWRITE;
+
+        return remap_pfn_range(vma, vma->vm_start,
+                               page_to_pfn(status),
+                               size, vma->vm_page_prot);
+}
+
+static const struct file_operations sel_handle_status_ops = {
+        .open           = sel_open_handle_status,
+        .read           = sel_read_handle_status,
+        .mmap           = sel_mmap_handle_status,
+        .llseek         = generic_file_llseek,
+};
+
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 static ssize_t sel_write_disable(struct file *file, const char __user *buf,
                                  size_t count, loff_t *ppos)
 
 {
-        char *page;
+        char *page = NULL;
         ssize_t length;
         int new_value;
         extern int selinux_disable(void);
 
+        length = -ENOMEM;
         if (count >= PAGE_SIZE)
-                return -ENOMEM;
-        if (*ppos != 0) {
-                /* No partial writes. */
-                return -EINVAL;
-        }
+                goto out;
+
+        /* No partial writes. */
+        length = -EINVAL;
+        if (*ppos != 0)
+                goto out;
+
+        length = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
         if (!page)
-                return -ENOMEM;
+                goto out;
+
         length = -EFAULT;
         if (copy_from_user(page, buf, count))
                 goto out;
@@ -234,7 +304,7 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf,
 
         if (new_value) {
                 length = selinux_disable();
-                if (length < 0)
+                if (length)
                         goto out;
                 audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS,
                         "selinux=0 auid=%u ses=%u",
@@ -296,11 +366,145 @@ static const struct file_operations sel_mls_ops = {
         .llseek         = generic_file_llseek,
 };
 
+struct policy_load_memory {
+        size_t len;
+        void *data;
+};
+
+static int sel_open_policy(struct inode *inode, struct file *filp)
+{
+        struct policy_load_memory *plm = NULL;
+        int rc;
+
+        BUG_ON(filp->private_data);
+
+        mutex_lock(&sel_mutex);
+
+        rc = task_has_security(current, SECURITY__READ_POLICY);
+        if (rc)
+                goto err;
+
+        rc = -EBUSY;
+        if (policy_opened)
+                goto err;
+
+        rc = -ENOMEM;
+        plm = kzalloc(sizeof(*plm), GFP_KERNEL);
+        if (!plm)
+                goto err;
+
+        if (i_size_read(inode) != security_policydb_len()) {
+                mutex_lock(&inode->i_mutex);
+                i_size_write(inode, security_policydb_len());
+                mutex_unlock(&inode->i_mutex);
+        }
+
+        rc = security_read_policy(&plm->data, &plm->len);
+        if (rc)
+                goto err;
+
+        policy_opened = 1;
+
+        filp->private_data = plm;
+
+        mutex_unlock(&sel_mutex);
+
+        return 0;
+err:
+        mutex_unlock(&sel_mutex);
+
+        if (plm)
+                vfree(plm->data);
+        kfree(plm);
+        return rc;
+}
+
+static int sel_release_policy(struct inode *inode, struct file *filp)
+{
+        struct policy_load_memory *plm = filp->private_data;
+
+        BUG_ON(!plm);
+
+        policy_opened = 0;
+
+        vfree(plm->data);
+        kfree(plm);
+
+        return 0;
+}
+
+static ssize_t sel_read_policy(struct file *filp, char __user *buf,
+                               size_t count, loff_t *ppos)
+{
+        struct policy_load_memory *plm = filp->private_data;
+        int ret;
+
+        mutex_lock(&sel_mutex);
+
+        ret = task_has_security(current, SECURITY__READ_POLICY);
+        if (ret)
+                goto out;
+
+        ret = simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
+out:
+        mutex_unlock(&sel_mutex);
+        return ret;
+}
+
+static int sel_mmap_policy_fault(struct vm_area_struct *vma,
+                                 struct vm_fault *vmf)
+{
+        struct policy_load_memory *plm = vma->vm_file->private_data;
+        unsigned long offset;
+        struct page *page;
+
+        if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE))
+                return VM_FAULT_SIGBUS;
+
+        offset = vmf->pgoff << PAGE_SHIFT;
+        if (offset >= roundup(plm->len, PAGE_SIZE))
+                return VM_FAULT_SIGBUS;
+
+        page = vmalloc_to_page(plm->data + offset);
+        get_page(page);
+
+        vmf->page = page;
+
+        return 0;
+}
+
+static struct vm_operations_struct sel_mmap_policy_ops = {
+        .fault = sel_mmap_policy_fault,
+        .page_mkwrite = sel_mmap_policy_fault,
+};
+
+int sel_mmap_policy(struct file *filp, struct vm_area_struct *vma)
+{
+        if (vma->vm_flags & VM_SHARED) {
+                /* do not allow mprotect to make mapping writable */
+                vma->vm_flags &= ~VM_MAYWRITE;
+
+                if (vma->vm_flags & VM_WRITE)
+                        return -EACCES;
+        }
+
+        vma->vm_flags |= VM_RESERVED;
+        vma->vm_ops = &sel_mmap_policy_ops;
+
+        return 0;
+}
+
+static const struct file_operations sel_policy_ops = {
+        .open           = sel_open_policy,
+        .read           = sel_read_policy,
+        .mmap           = sel_mmap_policy,
+        .release        = sel_release_policy,
+};
+
 static ssize_t sel_write_load(struct file *file, const char __user *buf,
                               size_t count, loff_t *ppos)
 
 {
-        int ret;
         ssize_t length;
         void *data = NULL;
 
@@ -310,17 +514,19 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
         if (length)
                 goto out;
 
-        if (*ppos != 0) {
-                /* No partial writes. */
-                length = -EINVAL;
+        /* No partial writes. */
+        length = -EINVAL;
+        if (*ppos != 0)
                 goto out;
-        }
 
-        if ((count > 64 * 1024 * 1024)
-            || (data = vmalloc(count)) == NULL) {
-                length = -ENOMEM;
+        length = -EFBIG;
+        if (count > 64 * 1024 * 1024)
+                goto out;
+
+        length = -ENOMEM;
+        data = vmalloc(count);
+        if (!data)
                 goto out;
-        }
 
         length = -EFAULT;
         if (copy_from_user(data, buf, count) != 0)
@@ -330,23 +536,19 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
         if (length)
                 goto out;
 
-        ret = sel_make_bools();
-        if (ret) {
-                length = ret;
+        length = sel_make_bools();
+        if (length)
                 goto out1;
-        }
 
-        ret = sel_make_classes();
-        if (ret) {
-                length = ret;
+        length = sel_make_classes();
+        if (length)
                 goto out1;
-        }
 
-        ret = sel_make_policycap();
-        if (ret)
-                length = ret;
-        else
-                length = count;
+        length = sel_make_policycap();
+        if (length)
+                goto out1;
+
+        length = count;
 
 out1:
         audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
@@ -366,26 +568,26 @@ static const struct file_operations sel_load_ops = {
 
 static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
 {
-        char *canon;
+        char *canon = NULL;
         u32 sid, len;
         ssize_t length;
 
         length = task_has_security(current, SECURITY__CHECK_CONTEXT);
         if (length)
-                return length;
+                goto out;
 
         length = security_context_to_sid(buf, size, &sid);
-        if (length < 0)
-                return length;
+        if (length)
+                goto out;
 
         length = security_sid_to_context(sid, &canon, &len);
-        if (length < 0)
-                return length;
+        if (length)
+                goto out;
 
+        length = -ERANGE;
         if (len > SIMPLE_TRANSACTION_LIMIT) {
                 printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "
                         "payload max\n", __func__, len);
-                length = -ERANGE;
                 goto out;
         }
 
@@ -409,23 +611,28 @@ static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
 static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
                                       size_t count, loff_t *ppos)
 {
-        char *page;
+        char *page = NULL;
         ssize_t length;
         unsigned int new_value;
 
         length = task_has_security(current, SECURITY__SETCHECKREQPROT);
         if (length)
-                return length;
+                goto out;
 
+        length = -ENOMEM;
         if (count >= PAGE_SIZE)
-                return -ENOMEM;
-        if (*ppos != 0) {
-                /* No partial writes. */
-                return -EINVAL;
-        }
+                goto out;
+
+        /* No partial writes. */
+        length = -EINVAL;
+        if (*ppos != 0)
+                goto out;
+
+        length = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
         if (!page)
-                return -ENOMEM;
+                goto out;
+
         length = -EFAULT;
         if (copy_from_user(page, buf, count))
                 goto out;
@@ -500,7 +707,7 @@ static const struct file_operations transaction_ops = {
 
 static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
 {
-        char *scon, *tcon;
+        char *scon = NULL, *tcon = NULL;
         u32 ssid, tsid;
         u16 tclass;
         struct av_decision avd;
@@ -508,27 +715,29 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
 
         length = task_has_security(current, SECURITY__COMPUTE_AV);
         if (length)
-                return length;
+                goto out;
 
         length = -ENOMEM;
         scon = kzalloc(size + 1, GFP_KERNEL);
         if (!scon)
-                return length;
+                goto out;
 
+        length = -ENOMEM;
         tcon = kzalloc(size + 1, GFP_KERNEL);
         if (!tcon)
                 goto out;
 
         length = -EINVAL;
         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
-                goto out2;
+                goto out;
 
         length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
+
         length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         security_compute_av_user(ssid, tsid, tclass, &avd);
 
@@ -537,133 +746,177 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
                           avd.allowed, 0xffffffff,
                           avd.auditallow, avd.auditdeny,
                           avd.seqno, avd.flags);
-out2:
-        kfree(tcon);
 out:
+        kfree(tcon);
         kfree(scon);
         return length;
 }
 
+static inline int hexcode_to_int(int code) {
+        if (code == '\0' || !isxdigit(code))
+                return -1;
+        if (isdigit(code))
+                return code - '0';
+        return tolower(code) - 'a' + 10;
+}
+
 static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
 {
-        char *scon, *tcon;
+        char *scon = NULL, *tcon = NULL;
+        char *namebuf = NULL, *objname = NULL;
         u32 ssid, tsid, newsid;
         u16 tclass;
         ssize_t length;
-        char *newcon;
+        char *newcon = NULL;
         u32 len;
+        int nargs;
 
         length = task_has_security(current, SECURITY__COMPUTE_CREATE);
         if (length)
-                return length;
+                goto out;
 
         length = -ENOMEM;
         scon = kzalloc(size + 1, GFP_KERNEL);
         if (!scon)
-                return length;
+                goto out;
 
+        length = -ENOMEM;
         tcon = kzalloc(size + 1, GFP_KERNEL);
         if (!tcon)
                 goto out;
 
+        length = -ENOMEM;
+        namebuf = kzalloc(size + 1, GFP_KERNEL);
+        if (!namebuf)
+                goto out;
+
         length = -EINVAL;
-        if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
-                goto out2;
+        nargs = sscanf(buf, "%s %s %hu %s", scon, tcon, &tclass, namebuf);
+        if (nargs < 3 || nargs > 4)
+                goto out;
+        if (nargs == 4) {
+                /*
+                 * If and when the name of new object to be queried contains
+                 * either whitespace or multibyte characters, they shall be
+                 * encoded based on the percentage-encoding rule.
+                 * If not encoded, the sscanf logic picks up only left-half
+                 * of the supplied name; splitted by a whitespace unexpectedly.
+                 */
+                char   *r, *w;
+                int     c1, c2;
+
+                r = w = namebuf;
+                do {
+                        c1 = *r++;
+                        if (c1 == '+')
+                                c1 = ' ';
+                        else if (c1 == '%') {
+                                if ((c1 = hexcode_to_int(*r++)) < 0)
+                                        goto out;
+                                if ((c2 = hexcode_to_int(*r++)) < 0)
+                                        goto out;
+                                c1 = (c1 << 4) | c2;
+                        }
+                        *w++ = c1;
+                } while (c1 != '\0');
+
+                objname = namebuf;
+        }
 
         length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
+
         length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
-        length = security_transition_sid_user(ssid, tsid, tclass, &newsid);
-        if (length < 0)
-                goto out2;
+        length = security_transition_sid_user(ssid, tsid, tclass,
+                                              objname, &newsid);
+        if (length)
+                goto out;
 
         length = security_sid_to_context(newsid, &newcon, &len);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
+        length = -ERANGE;
         if (len > SIMPLE_TRANSACTION_LIMIT) {
                 printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "
                         "payload max\n", __func__, len);
-                length = -ERANGE;
-                goto out3;
+                goto out;
         }
 
         memcpy(buf, newcon, len);
         length = len;
-out3:
+out:
         kfree(newcon);
-out2:
+        kfree(namebuf);
         kfree(tcon);
-out:
         kfree(scon);
         return length;
 }
 
 static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
 {
-        char *scon, *tcon;
+        char *scon = NULL, *tcon = NULL;
         u32 ssid, tsid, newsid;
         u16 tclass;
         ssize_t length;
-        char *newcon;
+        char *newcon = NULL;
         u32 len;
 
         length = task_has_security(current, SECURITY__COMPUTE_RELABEL);
         if (length)
-                return length;
+                goto out;
 
         length = -ENOMEM;
         scon = kzalloc(size + 1, GFP_KERNEL);
         if (!scon)
-                return length;
+                goto out;
 
+        length = -ENOMEM;
         tcon = kzalloc(size + 1, GFP_KERNEL);
         if (!tcon)
                 goto out;
 
         length = -EINVAL;
         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
-                goto out2;
+                goto out;
 
         length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
+
         length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         length = security_change_sid(ssid, tsid, tclass, &newsid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         length = security_sid_to_context(newsid, &newcon, &len);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
-        if (len > SIMPLE_TRANSACTION_LIMIT) {
-                length = -ERANGE;
-                goto out3;
-        }
+        length = -ERANGE;
+        if (len > SIMPLE_TRANSACTION_LIMIT)
+                goto out;
 
         memcpy(buf, newcon, len);
         length = len;
-out3:
+out:
         kfree(newcon);
-out2:
         kfree(tcon);
-out:
         kfree(scon);
         return length;
 }
 
 static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
 {
-        char *con, *user, *ptr;
-        u32 sid, *sids;
+        char *con = NULL, *user = NULL, *ptr;
+        u32 sid, *sids = NULL;
         ssize_t length;
         char *newcon;
         int i, rc;
@@ -671,28 +924,29 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
 
         length = task_has_security(current, SECURITY__COMPUTE_USER);
         if (length)
-                return length;
+                goto out;
 
         length = -ENOMEM;
         con = kzalloc(size + 1, GFP_KERNEL);
         if (!con)
-                return length;
+                goto out;
 
+        length = -ENOMEM;
         user = kzalloc(size + 1, GFP_KERNEL);
         if (!user)
                 goto out;
 
         length = -EINVAL;
         if (sscanf(buf, "%s %s", con, user) != 2)
-                goto out2;
+                goto out;
 
         length = security_context_to_sid(con, strlen(con) + 1, &sid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         length = security_get_user_sids(sid, user, &sids, &nsids);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         length = sprintf(buf, "%u", nsids) + 1;
         ptr = buf + length;
@@ -700,82 +954,80 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
                 rc = security_sid_to_context(sids[i], &newcon, &len);
                 if (rc) {
                         length = rc;
-                        goto out3;
+                        goto out;
                 }
                 if ((length + len) >= SIMPLE_TRANSACTION_LIMIT) {
                         kfree(newcon);
                         length = -ERANGE;
-                        goto out3;
+                        goto out;
                 }
                 memcpy(ptr, newcon, len);
                 kfree(newcon);
                 ptr += len;
                 length += len;
         }
-out3:
+out:
         kfree(sids);
-out2:
         kfree(user);
-out:
         kfree(con);
         return length;
 }
 
 static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
 {
-        char *scon, *tcon;
+        char *scon = NULL, *tcon = NULL;
         u32 ssid, tsid, newsid;
         u16 tclass;
         ssize_t length;
-        char *newcon;
+        char *newcon = NULL;
         u32 len;
 
         length = task_has_security(current, SECURITY__COMPUTE_MEMBER);
         if (length)
-                return length;
+                goto out;
 
         length = -ENOMEM;
         scon = kzalloc(size + 1, GFP_KERNEL);
         if (!scon)
-                return length;
+                goto out;
 
+        length = -ENOMEM;
         tcon = kzalloc(size + 1, GFP_KERNEL);
         if (!tcon)
                 goto out;
 
         length = -EINVAL;
         if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
-                goto out2;
+                goto out;
 
         length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
+
         length = security_context_to_sid(tcon, strlen(tcon) + 1, &tsid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         length = security_member_sid(ssid, tsid, tclass, &newsid);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
         length = security_sid_to_context(newsid, &newcon, &len);
-        if (length < 0)
-                goto out2;
+        if (length)
+                goto out;
 
+        length = -ERANGE;
         if (len > SIMPLE_TRANSACTION_LIMIT) {
                 printk(KERN_ERR "SELinux: %s:  context size (%u) exceeds "
                         "payload max\n", __func__, len);
-                length = -ERANGE;
-                goto out3;
+                goto out;
         }
 
         memcpy(buf, newcon, len);
         length = len;
-out3:
+out:
         kfree(newcon);
-out2:
         kfree(tcon);
-out:
         kfree(scon);
         return length;
 }
@@ -804,16 +1056,14 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
 
         mutex_lock(&sel_mutex);
 
-        if (index >= bool_num || strcmp(name, bool_pending_names[index])) {
-                ret = -EINVAL;
+        ret = -EINVAL;
+        if (index >= bool_num || strcmp(name, bool_pending_names[index]))
                 goto out;
-        }
 
+        ret = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
-        if (!page) {
-                ret = -ENOMEM;
+        if (!page)
                 goto out;
-        }
 
         cur_enforcing = security_get_bool_value(index);
         if (cur_enforcing < 0) {
@@ -825,8 +1075,7 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf,
         ret = simple_read_from_buffer(buf, count, ppos, page, length);
 out:
         mutex_unlock(&sel_mutex);
-        if (page)
-                free_page((unsigned long)page);
+        free_page((unsigned long)page);
         return ret;
 }
 
@@ -846,26 +1095,23 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
         if (length)
                 goto out;
 
-        if (index >= bool_num || strcmp(name, bool_pending_names[index])) {
-                length = -EINVAL;
+        length = -EINVAL;
+        if (index >= bool_num || strcmp(name, bool_pending_names[index]))
                 goto out;
-        }
 
-        if (count >= PAGE_SIZE) {
-                length = -ENOMEM;
+        length = -ENOMEM;
+        if (count >= PAGE_SIZE)
                 goto out;
-        }
 
-        if (*ppos != 0) {
-                /* No partial writes. */
-                length = -EINVAL;
+        /* No partial writes. */
+        length = -EINVAL;
+        if (*ppos != 0)
                 goto out;
-        }
+
+        length = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
-        if (!page) {
-                length = -ENOMEM;
+        if (!page)
                 goto out;
-        }
 
         length = -EFAULT;
         if (copy_from_user(page, buf, count))
@@ -883,8 +1129,7 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
 
 out:
         mutex_unlock(&sel_mutex);
-        if (page)
-                free_page((unsigned long) page);
+        free_page((unsigned long) page);
         return length;
 }
 
@@ -908,19 +1153,19 @@ static ssize_t sel_commit_bools_write(struct file *filep,
         if (length)
                 goto out;
 
-        if (count >= PAGE_SIZE) {
-                length = -ENOMEM;
+        length = -ENOMEM;
+        if (count >= PAGE_SIZE)
                 goto out;
-        }
-        if (*ppos != 0) {
-                /* No partial writes. */
+
+        /* No partial writes. */
+        length = -EINVAL;
+        if (*ppos != 0)
                 goto out;
-        }
+
+        length = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
-        if (!page) {
-                length = -ENOMEM;
+        if (!page)
                 goto out;
-        }
 
         length = -EFAULT;
         if (copy_from_user(page, buf, count))
@@ -930,15 +1175,16 @@ static ssize_t sel_commit_bools_write(struct file *filep,
         if (sscanf(page, "%d", &new_value) != 1)
                 goto out;
 
+        length = 0;
         if (new_value && bool_pending_values)
-                security_set_bools(bool_num, bool_pending_values);
+                length = security_set_bools(bool_num, bool_pending_values);
 
-        length = count;
+        if (!length)
+                length = count;
 
 out:
         mutex_unlock(&sel_mutex);
-        if (page)
-                free_page((unsigned long) page);
+        free_page((unsigned long) page);
         return length;
 }
 
@@ -951,31 +1197,35 @@ static void sel_remove_entries(struct dentry *de)
 {
         struct list_head *node;
 
-        spin_lock(&dcache_lock);
+        spin_lock(&de->d_lock);
         node = de->d_subdirs.next;
         while (node != &de->d_subdirs) {
                 struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
+
+                spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
                 list_del_init(node);
 
                 if (d->d_inode) {
-                        d = dget_locked(d);
-                        spin_unlock(&dcache_lock);
+                        dget_dlock(d);
+                        spin_unlock(&de->d_lock);
+                        spin_unlock(&d->d_lock);
                         d_delete(d);
                         simple_unlink(de->d_inode, d);
                         dput(d);
-                        spin_lock(&dcache_lock);
-                }
+                        spin_lock(&de->d_lock);
+                } else
+                        spin_unlock(&d->d_lock);
                 node = de->d_subdirs.next;
         }
 
-        spin_unlock(&dcache_lock);
+        spin_unlock(&de->d_lock);
 }
 
 #define BOOL_DIR_NAME "booleans"
 
 static int sel_make_bools(void)
 {
-        int i, ret = 0;
+        int i, ret;
         ssize_t len;
         struct dentry *dentry = NULL;
         struct dentry *dir = bool_dir;
@@ -996,38 +1246,40 @@ static int sel_make_bools(void)
 
         sel_remove_entries(dir);
 
+        ret = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
         if (!page)
-                return -ENOMEM;
+                goto out;
 
         ret = security_get_bools(&num, &names, &values);
-        if (ret != 0)
+        if (ret)
                 goto out;
 
         for (i = 0; i < num; i++) {
+                ret = -ENOMEM;
                 dentry = d_alloc_name(dir, names[i]);
-                if (!dentry) {
-                        ret = -ENOMEM;
-                        goto err;
-                }
+                if (!dentry)
+                        goto out;
+
+                ret = -ENOMEM;
                 inode = sel_make_inode(dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
-                if (!inode) {
-                        ret = -ENOMEM;
-                        goto err;
-                }
+                if (!inode)
+                        goto out;
 
+                ret = -EINVAL;
                 len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
-                if (len < 0) {
-                        ret = -EINVAL;
-                        goto err;
-                } else if (len >= PAGE_SIZE) {
-                        ret = -ENAMETOOLONG;
-                        goto err;
-                }
+                if (len < 0)
+                        goto out;
+
+                ret = -ENAMETOOLONG;
+                if (len >= PAGE_SIZE)
+                        goto out;
+
                 isec = (struct inode_security_struct *)inode->i_security;
                 ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
                 if (ret)
-                        goto err;
+                        goto out;
+
                 isec->sid = sid;
                 isec->initialized = 1;
                 inode->i_fop = &sel_bool_ops;
@@ -1037,10 +1289,12 @@ static int sel_make_bools(void)
         bool_num = num;
         bool_pending_names = names;
         bool_pending_values = values;
+
+        free_page((unsigned long)page);
+        return 0;
 out:
         free_page((unsigned long)page);
-        return ret;
-err:
+
         if (names) {
                 for (i = 0; i < num; i++)
                         kfree(names[i]);
@@ -1048,8 +1302,8 @@ err:
         }
         kfree(values);
         sel_remove_entries(dir);
-        ret = -ENOMEM;
-        goto out;
+
+        return ret;
 }
 
 #define NULL_FILE_NAME "null"
@@ -1071,47 +1325,41 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
                                              size_t count, loff_t *ppos)
 
 {
-        char *page;
+        char *page = NULL;
         ssize_t ret;
         int new_value;
 
-        if (count >= PAGE_SIZE) {
-                ret = -ENOMEM;
+        ret = task_has_security(current, SECURITY__SETSECPARAM);
+        if (ret)
                 goto out;
-        }
 
-        if (*ppos != 0) {
-                /* No partial writes. */
-                ret = -EINVAL;
+        ret = -ENOMEM;
+        if (count >= PAGE_SIZE)
+                goto out;
+
+        /* No partial writes. */
+        ret = -EINVAL;
+        if (*ppos != 0)
                 goto out;
-        }
 
+        ret = -ENOMEM;
         page = (char *)get_zeroed_page(GFP_KERNEL);
-        if (!page) {
-                ret = -ENOMEM;
+        if (!page)
                 goto out;
-        }
 
-        if (copy_from_user(page, buf, count)) {
-                ret = -EFAULT;
-                goto out_free;
-        }
+        ret = -EFAULT;
+        if (copy_from_user(page, buf, count))
+                goto out;
 
-        if (sscanf(page, "%u", &new_value) != 1) {
-                ret = -EINVAL;
+        ret = -EINVAL;
+        if (sscanf(page, "%u", &new_value) != 1)
                 goto out;
-        }
 
-        if (new_value != avc_cache_threshold) {
-                ret = task_has_security(current, SECURITY__SETSECPARAM);
-                if (ret)
-                        goto out_free;
-                avc_cache_threshold = new_value;
-        }
+        avc_cache_threshold = new_value;
+
         ret = count;
-out_free:
-        free_page((unsigned long)page);
 out:
+        free_page((unsigned long)page);
         return ret;
 }
 
@@ -1119,19 +1367,18 @@ static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
                                        size_t count, loff_t *ppos)
 {
         char *page;
-        ssize_t ret = 0;
+        ssize_t length;
 
         page = (char *)__get_free_page(GFP_KERNEL);
-        if (!page) {
-                ret = -ENOMEM;
-                goto out;
-        }
-        ret = avc_get_hash_stats(page);
-        if (ret >= 0)
-                ret = simple_read_from_buffer(buf, count, ppos, page, ret);
+        if (!page)
+                return -ENOMEM;
+
+        length = avc_get_hash_stats(page);
+        if (length >= 0)
+                length = simple_read_from_buffer(buf, count, ppos, page, length);
         free_page((unsigned long)page);
-out:
-        return ret;
+
+        return length;
 }
 
 static const struct file_operations sel_avc_cache_threshold_ops = {
@@ -1181,10 +1428,14 @@ static int sel_avc_stats_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "lookups hits misses allocations reclaims "
                            "frees\n");
-        else
-                seq_printf(seq, "%u %u %u %u %u %u\n", st->lookups,
-                           st->hits, st->misses, st->allocations,
+        else {
+                unsigned int lookups = st->lookups;
+                unsigned int misses = st->misses;
+                unsigned int hits = lookups - misses;
+                seq_printf(seq, "%u %u %u %u %u %u\n", lookups,
+                           hits, misses, st->allocations,
                            st->reclaims, st->frees);
+        }
         return 0;
 }
 
@@ -1213,7 +1464,7 @@ static const struct file_operations sel_avc_cache_stats_ops = {
 
 static int sel_make_avc_files(struct dentry *dir)
 {
-        int i, ret = 0;
+        int i;
         static struct tree_descr files[] = {
                 { "cache_threshold",
                   &sel_avc_cache_threshold_ops, S_IRUGO|S_IWUSR },
@@ -1228,22 +1479,19 @@ static int sel_make_avc_files(struct dentry *dir)
                 struct dentry *dentry;
 
                 dentry = d_alloc_name(dir, files[i].name);
-                if (!dentry) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!dentry)
+                        return -ENOMEM;
 
                 inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
-                if (!inode) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!inode)
+                        return -ENOMEM;
+
                 inode->i_fop = files[i].ops;
                 inode->i_ino = ++sel_last_ino;
                 d_add(dentry, inode);
         }
-out:
-        return ret;
+
+        return 0;
 }
 
 static ssize_t sel_read_initcon(struct file *file, char __user *buf,
@@ -1257,7 +1505,7 @@ static ssize_t sel_read_initcon(struct file *file, char __user *buf,
         inode = file->f_path.dentry->d_inode;
         sid = inode->i_ino&SEL_INO_MASK;
         ret = security_sid_to_context(sid, &con, &len);
-        if (ret < 0)
+        if (ret)
                 return ret;
 
         ret = simple_read_from_buffer(buf, count, ppos, con, len);
@@ -1272,28 +1520,25 @@ static const struct file_operations sel_initcon_ops = {
 
 static int sel_make_initcon_files(struct dentry *dir)
 {
-        int i, ret = 0;
+        int i;
 
         for (i = 1; i <= SECINITSID_NUM; i++) {
                 struct inode *inode;
                 struct dentry *dentry;
                 dentry = d_alloc_name(dir, security_get_initial_sid_context(i));
-                if (!dentry) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!dentry)
+                        return -ENOMEM;
 
                 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
-                if (!inode) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
+                if (!inode)
+                        return -ENOMEM;
+
                 inode->i_fop = &sel_initcon_ops;
                 inode->i_ino = i|SEL_INITCON_INO_OFFSET;
                 d_add(dentry, inode);
         }
-out:
-        return ret;
+
+        return 0;
 }
 
 static inline unsigned int sel_div(unsigned long a, unsigned long b)
@@ -1329,15 +1574,13 @@ static ssize_t sel_read_class(struct file *file, char __user *buf,
         unsigned long ino = file->f_path.dentry->d_inode->i_ino;
 
         page = (char *)__get_free_page(GFP_KERNEL);
-        if (!page) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!page)
+                return -ENOMEM;
 
         len = snprintf(page, PAGE_SIZE, "%d", sel_ino_to_class(ino));
         rc = simple_read_from_buffer(buf, count, ppos, page, len);
         free_page((unsigned long)page);
-out:
+
         return rc;
 }
 
@@ -1354,15 +1597,13 @@ static ssize_t sel_read_perm(struct file *file, char __user *buf,
         unsigned long ino = file->f_path.dentry->d_inode->i_ino;
 
         page = (char *)__get_free_page(GFP_KERNEL);
-        if (!page) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!page)
+                return -ENOMEM;
 
         len = snprintf(page, PAGE_SIZE, "%d", sel_ino_to_perm(ino));
         rc = simple_read_from_buffer(buf, count, ppos, page, len);
         free_page((unsigned long)page);
-out:
+
         return rc;
 }
 
@@ -1393,39 +1634,37 @@ static const struct file_operations sel_policycap_ops = {
 static int sel_make_perm_files(char *objclass, int classvalue,
                                 struct dentry *dir)
 {
-        int i, rc = 0, nperms;
+        int i, rc, nperms;
         char **perms;
 
         rc = security_get_permissions(objclass, &perms, &nperms);
         if (rc)
-                goto out;
+                return rc;
 
         for (i = 0; i < nperms; i++) {
                 struct inode *inode;
                 struct dentry *dentry;
 
+                rc = -ENOMEM;
                 dentry = d_alloc_name(dir, perms[i]);
-                if (!dentry) {
-                        rc = -ENOMEM;
-                        goto out1;
-                }
+                if (!dentry)
+                        goto out;
 
+                rc = -ENOMEM;
                 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
-                if (!inode) {
-                        rc = -ENOMEM;
-                        goto out1;
-                }
+                if (!inode)
+                        goto out;
+
                 inode->i_fop = &sel_perm_ops;
                 /* i+1 since perm values are 1-indexed */
                 inode->i_ino = sel_perm_to_ino(classvalue, i + 1);
                 d_add(dentry, inode);
         }
-
-out1:
+        rc = 0;
+out:
         for (i = 0; i < nperms; i++)
                 kfree(perms[i]);
         kfree(perms);
-out:
         return rc;
 }
 
@@ -1437,34 +1676,27 @@ static int sel_make_class_dir_entries(char *classname, int index,
         int rc;
 
         dentry = d_alloc_name(dir, "index");
-        if (!dentry) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!dentry)
+                return -ENOMEM;
 
         inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
-        if (!inode) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!inode)
+                return -ENOMEM;
 
         inode->i_fop = &sel_class_ops;
         inode->i_ino = sel_class_to_ino(index);
         d_add(dentry, inode);
 
         dentry = d_alloc_name(dir, "perms");
-        if (!dentry) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!dentry)
+                return -ENOMEM;
 
         rc = sel_make_dir(dir->d_inode, dentry, &last_class_ino);
         if (rc)
-                goto out;
+                return rc;
 
         rc = sel_make_perm_files(classname, index, dentry);
 
-out:
         return rc;
 }
 
@@ -1494,15 +1726,15 @@ static void sel_remove_classes(void)
 
 static int sel_make_classes(void)
 {
-        int rc = 0, nclasses, i;
+        int rc, nclasses, i;
         char **classes;
 
         /* delete any existing entries */
         sel_remove_classes();
 
         rc = security_get_classes(&classes, &nclasses);
-        if (rc < 0)
-                goto out;
+        if (rc)
+                return rc;
 
         /* +2 since classes are 1-indexed */
         last_class_ino = sel_class_to_ino(nclasses + 2);
@@ -1510,29 +1742,27 @@ static int sel_make_classes(void)
         for (i = 0; i < nclasses; i++) {
                 struct dentry *class_name_dir;
 
+                rc = -ENOMEM;
                 class_name_dir = d_alloc_name(class_dir, classes[i]);
-                if (!class_name_dir) {
-                        rc = -ENOMEM;
-                        goto out1;
-                }
+                if (!class_name_dir)
+                        goto out;
 
                 rc = sel_make_dir(class_dir->d_inode, class_name_dir,
                                 &last_class_ino);
                 if (rc)
-                        goto out1;
+                        goto out;
 
                 /* i+1 since class values are 1-indexed */
                 rc = sel_make_class_dir_entries(classes[i], i + 1,
                                 class_name_dir);
                 if (rc)
-                        goto out1;
+                        goto out;
         }
-
-out1:
+        rc = 0;
+out:
         for (i = 0; i < nclasses; i++)
                 kfree(classes[i]);
         kfree(classes);
-out:
         return rc;
 }
 
@@ -1569,14 +1799,12 @@ static int sel_make_policycap(void)
 static int sel_make_dir(struct inode *dir, struct dentry *dentry,
                         unsigned long *ino)
 {
-        int ret = 0;
         struct inode *inode;
 
         inode = sel_make_inode(dir->i_sb, S_IFDIR | S_IRUGO | S_IXUGO);
-        if (!inode) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!inode)
+                return -ENOMEM;
+
         inode->i_op = &simple_dir_inode_operations;
         inode->i_fop = &simple_dir_operations;
         inode->i_ino = ++(*ino);
@@ -1585,8 +1813,8 @@ static int sel_make_dir(struct inode *dir, struct dentry *dentry,
         d_add(dentry, inode);
         /* bump link count on parent directory, too */
         inc_nlink(dir);
-out:
-        return ret;
+
+        return 0;
 }
 
 static int sel_fill_super(struct super_block *sb, void *data, int silent)
@@ -1612,6 +1840,8 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
                 [SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR},
                 [SEL_REJECT_UNKNOWN] = {"reject_unknown", &sel_handle_unknown_ops, S_IRUGO},
                 [SEL_DENY_UNKNOWN] = {"deny_unknown", &sel_handle_unknown_ops, S_IRUGO},
+                [SEL_STATUS] = {"status", &sel_handle_status_ops, S_IRUGO},
+                [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUSR},
                 /* last one */ {""}
         };
         ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files);
@@ -1620,11 +1850,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
 
         root_inode = sb->s_root->d_inode;
 
+        ret = -ENOMEM;
         dentry = d_alloc_name(sb->s_root, BOOL_DIR_NAME);
-        if (!dentry) {
-                ret = -ENOMEM;
+        if (!dentry)
                 goto err;
-        }
 
         ret = sel_make_dir(root_inode, dentry, &sel_last_ino);
         if (ret)
@@ -1632,17 +1861,16 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
 
         bool_dir = dentry;
 
+        ret = -ENOMEM;
         dentry = d_alloc_name(sb->s_root, NULL_FILE_NAME);
-        if (!dentry) {
-                ret = -ENOMEM;
+        if (!dentry)
                 goto err;
-        }
 
+        ret = -ENOMEM;
         inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
-        if (!inode) {
-                ret = -ENOMEM;
+        if (!inode)
                 goto err;
-        }
+
         inode->i_ino = ++sel_last_ino;
         isec = (struct inode_security_struct *)inode->i_security;
         isec->sid = SECINITSID_DEVNULL;
@@ -1653,11 +1881,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
         d_add(dentry, inode);
         selinux_null = dentry;
 
+        ret = -ENOMEM;
         dentry = d_alloc_name(sb->s_root, "avc");
-        if (!dentry) {
-                ret = -ENOMEM;
+        if (!dentry)
                 goto err;
-        }
 
         ret = sel_make_dir(root_inode, dentry, &sel_last_ino);
         if (ret)
@@ -1667,11 +1894,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
         if (ret)
                 goto err;
 
+        ret = -ENOMEM;
         dentry = d_alloc_name(sb->s_root, "initial_contexts");
-        if (!dentry) {
-                ret = -ENOMEM;
+        if (!dentry)
                 goto err;
-        }
 
         ret = sel_make_dir(root_inode, dentry, &sel_last_ino);
         if (ret)
@@ -1681,11 +1907,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
         if (ret)
                 goto err;
 
+        ret = -ENOMEM;
         dentry = d_alloc_name(sb->s_root, "class");
-        if (!dentry) {
-                ret = -ENOMEM;
+        if (!dentry)
                 goto err;
-        }
 
         ret = sel_make_dir(root_inode, dentry, &sel_last_ino);
         if (ret)
@@ -1693,11 +1918,10 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
 
         class_dir = dentry;
 
+        ret = -ENOMEM;
         dentry = d_alloc_name(sb->s_root, "policy_capabilities");
-        if (!dentry) {
-                ret = -ENOMEM;
+        if (!dentry)
                 goto err;
-        }
 
         ret = sel_make_dir(root_inode, dentry, &sel_last_ino);
         if (ret)
@@ -1705,28 +1929,27 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
 
         policycap_dir = dentry;
 
-out:
-        return ret;
+        return 0;
 err:
         printk(KERN_ERR "SELinux: %s:  failed while creating inodes\n",
                 __func__);
-        goto out;
+        return ret;
 }
 
-static int sel_get_sb(struct file_system_type *fs_type,
-                      int flags, const char *dev_name, void *data,
-                      struct vfsmount *mnt)
+static struct dentry *sel_mount(struct file_system_type *fs_type,
+                      int flags, const char *dev_name, void *data)
 {
-        return get_sb_single(fs_type, flags, data, sel_fill_super, mnt);
+        return mount_single(fs_type, flags, data, sel_fill_super);
 }
 
 static struct file_system_type sel_fs_type = {
         .name           = "selinuxfs",
-        .get_sb         = sel_get_sb,
+        .mount          = sel_mount,
         .kill_sb        = kill_litter_super,
 };
 
 struct vfsmount *selinuxfs_mount;
+static struct kobject *selinuxfs_kobj;
 
 static int __init init_sel_fs(void)
 {
@@ -1734,15 +1957,24 @@ static int __init init_sel_fs(void)
 
         if (!selinux_enabled)
                 return 0;
+
+        selinuxfs_kobj = kobject_create_and_add("selinux", fs_kobj);
+        if (!selinuxfs_kobj)
+                return -ENOMEM;
+
         err = register_filesystem(&sel_fs_type);
-        if (!err) {
-                selinuxfs_mount = kern_mount(&sel_fs_type);
-                if (IS_ERR(selinuxfs_mount)) {
-                        printk(KERN_ERR "selinuxfs:  could not mount!\n");
-                        err = PTR_ERR(selinuxfs_mount);
-                        selinuxfs_mount = NULL;
-                }
+        if (err) {
+                kobject_put(selinuxfs_kobj);
+                return err;
         }
+
+        selinuxfs_mount = kern_mount(&sel_fs_type);
+        if (IS_ERR(selinuxfs_mount)) {
+                printk(KERN_ERR "selinuxfs:  could not mount!\n");
+                err = PTR_ERR(selinuxfs_mount);
+                selinuxfs_mount = NULL;
+        }
+
         return err;
 }
 
@@ -1751,6 +1983,7 @@ __initcall(init_sel_fs);
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 void exit_sel_fs(void)
 {
+        kobject_put(selinuxfs_kobj);
         unregister_filesystem(&sel_fs_type);
 }
 #endif
diff --git a/security/selinux/ss/Makefile b/security/selinux/ss/Makefile
deleted file mode 100644
index 15d4e62917de..000000000000
--- a/security/selinux/ss/Makefile
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# Makefile for building the SELinux security server as part of the kernel tree.
-#
-
-EXTRA_CFLAGS += -Isecurity/selinux -Isecurity/selinux/include
-obj-y := ss.o
-
-ss-y := ebitmap.o hashtab.o symtab.o sidtab.o avtab.o policydb.o services.o conditional.o mls.o
-
diff --git a/security/selinux/ss/avtab.c b/security/selinux/ss/avtab.c
index 929480c6c430..a3dd9faa19c0 100644
--- a/security/selinux/ss/avtab.c
+++ b/security/selinux/ss/avtab.c
@@ -266,8 +266,8 @@ int avtab_alloc(struct avtab *h, u32 nrules)
         if (shift > 2)
                 shift = shift - 2;
         nslot = 1 << shift;
-        if (nslot > MAX_AVTAB_SIZE)
-                nslot = MAX_AVTAB_SIZE;
+        if (nslot > MAX_AVTAB_HASH_BUCKETS)
+                nslot = MAX_AVTAB_HASH_BUCKETS;
         mask = nslot - 1;
 
         h->htable = kcalloc(nslot, sizeof(*(h->htable)), GFP_KERNEL);
@@ -501,6 +501,48 @@ bad:
         goto out;
 }
 
+int avtab_write_item(struct policydb *p, struct avtab_node *cur, void *fp)
+{
+        __le16 buf16[4];
+        __le32 buf32[1];
+        int rc;
+
+        buf16[0] = cpu_to_le16(cur->key.source_type);
+        buf16[1] = cpu_to_le16(cur->key.target_type);
+        buf16[2] = cpu_to_le16(cur->key.target_class);
+        buf16[3] = cpu_to_le16(cur->key.specified);
+        rc = put_entry(buf16, sizeof(u16), 4, fp);
+        if (rc)
+                return rc;
+        buf32[0] = cpu_to_le32(cur->datum.data);
+        rc = put_entry(buf32, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+        return 0;
+}
+
+int avtab_write(struct policydb *p, struct avtab *a, void *fp)
+{
+        unsigned int i;
+        int rc = 0;
+        struct avtab_node *cur;
+        __le32 buf[1];
+
+        buf[0] = cpu_to_le32(a->nel);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        for (i = 0; i < a->nslot; i++) {
+                for (cur = a->htable[i]; cur; cur = cur->next) {
+                        rc = avtab_write_item(p, cur, fp);
+                        if (rc)
+                                return rc;
+                }
+        }
+
+        return rc;
+}
 void avtab_cache_init(void)
 {
         avtab_node_cachep = kmem_cache_create("avtab_node",
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index cd4f734e2749..63ce2f9e441d 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -14,7 +14,7 @@
  *
  * Copyright (C) 2003 Tresys Technology, LLC
  *      This program is free software; you can redistribute it and/or modify
- *      it under the terms of the GNU General Public License as published by
+ *      it under the terms of the GNU General Public License as published by
  *      the Free Software Foundation, version 2.
  *
  * Updated: Yuichi Nakamura <ynakam@hitachisoft.jp>
@@ -27,16 +27,16 @@ struct avtab_key {
         u16 source_type;        /* source type */
         u16 target_type;        /* target type */
         u16 target_class;       /* target object class */
-#define AVTAB_ALLOWED     1
-#define AVTAB_AUDITALLOW  2
-#define AVTAB_AUDITDENY   4
-#define AVTAB_AV         (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY)
-#define AVTAB_TRANSITION 16
-#define AVTAB_MEMBER     32
-#define AVTAB_CHANGE     64
-#define AVTAB_TYPE       (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
-#define AVTAB_ENABLED_OLD    0x80000000 /* reserved for used in cond_avtab */
-#define AVTAB_ENABLED    0x8000 /* reserved for used in cond_avtab */
+#define AVTAB_ALLOWED           0x0001
+#define AVTAB_AUDITALLOW        0x0002
+#define AVTAB_AUDITDENY         0x0004
+#define AVTAB_AV                (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY)
+#define AVTAB_TRANSITION        0x0010
+#define AVTAB_MEMBER            0x0020
+#define AVTAB_CHANGE            0x0040
+#define AVTAB_TYPE              (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
+#define AVTAB_ENABLED_OLD   0x80000000 /* reserved for used in cond_avtab */
+#define AVTAB_ENABLED           0x8000 /* reserved for used in cond_avtab */
         u16 specified;  /* what field is specified */
 };
 
@@ -71,6 +71,8 @@ int avtab_read_item(struct avtab *a, void *fp, struct policydb *pol,
                     void *p);
 
 int avtab_read(struct avtab *a, void *fp, struct policydb *pol);
+int avtab_write_item(struct policydb *p, struct avtab_node *cur, void *fp);
+int avtab_write(struct policydb *p, struct avtab *a, void *fp);
 
 struct avtab_node *avtab_insert_nonunique(struct avtab *h, struct avtab_key *key,
                                           struct avtab_datum *datum);
@@ -84,8 +86,6 @@ void avtab_cache_destroy(void);
 
 #define MAX_AVTAB_HASH_BITS 11
 #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS)
-#define MAX_AVTAB_HASH_MASK (MAX_AVTAB_HASH_BUCKETS-1)
-#define MAX_AVTAB_SIZE MAX_AVTAB_HASH_BUCKETS
 
 #endif  /* _SS_AVTAB_H_ */
 
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index c91e150c3087..a53373207fb4 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -178,7 +178,7 @@ int cond_init_bool_indexes(struct policydb *p)
         p->bool_val_to_struct = (struct cond_bool_datum **)
                 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
         if (!p->bool_val_to_struct)
-                return -1;
+                return -ENOMEM;
         return 0;
 }
 
@@ -193,6 +193,7 @@ int cond_index_bool(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct cond_bool_datum *booldatum;
+        struct flex_array *fa;
 
         booldatum = datum;
         p = datap;
@@ -200,7 +201,10 @@ int cond_index_bool(void *key, void *datum, void *datap)
         if (!booldatum->value || booldatum->value > p->p_bools.nprim)
                 return -EINVAL;
 
-        p->p_bool_val_to_name[booldatum->value - 1] = key;
+        fa = p->sym_val_to_name[SYM_BOOLS];
+        if (flex_array_put_ptr(fa, booldatum->value - 1, key,
+                               GFP_KERNEL | __GFP_ZERO))
+                BUG();
         p->bool_val_to_struct[booldatum->value - 1] = booldatum;
 
         return 0;
@@ -490,6 +494,129 @@ err:
         return rc;
 }
 
+int cond_write_bool(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct cond_bool_datum *booldatum = datum;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        __le32 buf[3];
+        u32 len;
+        int rc;
+
+        len = strlen(key);
+        buf[0] = cpu_to_le32(booldatum->value);
+        buf[1] = cpu_to_le32(booldatum->state);
+        buf[2] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 3, fp);
+        if (rc)
+                return rc;
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+        return 0;
+}
+
+/*
+ * cond_write_cond_av_list doesn't write out the av_list nodes.
+ * Instead it writes out the key/value pairs from the avtab. This
+ * is necessary because there is no way to uniquely identifying rules
+ * in the avtab so it is not possible to associate individual rules
+ * in the avtab with a conditional without saving them as part of
+ * the conditional. This means that the avtab with the conditional
+ * rules will not be saved but will be rebuilt on policy load.
+ */
+static int cond_write_av_list(struct policydb *p,
+                              struct cond_av_list *list, struct policy_file *fp)
+{
+        __le32 buf[1];
+        struct cond_av_list *cur_list;
+        u32 len;
+        int rc;
+
+        len = 0;
+        for (cur_list = list; cur_list != NULL; cur_list = cur_list->next)
+                len++;
+
+        buf[0] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        if (len == 0)
+                return 0;
+
+        for (cur_list = list; cur_list != NULL; cur_list = cur_list->next) {
+                rc = avtab_write_item(p, cur_list->node, fp);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
+
+int cond_write_node(struct policydb *p, struct cond_node *node,
+                    struct policy_file *fp)
+{
+        struct cond_expr *cur_expr;
+        __le32 buf[2];
+        int rc;
+        u32 len = 0;
+
+        buf[0] = cpu_to_le32(node->cur_state);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next)
+                len++;
+
+        buf[0] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        for (cur_expr = node->expr; cur_expr != NULL; cur_expr = cur_expr->next) {
+                buf[0] = cpu_to_le32(cur_expr->expr_type);
+                buf[1] = cpu_to_le32(cur_expr->bool);
+                rc = put_entry(buf, sizeof(u32), 2, fp);
+                if (rc)
+                        return rc;
+        }
+
+        rc = cond_write_av_list(p, node->true_list, fp);
+        if (rc)
+                return rc;
+        rc = cond_write_av_list(p, node->false_list, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
+{
+        struct cond_node *cur;
+        u32 len;
+        __le32 buf[1];
+        int rc;
+
+        len = 0;
+        for (cur = list; cur != NULL; cur = cur->next)
+                len++;
+        buf[0] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        for (cur = list; cur != NULL; cur = cur->next) {
+                rc = cond_write_node(p, cur, fp);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
 /* Determine whether additional permissions are granted by the conditional
  * av table, and if so, add them to the result
  */
diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h
index 53ddb013ae57..3f209c635295 100644
--- a/security/selinux/ss/conditional.h
+++ b/security/selinux/ss/conditional.h
@@ -69,6 +69,8 @@ int cond_index_bool(void *key, void *datum, void *datap);
 
 int cond_read_bool(struct policydb *p, struct hashtab *h, void *fp);
 int cond_read_list(struct policydb *p, void *fp);
+int cond_write_bool(void *key, void *datum, void *ptr);
+int cond_write_list(struct policydb *p, struct cond_node *list, void *fp);
 
 void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd);
 
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index 04b6145d767f..d42951fcbe87 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -22,6 +22,8 @@
 #include "ebitmap.h"
 #include "policydb.h"
 
+#define BITS_PER_U64    (sizeof(u64) * 8)
+
 int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2)
 {
         struct ebitmap_node *n1, *n2;
@@ -363,10 +365,10 @@ int ebitmap_read(struct ebitmap *e, void *fp)
         e->highbit = le32_to_cpu(buf[1]);
         count = le32_to_cpu(buf[2]);
 
-        if (mapunit != sizeof(u64) * 8) {
+        if (mapunit != BITS_PER_U64) {
                 printk(KERN_ERR "SELinux: ebitmap: map size %u does not "
                        "match my size %Zd (high bit was %d)\n",
-                       mapunit, sizeof(u64) * 8, e->highbit);
+                       mapunit, BITS_PER_U64, e->highbit);
                 goto bad;
         }
 
@@ -446,3 +448,78 @@ bad:
         ebitmap_destroy(e);
         goto out;
 }
+
+int ebitmap_write(struct ebitmap *e, void *fp)
+{
+        struct ebitmap_node *n;
+        u32 count;
+        __le32 buf[3];
+        u64 map;
+        int bit, last_bit, last_startbit, rc;
+
+        buf[0] = cpu_to_le32(BITS_PER_U64);
+
+        count = 0;
+        last_bit = 0;
+        last_startbit = -1;
+        ebitmap_for_each_positive_bit(e, n, bit) {
+                if (rounddown(bit, (int)BITS_PER_U64) > last_startbit) {
+                        count++;
+                        last_startbit = rounddown(bit, BITS_PER_U64);
+                }
+                last_bit = roundup(bit + 1, BITS_PER_U64);
+        }
+        buf[1] = cpu_to_le32(last_bit);
+        buf[2] = cpu_to_le32(count);
+
+        rc = put_entry(buf, sizeof(u32), 3, fp);
+        if (rc)
+                return rc;
+
+        map = 0;
+        last_startbit = INT_MIN;
+        ebitmap_for_each_positive_bit(e, n, bit) {
+                if (rounddown(bit, (int)BITS_PER_U64) > last_startbit) {
+                        __le64 buf64[1];
+
+                        /* this is the very first bit */
+                        if (!map) {
+                                last_startbit = rounddown(bit, BITS_PER_U64);
+                                map = (u64)1 << (bit - last_startbit);
+                                continue;
+                        }
+
+                        /* write the last node */
+                        buf[0] = cpu_to_le32(last_startbit);
+                        rc = put_entry(buf, sizeof(u32), 1, fp);
+                        if (rc)
+                                return rc;
+
+                        buf64[0] = cpu_to_le64(map);
+                        rc = put_entry(buf64, sizeof(u64), 1, fp);
+                        if (rc)
+                                return rc;
+
+                        /* set up for the next node */
+                        map = 0;
+                        last_startbit = rounddown(bit, BITS_PER_U64);
+                }
+                map |= (u64)1 << (bit - last_startbit);
+        }
+        /* write the last node */
+        if (map) {
+                __le64 buf64[1];
+
+                /* write the last node */
+                buf[0] = cpu_to_le32(last_startbit);
+                rc = put_entry(buf, sizeof(u32), 1, fp);
+                if (rc)
+                        return rc;
+
+                buf64[0] = cpu_to_le64(map);
+                rc = put_entry(buf64, sizeof(u64), 1, fp);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index f283b4367f54..922f8afa89dd 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -36,7 +36,6 @@ struct ebitmap {
 };
 
 #define ebitmap_length(e) ((e)->highbit)
-#define ebitmap_startbit(e) ((e)->node ? (e)->node->startbit : 0)
 
 static inline unsigned int ebitmap_start_positive(struct ebitmap *e,
                                                   struct ebitmap_node **n)
@@ -123,6 +122,7 @@ int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);
 int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);
 void ebitmap_destroy(struct ebitmap *e);
 int ebitmap_read(struct ebitmap *e, void *fp);
+int ebitmap_write(struct ebitmap *e, void *fp);
 
 #ifdef CONFIG_NETLABEL
 int ebitmap_netlbl_export(struct ebitmap *ebmap,
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index b4eff7a60c50..e96174216bc9 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -45,7 +45,7 @@ int mls_compute_context_len(struct context *context)
         len = 1; /* for the beginning ":" */
         for (l = 0; l < 2; l++) {
                 int index_sens = context->range.level[l].sens;
-                len += strlen(policydb.p_sens_val_to_name[index_sens - 1]);
+                len += strlen(sym_name(&policydb, SYM_LEVELS, index_sens - 1));
 
                 /* categories */
                 head = -2;
@@ -55,17 +55,17 @@ int mls_compute_context_len(struct context *context)
                         if (i - prev > 1) {
                                 /* one or more negative bits are skipped */
                                 if (head != prev) {
-                                        nm = policydb.p_cat_val_to_name[prev];
+                                        nm = sym_name(&policydb, SYM_CATS, prev);
                                         len += strlen(nm) + 1;
                                 }
-                                nm = policydb.p_cat_val_to_name[i];
+                                nm = sym_name(&policydb, SYM_CATS, i);
                                 len += strlen(nm) + 1;
                                 head = i;
                         }
                         prev = i;
                 }
                 if (prev != head) {
-                        nm = policydb.p_cat_val_to_name[prev];
+                        nm = sym_name(&policydb, SYM_CATS, prev);
                         len += strlen(nm) + 1;
                 }
                 if (l == 0) {
@@ -102,8 +102,8 @@ void mls_sid_to_context(struct context *context,
         scontextp++;
 
         for (l = 0; l < 2; l++) {
-                strcpy(scontextp,
-                       policydb.p_sens_val_to_name[context->range.level[l].sens - 1]);
+                strcpy(scontextp, sym_name(&policydb, SYM_LEVELS,
+                                           context->range.level[l].sens - 1));
                 scontextp += strlen(scontextp);
 
                 /* categories */
@@ -118,7 +118,7 @@ void mls_sid_to_context(struct context *context,
                                                 *scontextp++ = '.';
                                         else
                                                 *scontextp++ = ',';
-                                        nm = policydb.p_cat_val_to_name[prev];
+                                        nm = sym_name(&policydb, SYM_CATS, prev);
                                         strcpy(scontextp, nm);
                                         scontextp += strlen(nm);
                                 }
@@ -126,7 +126,7 @@ void mls_sid_to_context(struct context *context,
                                         *scontextp++ = ':';
                                 else
                                         *scontextp++ = ',';
-                                nm = policydb.p_cat_val_to_name[i];
+                                nm = sym_name(&policydb, SYM_CATS, i);
                                 strcpy(scontextp, nm);
                                 scontextp += strlen(nm);
                                 head = i;
@@ -139,7 +139,7 @@ void mls_sid_to_context(struct context *context,
                                 *scontextp++ = '.';
                         else
                                 *scontextp++ = ',';
-                        nm = policydb.p_cat_val_to_name[prev];
+                        nm = sym_name(&policydb, SYM_CATS, prev);
                         strcpy(scontextp, nm);
                         scontextp += strlen(nm);
                 }
@@ -166,7 +166,7 @@ int mls_level_isvalid(struct policydb *p, struct mls_level *l)
         if (!l->sens || l->sens > p->p_levels.nprim)
                 return 0;
         levdatum = hashtab_search(p->p_levels.table,
-                                  p->p_sens_val_to_name[l->sens - 1]);
+                                  sym_name(p, SYM_LEVELS, l->sens - 1));
         if (!levdatum)
                 return 0;
 
@@ -482,7 +482,8 @@ int mls_convert_context(struct policydb *oldp,
 
         for (l = 0; l < 2; l++) {
                 levdatum = hashtab_search(newp->p_levels.table,
-                        oldp->p_sens_val_to_name[c->range.level[l].sens - 1]);
+                                          sym_name(oldp, SYM_LEVELS,
+                                                   c->range.level[l].sens - 1));
 
                 if (!levdatum)
                         return -EINVAL;
@@ -493,7 +494,7 @@ int mls_convert_context(struct policydb *oldp,
                         int rc;
 
                         catdatum = hashtab_search(newp->p_cats.table,
-                                                  oldp->p_cat_val_to_name[i]);
+                                                  sym_name(oldp, SYM_CATS, i));
                         if (!catdatum)
                                 return -EINVAL;
                         rc = ebitmap_set_bit(&bitmap, catdatum->value - 1, 1);
@@ -511,7 +512,8 @@ int mls_compute_sid(struct context *scontext,
                     struct context *tcontext,
                     u16 tclass,
                     u32 specified,
-                    struct context *newcontext)
+                    struct context *newcontext,
+                    bool sock)
 {
         struct range_trans rtr;
         struct mls_range *r;
@@ -530,7 +532,7 @@ int mls_compute_sid(struct context *scontext,
                         return mls_range_set(newcontext, r);
                 /* Fallthrough */
         case AVTAB_CHANGE:
-                if (tclass == policydb.process_class)
+                if ((tclass == policydb.process_class) || (sock == true))
                         /* Use the process MLS attributes. */
                         return mls_context_cpy(newcontext, scontext);
                 else
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index cd9152632e54..037bf9d82d41 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -49,7 +49,8 @@ int mls_compute_sid(struct context *scontext,
                     struct context *tcontext,
                     u16 tclass,
                     u32 specified,
-                    struct context *newcontext);
+                    struct context *newcontext,
+                    bool sock);
 
 int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
                          struct context *usercon);
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 3a29704be8ce..d246aca3f4fb 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -37,6 +37,7 @@
 #include "policydb.h"
 #include "conditional.h"
 #include "mls.h"
+#include "services.h"
 
 #define _DEBUG_HASHES
 
@@ -122,6 +123,16 @@ static struct policydb_compat_info policydb_compat[] = {
                 .sym_num        = SYM_NUM,
                 .ocon_num       = OCON_NUM,
         },
+        {
+                .version        = POLICYDB_VERSION_FILENAME_TRANS,
+                .sym_num        = SYM_NUM,
+                .ocon_num       = OCON_NUM,
+        },
+        {
+                .version        = POLICYDB_VERSION_ROLETRANS,
+                .sym_num        = SYM_NUM,
+                .ocon_num       = OCON_NUM,
+        },
 };
 
 static struct policydb_compat_info *policydb_lookup_compat(int version)
@@ -147,32 +158,67 @@ static int roles_init(struct policydb *p)
         int rc;
         struct role_datum *role;
 
+        rc = -ENOMEM;
         role = kzalloc(sizeof(*role), GFP_KERNEL);
-        if (!role) {
-                rc = -ENOMEM;
+        if (!role)
                 goto out;
-        }
+
+        rc = -EINVAL;
         role->value = ++p->p_roles.nprim;
-        if (role->value != OBJECT_R_VAL) {
-                rc = -EINVAL;
-                goto out_free_role;
-        }
+        if (role->value != OBJECT_R_VAL)
+                goto out;
+
+        rc = -ENOMEM;
         key = kstrdup(OBJECT_R, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
-                goto out_free_role;
-        }
+        if (!key)
+                goto out;
+
         rc = hashtab_insert(p->p_roles.table, key, role);
         if (rc)
-                goto out_free_key;
-out:
-        return rc;
+                goto out;
 
-out_free_key:
+        return 0;
+out:
         kfree(key);
-out_free_role:
         kfree(role);
-        goto out;
+        return rc;
+}
+
+static u32 filenametr_hash(struct hashtab *h, const void *k)
+{
+        const struct filename_trans *ft = k;
+        unsigned long hash;
+        unsigned int byte_num;
+        unsigned char focus;
+
+        hash = ft->stype ^ ft->ttype ^ ft->tclass;
+
+        byte_num = 0;
+        while ((focus = ft->name[byte_num++]))
+                hash = partial_name_hash(focus, hash);
+        return hash & (h->size - 1);
+}
+
+static int filenametr_cmp(struct hashtab *h, const void *k1, const void *k2)
+{
+        const struct filename_trans *ft1 = k1;
+        const struct filename_trans *ft2 = k2;
+        int v;
+
+        v = ft1->stype - ft2->stype;
+        if (v)
+                return v;
+
+        v = ft1->ttype - ft2->ttype;
+        if (v)
+                return v;
+
+        v = ft1->tclass - ft2->tclass;
+        if (v)
+                return v;
+
+        return strcmp(ft1->name, ft2->name);
+
 }
 
 static u32 rangetr_hash(struct hashtab *h, const void *k)
@@ -185,9 +231,19 @@ static u32 rangetr_hash(struct hashtab *h, const void *k)
 static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2)
 {
         const struct range_trans *key1 = k1, *key2 = k2;
-        return (key1->source_type != key2->source_type ||
-                key1->target_type != key2->target_type ||
-                key1->target_class != key2->target_class);
+        int v;
+
+        v = key1->source_type - key2->source_type;
+        if (v)
+                return v;
+
+        v = key1->target_type - key2->target_type;
+        if (v)
+                return v;
+
+        v = key1->target_class - key2->target_class;
+
+        return v;
 }
 
 /*
@@ -202,35 +258,40 @@ static int policydb_init(struct policydb *p)
         for (i = 0; i < SYM_NUM; i++) {
                 rc = symtab_init(&p->symtab[i], symtab_sizes[i]);
                 if (rc)
-                        goto out_free_symtab;
+                        goto out;
         }
 
         rc = avtab_init(&p->te_avtab);
         if (rc)
-                goto out_free_symtab;
+                goto out;
 
         rc = roles_init(p);
         if (rc)
-                goto out_free_symtab;
+                goto out;
 
         rc = cond_policydb_init(p);
         if (rc)
-                goto out_free_symtab;
+                goto out;
+
+        p->filename_trans = hashtab_create(filenametr_hash, filenametr_cmp, (1 << 10));
+        if (!p->filename_trans)
+                goto out;
 
         p->range_tr = hashtab_create(rangetr_hash, rangetr_cmp, 256);
         if (!p->range_tr)
-                goto out_free_symtab;
+                goto out;
 
+        ebitmap_init(&p->filename_trans_ttypes);
         ebitmap_init(&p->policycaps);
         ebitmap_init(&p->permissive_map);
 
+        return 0;
 out:
-        return rc;
-
-out_free_symtab:
+        hashtab_destroy(p->filename_trans);
+        hashtab_destroy(p->range_tr);
         for (i = 0; i < SYM_NUM; i++)
                 hashtab_destroy(p->symtab[i].table);
-        goto out;
+        return rc;
 }
 
 /*
@@ -247,12 +308,17 @@ static int common_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct common_datum *comdatum;
+        struct flex_array *fa;
 
         comdatum = datum;
         p = datap;
         if (!comdatum->value || comdatum->value > p->p_commons.nprim)
                 return -EINVAL;
-        p->p_common_val_to_name[comdatum->value - 1] = key;
+
+        fa = p->sym_val_to_name[SYM_COMMONS];
+        if (flex_array_put_ptr(fa, comdatum->value - 1, key,
+                               GFP_KERNEL | __GFP_ZERO))
+                BUG();
         return 0;
 }
 
@@ -260,12 +326,16 @@ static int class_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct class_datum *cladatum;
+        struct flex_array *fa;
 
         cladatum = datum;
         p = datap;
         if (!cladatum->value || cladatum->value > p->p_classes.nprim)
                 return -EINVAL;
-        p->p_class_val_to_name[cladatum->value - 1] = key;
+        fa = p->sym_val_to_name[SYM_CLASSES];
+        if (flex_array_put_ptr(fa, cladatum->value - 1, key,
+                               GFP_KERNEL | __GFP_ZERO))
+                BUG();
         p->class_val_to_struct[cladatum->value - 1] = cladatum;
         return 0;
 }
@@ -274,6 +344,7 @@ static int role_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct role_datum *role;
+        struct flex_array *fa;
 
         role = datum;
         p = datap;
@@ -281,7 +352,11 @@ static int role_index(void *key, void *datum, void *datap)
             || role->value > p->p_roles.nprim
             || role->bounds > p->p_roles.nprim)
                 return -EINVAL;
-        p->p_role_val_to_name[role->value - 1] = key;
+
+        fa = p->sym_val_to_name[SYM_ROLES];
+        if (flex_array_put_ptr(fa, role->value - 1, key,
+                               GFP_KERNEL | __GFP_ZERO))
+                BUG();
         p->role_val_to_struct[role->value - 1] = role;
         return 0;
 }
@@ -290,6 +365,7 @@ static int type_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct type_datum *typdatum;
+        struct flex_array *fa;
 
         typdatum = datum;
         p = datap;
@@ -299,8 +375,15 @@ static int type_index(void *key, void *datum, void *datap)
                     || typdatum->value > p->p_types.nprim
                     || typdatum->bounds > p->p_types.nprim)
                         return -EINVAL;
-                p->p_type_val_to_name[typdatum->value - 1] = key;
-                p->type_val_to_struct[typdatum->value - 1] = typdatum;
+                fa = p->sym_val_to_name[SYM_TYPES];
+                if (flex_array_put_ptr(fa, typdatum->value - 1, key,
+                                       GFP_KERNEL | __GFP_ZERO))
+                        BUG();
+
+                fa = p->type_val_to_struct_array;
+                if (flex_array_put_ptr(fa, typdatum->value - 1, typdatum,
+                                       GFP_KERNEL | __GFP_ZERO))
+                        BUG();
         }
 
         return 0;
@@ -310,6 +393,7 @@ static int user_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct user_datum *usrdatum;
+        struct flex_array *fa;
 
         usrdatum = datum;
         p = datap;
@@ -317,7 +401,11 @@ static int user_index(void *key, void *datum, void *datap)
             || usrdatum->value > p->p_users.nprim
             || usrdatum->bounds > p->p_users.nprim)
                 return -EINVAL;
-        p->p_user_val_to_name[usrdatum->value - 1] = key;
+
+        fa = p->sym_val_to_name[SYM_USERS];
+        if (flex_array_put_ptr(fa, usrdatum->value - 1, key,
+                               GFP_KERNEL | __GFP_ZERO))
+                BUG();
         p->user_val_to_struct[usrdatum->value - 1] = usrdatum;
         return 0;
 }
@@ -326,6 +414,7 @@ static int sens_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct level_datum *levdatum;
+        struct flex_array *fa;
 
         levdatum = datum;
         p = datap;
@@ -334,7 +423,10 @@ static int sens_index(void *key, void *datum, void *datap)
                 if (!levdatum->level->sens ||
                     levdatum->level->sens > p->p_levels.nprim)
                         return -EINVAL;
-                p->p_sens_val_to_name[levdatum->level->sens - 1] = key;
+                fa = p->sym_val_to_name[SYM_LEVELS];
+                if (flex_array_put_ptr(fa, levdatum->level->sens - 1, key,
+                                       GFP_KERNEL | __GFP_ZERO))
+                        BUG();
         }
 
         return 0;
@@ -344,6 +436,7 @@ static int cat_index(void *key, void *datum, void *datap)
 {
         struct policydb *p;
         struct cat_datum *catdatum;
+        struct flex_array *fa;
 
         catdatum = datum;
         p = datap;
@@ -351,7 +444,10 @@ static int cat_index(void *key, void *datum, void *datap)
         if (!catdatum->isalias) {
                 if (!catdatum->value || catdatum->value > p->p_cats.nprim)
                         return -EINVAL;
-                p->p_cat_val_to_name[catdatum->value - 1] = key;
+                fa = p->sym_val_to_name[SYM_CATS];
+                if (flex_array_put_ptr(fa, catdatum->value - 1, key,
+                                       GFP_KERNEL | __GFP_ZERO))
+                        BUG();
         }
 
         return 0;
@@ -369,74 +465,27 @@ static int (*index_f[SYM_NUM]) (void *key, void *datum, void *datap) =
         cat_index,
 };
 
-/*
- * Define the common val_to_name array and the class
- * val_to_name and val_to_struct arrays in a policy
- * database structure.
- *
- * Caller must clean up upon failure.
- */
-static int policydb_index_classes(struct policydb *p)
+#ifdef DEBUG_HASHES
+static void hash_eval(struct hashtab *h, const char *hash_name)
 {
-        int rc;
-
-        p->p_common_val_to_name =
-                kmalloc(p->p_commons.nprim * sizeof(char *), GFP_KERNEL);
-        if (!p->p_common_val_to_name) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        rc = hashtab_map(p->p_commons.table, common_index, p);
-        if (rc)
-                goto out;
-
-        p->class_val_to_struct =
-                kmalloc(p->p_classes.nprim * sizeof(*(p->class_val_to_struct)), GFP_KERNEL);
-        if (!p->class_val_to_struct) {
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        p->p_class_val_to_name =
-                kmalloc(p->p_classes.nprim * sizeof(char *), GFP_KERNEL);
-        if (!p->p_class_val_to_name) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        struct hashtab_info info;
 
-        rc = hashtab_map(p->p_classes.table, class_index, p);
-out:
-        return rc;
+        hashtab_stat(h, &info);
+        printk(KERN_DEBUG "SELinux: %s:  %d entries and %d/%d buckets used, "
+               "longest chain length %d\n", hash_name, h->nel,
+               info.slots_used, h->size, info.max_chain_len);
 }
 
-#ifdef DEBUG_HASHES
 static void symtab_hash_eval(struct symtab *s)
 {
         int i;
 
-        for (i = 0; i < SYM_NUM; i++) {
-                struct hashtab *h = s[i].table;
-                struct hashtab_info info;
-
-                hashtab_stat(h, &info);
-                printk(KERN_DEBUG "SELinux: %s:  %d entries and %d/%d buckets used, "
-                       "longest chain length %d\n", symtab_name[i], h->nel,
-                       info.slots_used, h->size, info.max_chain_len);
-        }
+        for (i = 0; i < SYM_NUM; i++)
+                hash_eval(s[i].table, symtab_name[i]);
 }
 
-static void rangetr_hash_eval(struct hashtab *h)
-{
-        struct hashtab_info info;
-
-        hashtab_stat(h, &info);
-        printk(KERN_DEBUG "SELinux: rangetr:  %d entries and %d/%d buckets used, "
-               "longest chain length %d\n", h->nel,
-               info.slots_used, h->size, info.max_chain_len);
-}
 #else
-static inline void rangetr_hash_eval(struct hashtab *h)
+static inline void hash_eval(struct hashtab *h, char *hash_name)
 {
 }
 #endif
@@ -447,9 +496,9 @@ static inline void rangetr_hash_eval(struct hashtab *h)
  *
  * Caller must clean up on failure.
  */
-static int policydb_index_others(struct policydb *p)
+static int policydb_index(struct policydb *p)
 {
-        int i, rc = 0;
+        int i, rc;
 
         printk(KERN_DEBUG "SELinux:  %d users, %d roles, %d types, %d bools",
                p->p_users.nprim, p->p_roles.nprim, p->p_types.nprim, p->p_bools.nprim);
@@ -466,47 +515,63 @@ static int policydb_index_others(struct policydb *p)
         symtab_hash_eval(p->symtab);
 #endif
 
+        rc = -ENOMEM;
+        p->class_val_to_struct =
+                kmalloc(p->p_classes.nprim * sizeof(*(p->class_val_to_struct)),
+                        GFP_KERNEL);
+        if (!p->class_val_to_struct)
+                goto out;
+
+        rc = -ENOMEM;
         p->role_val_to_struct =
                 kmalloc(p->p_roles.nprim * sizeof(*(p->role_val_to_struct)),
                         GFP_KERNEL);
-        if (!p->role_val_to_struct) {
-                rc = -ENOMEM;
+        if (!p->role_val_to_struct)
                 goto out;
-        }
 
+        rc = -ENOMEM;
         p->user_val_to_struct =
                 kmalloc(p->p_users.nprim * sizeof(*(p->user_val_to_struct)),
                         GFP_KERNEL);
-        if (!p->user_val_to_struct) {
-                rc = -ENOMEM;
+        if (!p->user_val_to_struct)
                 goto out;
-        }
 
-        p->type_val_to_struct =
-                kmalloc(p->p_types.nprim * sizeof(*(p->type_val_to_struct)),
-                        GFP_KERNEL);
-        if (!p->type_val_to_struct) {
-                rc = -ENOMEM;
+        /* Yes, I want the sizeof the pointer, not the structure */
+        rc = -ENOMEM;
+        p->type_val_to_struct_array = flex_array_alloc(sizeof(struct type_datum *),
+                                                       p->p_types.nprim,
+                                                       GFP_KERNEL | __GFP_ZERO);
+        if (!p->type_val_to_struct_array)
                 goto out;
-        }
 
-        if (cond_init_bool_indexes(p)) {
-                rc = -ENOMEM;
+        rc = flex_array_prealloc(p->type_val_to_struct_array, 0,
+                                 p->p_types.nprim, GFP_KERNEL | __GFP_ZERO);
+        if (rc)
                 goto out;
-        }
 
-        for (i = SYM_ROLES; i < SYM_NUM; i++) {
-                p->sym_val_to_name[i] =
-                        kmalloc(p->symtab[i].nprim * sizeof(char *), GFP_KERNEL);
-                if (!p->sym_val_to_name[i]) {
-                        rc = -ENOMEM;
+        rc = cond_init_bool_indexes(p);
+        if (rc)
+                goto out;
+
+        for (i = 0; i < SYM_NUM; i++) {
+                rc = -ENOMEM;
+                p->sym_val_to_name[i] = flex_array_alloc(sizeof(char *),
+                                                         p->symtab[i].nprim,
+                                                         GFP_KERNEL | __GFP_ZERO);
+                if (!p->sym_val_to_name[i])
                         goto out;
-                }
+
+                rc = flex_array_prealloc(p->sym_val_to_name[i],
+                                         0, p->symtab[i].nprim,
+                                         GFP_KERNEL | __GFP_ZERO);
+                if (rc)
+                        goto out;
+
                 rc = hashtab_map(p->symtab[i].table, index_f[i], p);
                 if (rc)
                         goto out;
         }
-
+        rc = 0;
 out:
         return rc;
 }
@@ -529,9 +594,11 @@ static int common_destroy(void *key, void *datum, void *p)
         struct common_datum *comdatum;
 
         kfree(key);
-        comdatum = datum;
-        hashtab_map(comdatum->permissions.table, perm_destroy, NULL);
-        hashtab_destroy(comdatum->permissions.table);
+        if (datum) {
+                comdatum = datum;
+                hashtab_map(comdatum->permissions.table, perm_destroy, NULL);
+                hashtab_destroy(comdatum->permissions.table);
+        }
         kfree(datum);
         return 0;
 }
@@ -543,38 +610,40 @@ static int cls_destroy(void *key, void *datum, void *p)
         struct constraint_expr *e, *etmp;
 
         kfree(key);
-        cladatum = datum;
-        hashtab_map(cladatum->permissions.table, perm_destroy, NULL);
-        hashtab_destroy(cladatum->permissions.table);
-        constraint = cladatum->constraints;
-        while (constraint) {
-                e = constraint->expr;
-                while (e) {
-                        ebitmap_destroy(&e->names);
-                        etmp = e;
-                        e = e->next;
-                        kfree(etmp);
+        if (datum) {
+                cladatum = datum;
+                hashtab_map(cladatum->permissions.table, perm_destroy, NULL);
+                hashtab_destroy(cladatum->permissions.table);
+                constraint = cladatum->constraints;
+                while (constraint) {
+                        e = constraint->expr;
+                        while (e) {
+                                ebitmap_destroy(&e->names);
+                                etmp = e;
+                                e = e->next;
+                                kfree(etmp);
+                        }
+                        ctemp = constraint;
+                        constraint = constraint->next;
+                        kfree(ctemp);
                 }
-                ctemp = constraint;
-                constraint = constraint->next;
-                kfree(ctemp);
-        }
-
-        constraint = cladatum->validatetrans;
-        while (constraint) {
-                e = constraint->expr;
-                while (e) {
-                        ebitmap_destroy(&e->names);
-                        etmp = e;
-                        e = e->next;
-                        kfree(etmp);
+
+                constraint = cladatum->validatetrans;
+                while (constraint) {
+                        e = constraint->expr;
+                        while (e) {
+                                ebitmap_destroy(&e->names);
+                                etmp = e;
+                                e = e->next;
+                                kfree(etmp);
+                        }
+                        ctemp = constraint;
+                        constraint = constraint->next;
+                        kfree(ctemp);
                 }
-                ctemp = constraint;
-                constraint = constraint->next;
-                kfree(ctemp);
-        }
 
-        kfree(cladatum->comkey);
+                kfree(cladatum->comkey);
+        }
         kfree(datum);
         return 0;
 }
@@ -584,9 +653,11 @@ static int role_destroy(void *key, void *datum, void *p)
         struct role_datum *role;
 
         kfree(key);
-        role = datum;
-        ebitmap_destroy(&role->dominates);
-        ebitmap_destroy(&role->types);
+        if (datum) {
+                role = datum;
+                ebitmap_destroy(&role->dominates);
+                ebitmap_destroy(&role->types);
+        }
         kfree(datum);
         return 0;
 }
@@ -603,11 +674,13 @@ static int user_destroy(void *key, void *datum, void *p)
         struct user_datum *usrdatum;
 
         kfree(key);
-        usrdatum = datum;
-        ebitmap_destroy(&usrdatum->roles);
-        ebitmap_destroy(&usrdatum->range.level[0].cat);
-        ebitmap_destroy(&usrdatum->range.level[1].cat);
-        ebitmap_destroy(&usrdatum->dfltlevel.cat);
+        if (datum) {
+                usrdatum = datum;
+                ebitmap_destroy(&usrdatum->roles);
+                ebitmap_destroy(&usrdatum->range.level[0].cat);
+                ebitmap_destroy(&usrdatum->range.level[1].cat);
+                ebitmap_destroy(&usrdatum->dfltlevel.cat);
+        }
         kfree(datum);
         return 0;
 }
@@ -617,9 +690,11 @@ static int sens_destroy(void *key, void *datum, void *p)
         struct level_datum *levdatum;
 
         kfree(key);
-        levdatum = datum;
-        ebitmap_destroy(&levdatum->level->cat);
-        kfree(levdatum->level);
+        if (datum) {
+                levdatum = datum;
+                ebitmap_destroy(&levdatum->level->cat);
+                kfree(levdatum->level);
+        }
         kfree(datum);
         return 0;
 }
@@ -643,6 +718,16 @@ static int (*destroy_f[SYM_NUM]) (void *key, void *datum, void *datap) =
         cat_destroy,
 };
 
+static int filenametr_destroy(void *key, void *datum, void *p)
+{
+        struct filename_trans *ft = key;
+        kfree(ft->name);
+        kfree(key);
+        kfree(datum);
+        cond_resched();
+        return 0;
+}
+
 static int range_tr_destroy(void *key, void *datum, void *p)
 {
         struct mls_range *rt = datum;
@@ -684,13 +769,16 @@ void policydb_destroy(struct policydb *p)
                 hashtab_destroy(p->symtab[i].table);
         }
 
-        for (i = 0; i < SYM_NUM; i++)
-                kfree(p->sym_val_to_name[i]);
+        for (i = 0; i < SYM_NUM; i++) {
+                if (p->sym_val_to_name[i])
+                        flex_array_free(p->sym_val_to_name[i]);
+        }
 
         kfree(p->class_val_to_struct);
         kfree(p->role_val_to_struct);
         kfree(p->user_val_to_struct);
-        kfree(p->type_val_to_struct);
+        if (p->type_val_to_struct_array)
+                flex_array_free(p->type_val_to_struct_array);
 
         avtab_destroy(&p->te_avtab);
 
@@ -737,6 +825,9 @@ void policydb_destroy(struct policydb *p)
         }
         kfree(lra);
 
+        hashtab_map(p->filename_trans, filenametr_destroy, NULL);
+        hashtab_destroy(p->filename_trans);
+
         hashtab_map(p->range_tr, range_tr_destroy, NULL);
         hashtab_destroy(p->range_tr);
 
@@ -751,6 +842,8 @@ void policydb_destroy(struct policydb *p)
                 }
                 flex_array_free(p->type_attr_map_array);
         }
+
+        ebitmap_destroy(&p->filename_trans_ttypes);
         ebitmap_destroy(&p->policycaps);
         ebitmap_destroy(&p->permissive_map);
 
@@ -774,19 +867,21 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s)
 
         head = p->ocontexts[OCON_ISID];
         for (c = head; c; c = c->next) {
+                rc = -EINVAL;
                 if (!c->context[0].user) {
-                        printk(KERN_ERR "SELinux:  SID %s was never "
-                               "defined.\n", c->u.name);
-                        rc = -EINVAL;
+                        printk(KERN_ERR "SELinux:  SID %s was never defined.\n",
+                                c->u.name);
                         goto out;
                 }
-                if (sidtab_insert(s, c->sid[0], &c->context[0])) {
-                        printk(KERN_ERR "SELinux:  unable to load initial "
-                               "SID %s.\n", c->u.name);
-                        rc = -EINVAL;
+
+                rc = sidtab_insert(s, c->sid[0], &c->context[0]);
+                if (rc) {
+                        printk(KERN_ERR "SELinux:  unable to load initial SID %s.\n",
+                                c->u.name);
                         goto out;
                 }
         }
+        rc = 0;
 out:
         return rc;
 }
@@ -835,8 +930,7 @@ int policydb_context_isvalid(struct policydb *p, struct context *c)
                  * Role must be authorized for the type.
                  */
                 role = p->role_val_to_struct[c->role - 1];
-                if (!ebitmap_get_bit(&role->types,
-                                     c->type - 1))
+                if (!ebitmap_get_bit(&role->types, c->type - 1))
                         /* role may not be associated with type */
                         return 0;
 
@@ -847,8 +941,7 @@ int policydb_context_isvalid(struct policydb *p, struct context *c)
                 if (!usrdatum)
                         return 0;
 
-                if (!ebitmap_get_bit(&usrdatum->roles,
-                                     c->role - 1))
+                if (!ebitmap_get_bit(&usrdatum->roles, c->role - 1))
                         /* user may not be associated with role */
                         return 0;
         }
@@ -870,20 +963,22 @@ static int mls_read_range_helper(struct mls_range *r, void *fp)
         int rc;
 
         rc = next_entry(buf, fp, sizeof(u32));
-        if (rc < 0)
+        if (rc)
                 goto out;
 
+        rc = -EINVAL;
         items = le32_to_cpu(buf[0]);
         if (items > ARRAY_SIZE(buf)) {
                 printk(KERN_ERR "SELinux: mls:  range overflow\n");
-                rc = -EINVAL;
                 goto out;
         }
+
         rc = next_entry(buf, fp, sizeof(u32) * items);
-        if (rc < 0) {
+        if (rc) {
                 printk(KERN_ERR "SELinux: mls:  truncated range\n");
                 goto out;
         }
+
         r->level[0].sens = le32_to_cpu(buf[0]);
         if (items > 1)
                 r->level[1].sens = le32_to_cpu(buf[1]);
@@ -892,15 +987,13 @@ static int mls_read_range_helper(struct mls_range *r, void *fp)
 
         rc = ebitmap_read(&r->level[0].cat, fp);
         if (rc) {
-                printk(KERN_ERR "SELinux: mls:  error reading low "
-                       "categories\n");
+                printk(KERN_ERR "SELinux: mls:  error reading low categories\n");
                 goto out;
         }
         if (items > 1) {
                 rc = ebitmap_read(&r->level[1].cat, fp);
                 if (rc) {
-                        printk(KERN_ERR "SELinux: mls:  error reading high "
-                               "categories\n");
+                        printk(KERN_ERR "SELinux: mls:  error reading high categories\n");
                         goto bad_high;
                 }
         } else {
@@ -911,12 +1004,11 @@ static int mls_read_range_helper(struct mls_range *r, void *fp)
                 }
         }
 
-        rc = 0;
-out:
-        return rc;
+        return 0;
 bad_high:
         ebitmap_destroy(&r->level[0].cat);
-        goto out;
+out:
+        return rc;
 }
 
 /*
@@ -931,7 +1023,7 @@ static int context_read_and_validate(struct context *c,
         int rc;
 
         rc = next_entry(buf, fp, sizeof buf);
-        if (rc < 0) {
+        if (rc) {
                 printk(KERN_ERR "SELinux: context truncated\n");
                 goto out;
         }
@@ -939,19 +1031,20 @@ static int context_read_and_validate(struct context *c,
         c->role = le32_to_cpu(buf[1]);
         c->type = le32_to_cpu(buf[2]);
         if (p->policyvers >= POLICYDB_VERSION_MLS) {
-                if (mls_read_range_helper(&c->range, fp)) {
-                        printk(KERN_ERR "SELinux: error reading MLS range of "
-                               "context\n");
-                        rc = -EINVAL;
+                rc = mls_read_range_helper(&c->range, fp);
+                if (rc) {
+                        printk(KERN_ERR "SELinux: error reading MLS range of context\n");
                         goto out;
                 }
         }
 
+        rc = -EINVAL;
         if (!policydb_context_isvalid(p, c)) {
                 printk(KERN_ERR "SELinux:  invalid security context\n");
                 context_destroy(c);
-                rc = -EINVAL;
+                goto out;
         }
+        rc = 0;
 out:
         return rc;
 }
@@ -970,37 +1063,36 @@ static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
         __le32 buf[2];
         u32 len;
 
+        rc = -ENOMEM;
         perdatum = kzalloc(sizeof(*perdatum), GFP_KERNEL);
-        if (!perdatum) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!perdatum)
+                goto bad;
 
         rc = next_entry(buf, fp, sizeof buf);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
         perdatum->value = le32_to_cpu(buf[1]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
+
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
         rc = hashtab_insert(h, key, perdatum);
         if (rc)
                 goto bad;
-out:
-        return rc;
+
+        return 0;
 bad:
         perm_destroy(key, perdatum, NULL);
-        goto out;
+        return rc;
 }
 
 static int common_read(struct policydb *p, struct hashtab *h, void *fp)
@@ -1011,14 +1103,13 @@ static int common_read(struct policydb *p, struct hashtab *h, void *fp)
         u32 len, nel;
         int i, rc;
 
+        rc = -ENOMEM;
         comdatum = kzalloc(sizeof(*comdatum), GFP_KERNEL);
-        if (!comdatum) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!comdatum)
+                goto bad;
 
         rc = next_entry(buf, fp, sizeof buf);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
@@ -1030,13 +1121,13 @@ static int common_read(struct policydb *p, struct hashtab *h, void *fp)
         comdatum->permissions.nprim = le32_to_cpu(buf[2]);
         nel = le32_to_cpu(buf[3]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
+
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
@@ -1049,11 +1140,10 @@ static int common_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = hashtab_insert(h, key, comdatum);
         if (rc)
                 goto bad;
-out:
-        return rc;
+        return 0;
 bad:
         common_destroy(key, comdatum, NULL);
-        goto out;
+        return rc;
 }
 
 static int read_cons_helper(struct constraint_node **nodep, int ncons,
@@ -1077,7 +1167,7 @@ static int read_cons_helper(struct constraint_node **nodep, int ncons,
                         *nodep = c;
 
                 rc = next_entry(buf, fp, (sizeof(u32) * 2));
-                if (rc < 0)
+                if (rc)
                         return rc;
                 c->permissions = le32_to_cpu(buf[0]);
                 nexpr = le32_to_cpu(buf[1]);
@@ -1094,7 +1184,7 @@ static int read_cons_helper(struct constraint_node **nodep, int ncons,
                                 c->expr = e;
 
                         rc = next_entry(buf, fp, (sizeof(u32) * 3));
-                        if (rc < 0)
+                        if (rc)
                                 return rc;
                         e->expr_type = le32_to_cpu(buf[0]);
                         e->attr = le32_to_cpu(buf[1]);
@@ -1122,8 +1212,9 @@ static int read_cons_helper(struct constraint_node **nodep, int ncons,
                                 if (depth == (CEXPR_MAXDEPTH - 1))
                                         return -EINVAL;
                                 depth++;
-                                if (ebitmap_read(&e->names, fp))
-                                        return -EINVAL;
+                                rc = ebitmap_read(&e->names, fp);
+                                if (rc)
+                                        return rc;
                                 break;
                         default:
                                 return -EINVAL;
@@ -1146,14 +1237,13 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
         u32 len, len2, ncons, nel;
         int i, rc;
 
+        rc = -ENOMEM;
         cladatum = kzalloc(sizeof(*cladatum), GFP_KERNEL);
-        if (!cladatum) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!cladatum)
+                goto bad;
 
         rc = next_entry(buf, fp, sizeof(u32)*6);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
@@ -1168,33 +1258,30 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
 
         ncons = le32_to_cpu(buf[5]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
+
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
         if (len2) {
+                rc = -ENOMEM;
                 cladatum->comkey = kmalloc(len2 + 1, GFP_KERNEL);
-                if (!cladatum->comkey) {
-                        rc = -ENOMEM;
+                if (!cladatum->comkey)
                         goto bad;
-                }
                 rc = next_entry(cladatum->comkey, fp, len2);
-                if (rc < 0)
+                if (rc)
                         goto bad;
                 cladatum->comkey[len2] = '\0';
 
-                cladatum->comdatum = hashtab_search(p->p_commons.table,
-                                                    cladatum->comkey);
+                rc = -EINVAL;
+                cladatum->comdatum = hashtab_search(p->p_commons.table, cladatum->comkey);
                 if (!cladatum->comdatum) {
-                        printk(KERN_ERR "SELinux:  unknown common %s\n",
-                               cladatum->comkey);
-                        rc = -EINVAL;
+                        printk(KERN_ERR "SELinux:  unknown common %s\n", cladatum->comkey);
                         goto bad;
                 }
         }
@@ -1211,7 +1298,7 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
         if (p->policyvers >= POLICYDB_VERSION_VALIDATETRANS) {
                 /* grab the validatetrans rules */
                 rc = next_entry(buf, fp, sizeof(u32));
-                if (rc < 0)
+                if (rc)
                         goto bad;
                 ncons = le32_to_cpu(buf[0]);
                 rc = read_cons_helper(&cladatum->validatetrans, ncons, 1, fp);
@@ -1223,12 +1310,10 @@ static int class_read(struct policydb *p, struct hashtab *h, void *fp)
         if (rc)
                 goto bad;
 
-        rc = 0;
-out:
-        return rc;
+        return 0;
 bad:
         cls_destroy(key, cladatum, NULL);
-        goto out;
+        return rc;
 }
 
 static int role_read(struct policydb *p, struct hashtab *h, void *fp)
@@ -1239,17 +1324,16 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
         __le32 buf[3];
         u32 len;
 
+        rc = -ENOMEM;
         role = kzalloc(sizeof(*role), GFP_KERNEL);
-        if (!role) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!role)
+                goto bad;
 
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 to_read = 3;
 
         rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
@@ -1257,13 +1341,13 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 role->bounds = le32_to_cpu(buf[2]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
+
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
@@ -1276,10 +1360,10 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
                 goto bad;
 
         if (strcmp(key, OBJECT_R) == 0) {
+                rc = -EINVAL;
                 if (role->value != OBJECT_R_VAL) {
                         printk(KERN_ERR "SELinux: Role %s has wrong value %d\n",
                                OBJECT_R, role->value);
-                        rc = -EINVAL;
                         goto bad;
                 }
                 rc = 0;
@@ -1289,11 +1373,10 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = hashtab_insert(h, key, role);
         if (rc)
                 goto bad;
-out:
-        return rc;
+        return 0;
 bad:
         role_destroy(key, role, NULL);
-        goto out;
+        return rc;
 }
 
 static int type_read(struct policydb *p, struct hashtab *h, void *fp)
@@ -1304,17 +1387,16 @@ static int type_read(struct policydb *p, struct hashtab *h, void *fp)
         __le32 buf[4];
         u32 len;
 
+        rc = -ENOMEM;
         typdatum = kzalloc(sizeof(*typdatum), GFP_KERNEL);
-        if (!typdatum) {
-                rc = -ENOMEM;
-                return rc;
-        }
+        if (!typdatum)
+                goto bad;
 
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 to_read = 4;
 
         rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
@@ -1332,24 +1414,22 @@ static int type_read(struct policydb *p, struct hashtab *h, void *fp)
                 typdatum->primary = le32_to_cpu(buf[2]);
         }
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
         rc = hashtab_insert(h, key, typdatum);
         if (rc)
                 goto bad;
-out:
-        return rc;
+        return 0;
 bad:
         type_destroy(key, typdatum, NULL);
-        goto out;
+        return rc;
 }
 
 
@@ -1365,22 +1445,18 @@ static int mls_read_level(struct mls_level *lp, void *fp)
         memset(lp, 0, sizeof(*lp));
 
         rc = next_entry(buf, fp, sizeof buf);
-        if (rc < 0) {
+        if (rc) {
                 printk(KERN_ERR "SELinux: mls: truncated level\n");
-                goto bad;
+                return rc;
         }
         lp->sens = le32_to_cpu(buf[0]);
 
-        if (ebitmap_read(&lp->cat, fp)) {
-                printk(KERN_ERR "SELinux: mls:  error reading level "
-                       "categories\n");
-                goto bad;
+        rc = ebitmap_read(&lp->cat, fp);
+        if (rc) {
+                printk(KERN_ERR "SELinux: mls:  error reading level categories\n");
+                return rc;
         }
-
         return 0;
-
-bad:
-        return -EINVAL;
 }
 
 static int user_read(struct policydb *p, struct hashtab *h, void *fp)
@@ -1391,17 +1467,16 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp)
         __le32 buf[3];
         u32 len;
 
+        rc = -ENOMEM;
         usrdatum = kzalloc(sizeof(*usrdatum), GFP_KERNEL);
-        if (!usrdatum) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!usrdatum)
+                goto bad;
 
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 to_read = 3;
 
         rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
@@ -1409,13 +1484,12 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp)
         if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
                 usrdatum->bounds = le32_to_cpu(buf[2]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_KERNEL);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
@@ -1435,11 +1509,10 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp)
         rc = hashtab_insert(h, key, usrdatum);
         if (rc)
                 goto bad;
-out:
-        return rc;
+        return 0;
 bad:
         user_destroy(key, usrdatum, NULL);
-        goto out;
+        return rc;
 }
 
 static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
@@ -1450,47 +1523,43 @@ static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
         __le32 buf[2];
         u32 len;
 
+        rc = -ENOMEM;
         levdatum = kzalloc(sizeof(*levdatum), GFP_ATOMIC);
-        if (!levdatum) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!levdatum)
+                goto bad;
 
         rc = next_entry(buf, fp, sizeof buf);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
         levdatum->isalias = le32_to_cpu(buf[1]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_ATOMIC);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
+        rc = -ENOMEM;
         levdatum->level = kmalloc(sizeof(struct mls_level), GFP_ATOMIC);
-        if (!levdatum->level) {
-                rc = -ENOMEM;
+        if (!levdatum->level)
                 goto bad;
-        }
-        if (mls_read_level(levdatum->level, fp)) {
-                rc = -EINVAL;
+
+        rc = mls_read_level(levdatum->level, fp);
+        if (rc)
                 goto bad;
-        }
 
         rc = hashtab_insert(h, key, levdatum);
         if (rc)
                 goto bad;
-out:
-        return rc;
+        return 0;
 bad:
         sens_destroy(key, levdatum, NULL);
-        goto out;
+        return rc;
 }
 
 static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
@@ -1501,39 +1570,35 @@ static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
         __le32 buf[3];
         u32 len;
 
+        rc = -ENOMEM;
         catdatum = kzalloc(sizeof(*catdatum), GFP_ATOMIC);
-        if (!catdatum) {
-                rc = -ENOMEM;
-                goto out;
-        }
+        if (!catdatum)
+                goto bad;
 
         rc = next_entry(buf, fp, sizeof buf);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
         len = le32_to_cpu(buf[0]);
         catdatum->value = le32_to_cpu(buf[1]);
         catdatum->isalias = le32_to_cpu(buf[2]);
 
+        rc = -ENOMEM;
         key = kmalloc(len + 1, GFP_ATOMIC);
-        if (!key) {
-                rc = -ENOMEM;
+        if (!key)
                 goto bad;
-        }
         rc = next_entry(key, fp, len);
-        if (rc < 0)
+        if (rc)
                 goto bad;
         key[len] = '\0';
 
         rc = hashtab_insert(h, key, catdatum);
         if (rc)
                 goto bad;
-out:
-        return rc;
-
+        return 0;
 bad:
         cat_destroy(key, catdatum, NULL);
-        goto out;
+        return rc;
 }
 
 static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) =
@@ -1574,9 +1639,9 @@ static int user_bounds_sanity_check(void *key, void *datum, void *datap)
                         printk(KERN_ERR
                                "SELinux: boundary violated policy: "
                                "user=%s role=%s bounds=%s\n",
-                               p->p_user_val_to_name[user->value - 1],
-                               p->p_role_val_to_name[bit],
-                               p->p_user_val_to_name[upper->value - 1]);
+                               sym_name(p, SYM_USERS, user->value - 1),
+                               sym_name(p, SYM_ROLES, bit),
+                               sym_name(p, SYM_USERS, upper->value - 1));
 
                         return -EINVAL;
                 }
@@ -1611,9 +1676,9 @@ static int role_bounds_sanity_check(void *key, void *datum, void *datap)
                         printk(KERN_ERR
                                "SELinux: boundary violated policy: "
                                "role=%s type=%s bounds=%s\n",
-                               p->p_role_val_to_name[role->value - 1],
-                               p->p_type_val_to_name[bit],
-                               p->p_role_val_to_name[upper->value - 1]);
+                               sym_name(p, SYM_ROLES, role->value - 1),
+                               sym_name(p, SYM_TYPES, bit),
+                               sym_name(p, SYM_ROLES, upper->value - 1));
 
                         return -EINVAL;
                 }
@@ -1624,11 +1689,11 @@ static int role_bounds_sanity_check(void *key, void *datum, void *datap)
 
 static int type_bounds_sanity_check(void *key, void *datum, void *datap)
 {
-        struct type_datum *upper, *type;
+        struct type_datum *upper;
         struct policydb *p = datap;
         int depth = 0;
 
-        upper = type = datum;
+        upper = datum;
         while (upper->bounds) {
                 if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {
                         printk(KERN_ERR "SELinux: type %s: "
@@ -1637,12 +1702,15 @@ static int type_bounds_sanity_check(void *key, void *datum, void *datap)
                         return -EINVAL;
                 }
 
-                upper = p->type_val_to_struct[upper->bounds - 1];
+                upper = flex_array_get_ptr(p->type_val_to_struct_array,
+                                           upper->bounds - 1);
+                BUG_ON(!upper);
+
                 if (upper->attribute) {
                         printk(KERN_ERR "SELinux: type %s: "
                                "bounded by attribute %s",
                                (char *) key,
-                               p->p_type_val_to_name[upper->value - 1]);
+                               sym_name(p, SYM_TYPES, upper->value - 1));
                         return -EINVAL;
                 }
         }
@@ -1775,7 +1843,7 @@ static int range_read(struct policydb *p, void *fp)
                 rt = NULL;
                 r = NULL;
         }
-        rangetr_hash_eval(p->range_tr);
+        hash_eval(p->range_tr, "rangetr");
         rc = 0;
 out:
         kfree(rt);
@@ -1783,6 +1851,83 @@ out:
         return rc;
 }
 
+static int filename_trans_read(struct policydb *p, void *fp)
+{
+        struct filename_trans *ft;
+        struct filename_trans_datum *otype;
+        char *name;
+        u32 nel, len;
+        __le32 buf[4];
+        int rc, i;
+
+        if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
+                return 0;
+
+        rc = next_entry(buf, fp, sizeof(u32));
+        if (rc)
+                return rc;
+        nel = le32_to_cpu(buf[0]);
+
+        for (i = 0; i < nel; i++) {
+                ft = NULL;
+                otype = NULL;
+                name = NULL;
+
+                rc = -ENOMEM;
+                ft = kzalloc(sizeof(*ft), GFP_KERNEL);
+                if (!ft)
+                        goto out;
+
+                rc = -ENOMEM;
+                otype = kmalloc(sizeof(*otype), GFP_KERNEL);
+                if (!otype)
+                        goto out;
+
+                /* length of the path component string */
+                rc = next_entry(buf, fp, sizeof(u32));
+                if (rc)
+                        goto out;
+                len = le32_to_cpu(buf[0]);
+
+                rc = -ENOMEM;
+                name = kmalloc(len + 1, GFP_KERNEL);
+                if (!name)
+                        goto out;
+
+                ft->name = name;
+
+                /* path component string */
+                rc = next_entry(name, fp, len);
+                if (rc)
+                        goto out;
+                name[len] = 0;
+
+                rc = next_entry(buf, fp, sizeof(u32) * 4);
+                if (rc)
+                        goto out;
+
+                ft->stype = le32_to_cpu(buf[0]);
+                ft->ttype = le32_to_cpu(buf[1]);
+                ft->tclass = le32_to_cpu(buf[2]);
+
+                otype->otype = le32_to_cpu(buf[3]);
+
+                rc = ebitmap_set_bit(&p->filename_trans_ttypes, ft->ttype, 1);
+                if (rc)
+                        goto out;
+
+                hashtab_insert(p->filename_trans, ft, otype);
+        }
+        hash_eval(p->filename_trans, "filenametr");
+        return 0;
+out:
+        kfree(ft);
+        kfree(name);
+        kfree(otype);
+
+        return rc;
+}
+
 static int genfs_read(struct policydb *p, void *fp)
 {
         int i, j, rc;
@@ -2055,13 +2200,14 @@ int policydb_read(struct policydb *p, void *fp)
 
         rc = policydb_init(p);
         if (rc)
-                goto out;
+                return rc;
 
         /* Read the magic number and string length. */
         rc = next_entry(buf, fp, sizeof(u32) * 2);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
+        rc = -EINVAL;
         if (le32_to_cpu(buf[0]) != POLICYDB_MAGIC) {
                 printk(KERN_ERR "SELinux:  policydb magic number 0x%x does "
                        "not match expected magic number 0x%x\n",
@@ -2069,6 +2215,7 @@ int policydb_read(struct policydb *p, void *fp)
                 goto bad;
         }
 
+        rc = -EINVAL;
         len = le32_to_cpu(buf[1]);
         if (len != strlen(POLICYDB_STRING)) {
                 printk(KERN_ERR "SELinux:  policydb string length %d does not "
@@ -2076,19 +2223,23 @@ int policydb_read(struct policydb *p, void *fp)
                        len, strlen(POLICYDB_STRING));
                 goto bad;
         }
+
+        rc = -ENOMEM;
         policydb_str = kmalloc(len + 1, GFP_KERNEL);
         if (!policydb_str) {
                 printk(KERN_ERR "SELinux:  unable to allocate memory for policydb "
                        "string of length %d\n", len);
-                rc = -ENOMEM;
                 goto bad;
         }
+
         rc = next_entry(policydb_str, fp, len);
-        if (rc < 0) {
+        if (rc) {
                 printk(KERN_ERR "SELinux:  truncated policydb string identifier\n");
                 kfree(policydb_str);
                 goto bad;
         }
+
+        rc = -EINVAL;
         policydb_str[len] = '\0';
         if (strcmp(policydb_str, POLICYDB_STRING)) {
                 printk(KERN_ERR "SELinux:  policydb string %s does not match "
@@ -2102,9 +2253,10 @@ int policydb_read(struct policydb *p, void *fp)
 
         /* Read the version and table sizes. */
         rc = next_entry(buf, fp, sizeof(u32)*4);
-        if (rc < 0)
+        if (rc)
                 goto bad;
 
+        rc = -EINVAL;
         p->policyvers = le32_to_cpu(buf[0]);
         if (p->policyvers < POLICYDB_VERSION_MIN ||
             p->policyvers > POLICYDB_VERSION_MAX) {
@@ -2117,6 +2269,7 @@ int policydb_read(struct policydb *p, void *fp)
         if ((le32_to_cpu(buf[1]) & POLICYDB_CONFIG_MLS)) {
                 p->mls_enabled = 1;
 
+                rc = -EINVAL;
                 if (p->policyvers < POLICYDB_VERSION_MLS) {
                         printk(KERN_ERR "SELinux: security policydb version %d "
                                 "(MLS) not backwards compatible\n",
@@ -2127,14 +2280,19 @@ int policydb_read(struct policydb *p, void *fp)
         p->reject_unknown = !!(le32_to_cpu(buf[1]) & REJECT_UNKNOWN);
         p->allow_unknown = !!(le32_to_cpu(buf[1]) & ALLOW_UNKNOWN);
 
-        if (p->policyvers >= POLICYDB_VERSION_POLCAP &&
-            ebitmap_read(&p->policycaps, fp) != 0)
-                goto bad;
+        if (p->policyvers >= POLICYDB_VERSION_POLCAP) {
+                rc = ebitmap_read(&p->policycaps, fp);
+                if (rc)
+                        goto bad;
+        }
 
-        if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE &&
-            ebitmap_read(&p->permissive_map, fp) != 0)
-                goto bad;
+        if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE) {
+                rc = ebitmap_read(&p->permissive_map, fp);
+                if (rc)
+                        goto bad;
+        }
 
+        rc = -EINVAL;
         info = policydb_lookup_compat(p->policyvers);
         if (!info) {
                 printk(KERN_ERR "SELinux:  unable to find policy compat info "
@@ -2142,6 +2300,7 @@ int policydb_read(struct policydb *p, void *fp)
                 goto bad;
         }
 
+        rc = -EINVAL;
         if (le32_to_cpu(buf[2]) != info->sym_num ||
                 le32_to_cpu(buf[3]) != info->ocon_num) {
                 printk(KERN_ERR "SELinux:  policydb table sizes (%d,%d) do "
@@ -2153,7 +2312,7 @@ int policydb_read(struct policydb *p, void *fp)
 
         for (i = 0; i < info->sym_num; i++) {
                 rc = next_entry(buf, fp, sizeof(u32)*2);
-                if (rc < 0)
+                if (rc)
                         goto bad;
                 nprim = le32_to_cpu(buf[0]);
                 nel = le32_to_cpu(buf[1]);
@@ -2166,6 +2325,11 @@ int policydb_read(struct policydb *p, void *fp)
                 p->symtab[i].nprim = nprim;
         }
 
+        rc = -EINVAL;
+        p->process_class = string_to_security_class(p, "process");
+        if (!p->process_class)
+                goto bad;
+
         rc = avtab_read(&p->te_avtab, fp, p);
         if (rc)
                 goto bad;
@@ -2177,78 +2341,81 @@ int policydb_read(struct policydb *p, void *fp)
         }
 
         rc = next_entry(buf, fp, sizeof(u32));
-        if (rc < 0)
+        if (rc)
                 goto bad;
         nel = le32_to_cpu(buf[0]);
         ltr = NULL;
         for (i = 0; i < nel; i++) {
+                rc = -ENOMEM;
                 tr = kzalloc(sizeof(*tr), GFP_KERNEL);
-                if (!tr) {
-                        rc = -ENOMEM;
+                if (!tr)
                         goto bad;
-                }
                 if (ltr)
                         ltr->next = tr;
                 else
                         p->role_tr = tr;
                 rc = next_entry(buf, fp, sizeof(u32)*3);
-                if (rc < 0)
+                if (rc)
                         goto bad;
+
+                rc = -EINVAL;
                 tr->role = le32_to_cpu(buf[0]);
                 tr->type = le32_to_cpu(buf[1]);
                 tr->new_role = le32_to_cpu(buf[2]);
+                if (p->policyvers >= POLICYDB_VERSION_ROLETRANS) {
+                        rc = next_entry(buf, fp, sizeof(u32));
+                        if (rc)
+                                goto bad;
+                        tr->tclass = le32_to_cpu(buf[0]);
+                } else
+                        tr->tclass = p->process_class;
+
                 if (!policydb_role_isvalid(p, tr->role) ||
                     !policydb_type_isvalid(p, tr->type) ||
-                    !policydb_role_isvalid(p, tr->new_role)) {
-                        rc = -EINVAL;
+                    !policydb_class_isvalid(p, tr->tclass) ||
+                    !policydb_role_isvalid(p, tr->new_role))
                         goto bad;
-                }
                 ltr = tr;
         }
 
         rc = next_entry(buf, fp, sizeof(u32));
-        if (rc < 0)
+        if (rc)
                 goto bad;
         nel = le32_to_cpu(buf[0]);
         lra = NULL;
         for (i = 0; i < nel; i++) {
+                rc = -ENOMEM;
                 ra = kzalloc(sizeof(*ra), GFP_KERNEL);
-                if (!ra) {
-                        rc = -ENOMEM;
+                if (!ra)
                         goto bad;
-                }
                 if (lra)
                         lra->next = ra;
                 else
                         p->role_allow = ra;
                 rc = next_entry(buf, fp, sizeof(u32)*2);
-                if (rc < 0)
+                if (rc)
                         goto bad;
+
+                rc = -EINVAL;
                 ra->role = le32_to_cpu(buf[0]);
                 ra->new_role = le32_to_cpu(buf[1]);
                 if (!policydb_role_isvalid(p, ra->role) ||
-                    !policydb_role_isvalid(p, ra->new_role)) {
-                        rc = -EINVAL;
+                    !policydb_role_isvalid(p, ra->new_role))
                         goto bad;
-                }
                 lra = ra;
         }
 
-        rc = policydb_index_classes(p);
+        rc = filename_trans_read(p, fp);
         if (rc)
                 goto bad;
 
-        rc = policydb_index_others(p);
+        rc = policydb_index(p);
         if (rc)
                 goto bad;
 
-        p->process_class = string_to_security_class(p, "process");
-        if (!p->process_class)
-                goto bad;
-        p->process_trans_perms = string_to_av_perm(p, p->process_class,
-                                                   "transition");
-        p->process_trans_perms |= string_to_av_perm(p, p->process_class,
-                                                    "dyntransition");
+        rc = -EINVAL;
+        p->process_trans_perms = string_to_av_perm(p, p->process_class, "transition");
+        p->process_trans_perms |= string_to_av_perm(p, p->process_class, "dyntransition");
         if (!p->process_trans_perms)
                 goto bad;
 
@@ -2272,7 +2439,7 @@ int policydb_read(struct policydb *p, void *fp)
                 goto bad;
 
         /* preallocate so we don't have to worry about the put ever failing */
-        rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim - 1,
+        rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim,
                                  GFP_KERNEL | __GFP_ZERO);
         if (rc)
                 goto bad;
@@ -2301,8 +2468,914 @@ int policydb_read(struct policydb *p, void *fp)
 out:
         return rc;
 bad:
-        if (!rc)
-                rc = -EINVAL;
         policydb_destroy(p);
         goto out;
 }
+
+/*
+ * Write a MLS level structure to a policydb binary
+ * representation file.
+ */
+static int mls_write_level(struct mls_level *l, void *fp)
+{
+        __le32 buf[1];
+        int rc;
+
+        buf[0] = cpu_to_le32(l->sens);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        rc = ebitmap_write(&l->cat, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+/*
+ * Write a MLS range structure to a policydb binary
+ * representation file.
+ */
+static int mls_write_range_helper(struct mls_range *r, void *fp)
+{
+        __le32 buf[3];
+        size_t items;
+        int rc, eq;
+
+        eq = mls_level_eq(&r->level[1], &r->level[0]);
+
+        if (eq)
+                items = 2;
+        else
+                items = 3;
+        buf[0] = cpu_to_le32(items-1);
+        buf[1] = cpu_to_le32(r->level[0].sens);
+        if (!eq)
+                buf[2] = cpu_to_le32(r->level[1].sens);
+
+        BUG_ON(items > (sizeof(buf)/sizeof(buf[0])));
+
+        rc = put_entry(buf, sizeof(u32), items, fp);
+        if (rc)
+                return rc;
+
+        rc = ebitmap_write(&r->level[0].cat, fp);
+        if (rc)
+                return rc;
+        if (!eq) {
+                rc = ebitmap_write(&r->level[1].cat, fp);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
+
+static int sens_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct level_datum *levdatum = datum;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        __le32 buf[2];
+        size_t len;
+        int rc;
+
+        len = strlen(key);
+        buf[0] = cpu_to_le32(len);
+        buf[1] = cpu_to_le32(levdatum->isalias);
+        rc = put_entry(buf, sizeof(u32), 2, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        rc = mls_write_level(levdatum->level, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int cat_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct cat_datum *catdatum = datum;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        __le32 buf[3];
+        size_t len;
+        int rc;
+
+        len = strlen(key);
+        buf[0] = cpu_to_le32(len);
+        buf[1] = cpu_to_le32(catdatum->value);
+        buf[2] = cpu_to_le32(catdatum->isalias);
+        rc = put_entry(buf, sizeof(u32), 3, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int role_trans_write(struct policydb *p, void *fp)
+{
+        struct role_trans *r = p->role_tr;
+        struct role_trans *tr;
+        u32 buf[3];
+        size_t nel;
+        int rc;
+
+        nel = 0;
+        for (tr = r; tr; tr = tr->next)
+                nel++;
+        buf[0] = cpu_to_le32(nel);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+        for (tr = r; tr; tr = tr->next) {
+                buf[0] = cpu_to_le32(tr->role);
+                buf[1] = cpu_to_le32(tr->type);
+                buf[2] = cpu_to_le32(tr->new_role);
+                rc = put_entry(buf, sizeof(u32), 3, fp);
+                if (rc)
+                        return rc;
+                if (p->policyvers >= POLICYDB_VERSION_ROLETRANS) {
+                        buf[0] = cpu_to_le32(tr->tclass);
+                        rc = put_entry(buf, sizeof(u32), 1, fp);
+                        if (rc)
+                                return rc;
+                }
+        }
+
+        return 0;
+}
+
+static int role_allow_write(struct role_allow *r, void *fp)
+{
+        struct role_allow *ra;
+        u32 buf[2];
+        size_t nel;
+        int rc;
+
+        nel = 0;
+        for (ra = r; ra; ra = ra->next)
+                nel++;
+        buf[0] = cpu_to_le32(nel);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+        for (ra = r; ra; ra = ra->next) {
+                buf[0] = cpu_to_le32(ra->role);
+                buf[1] = cpu_to_le32(ra->new_role);
+                rc = put_entry(buf, sizeof(u32), 2, fp);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
+
+/*
+ * Write a security context structure
+ * to a policydb binary representation file.
+ */
+static int context_write(struct policydb *p, struct context *c,
+                         void *fp)
+{
+        int rc;
+        __le32 buf[3];
+
+        buf[0] = cpu_to_le32(c->user);
+        buf[1] = cpu_to_le32(c->role);
+        buf[2] = cpu_to_le32(c->type);
+
+        rc = put_entry(buf, sizeof(u32), 3, fp);
+        if (rc)
+                return rc;
+
+        rc = mls_write_range_helper(&c->range, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+/*
+ * The following *_write functions are used to
+ * write the symbol data to a policy database
+ * binary representation file.
+ */
+
+static int perm_write(void *vkey, void *datum, void *fp)
+{
+        char *key = vkey;
+        struct perm_datum *perdatum = datum;
+        __le32 buf[2];
+        size_t len;
+        int rc;
+
+        len = strlen(key);
+        buf[0] = cpu_to_le32(len);
+        buf[1] = cpu_to_le32(perdatum->value);
+        rc = put_entry(buf, sizeof(u32), 2, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int common_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct common_datum *comdatum = datum;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        __le32 buf[4];
+        size_t len;
+        int rc;
+
+        len = strlen(key);
+        buf[0] = cpu_to_le32(len);
+        buf[1] = cpu_to_le32(comdatum->value);
+        buf[2] = cpu_to_le32(comdatum->permissions.nprim);
+        buf[3] = cpu_to_le32(comdatum->permissions.table->nel);
+        rc = put_entry(buf, sizeof(u32), 4, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        rc = hashtab_map(comdatum->permissions.table, perm_write, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int write_cons_helper(struct policydb *p, struct constraint_node *node,
+                             void *fp)
+{
+        struct constraint_node *c;
+        struct constraint_expr *e;
+        __le32 buf[3];
+        u32 nel;
+        int rc;
+
+        for (c = node; c; c = c->next) {
+                nel = 0;
+                for (e = c->expr; e; e = e->next)
+                        nel++;
+                buf[0] = cpu_to_le32(c->permissions);
+                buf[1] = cpu_to_le32(nel);
+                rc = put_entry(buf, sizeof(u32), 2, fp);
+                if (rc)
+                        return rc;
+                for (e = c->expr; e; e = e->next) {
+                        buf[0] = cpu_to_le32(e->expr_type);
+                        buf[1] = cpu_to_le32(e->attr);
+                        buf[2] = cpu_to_le32(e->op);
+                        rc = put_entry(buf, sizeof(u32), 3, fp);
+                        if (rc)
+                                return rc;
+
+                        switch (e->expr_type) {
+                        case CEXPR_NAMES:
+                                rc = ebitmap_write(&e->names, fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        default:
+                                break;
+                        }
+                }
+        }
+
+        return 0;
+}
+
+static int class_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct class_datum *cladatum = datum;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        struct policydb *p = pd->p;
+        struct constraint_node *c;
+        __le32 buf[6];
+        u32 ncons;
+        size_t len, len2;
+        int rc;
+
+        len = strlen(key);
+        if (cladatum->comkey)
+                len2 = strlen(cladatum->comkey);
+        else
+                len2 = 0;
+
+        ncons = 0;
+        for (c = cladatum->constraints; c; c = c->next)
+                ncons++;
+
+        buf[0] = cpu_to_le32(len);
+        buf[1] = cpu_to_le32(len2);
+        buf[2] = cpu_to_le32(cladatum->value);
+        buf[3] = cpu_to_le32(cladatum->permissions.nprim);
+        if (cladatum->permissions.table)
+                buf[4] = cpu_to_le32(cladatum->permissions.table->nel);
+        else
+                buf[4] = 0;
+        buf[5] = cpu_to_le32(ncons);
+        rc = put_entry(buf, sizeof(u32), 6, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        if (cladatum->comkey) {
+                rc = put_entry(cladatum->comkey, 1, len2, fp);
+                if (rc)
+                        return rc;
+        }
+
+        rc = hashtab_map(cladatum->permissions.table, perm_write, fp);
+        if (rc)
+                return rc;
+
+        rc = write_cons_helper(p, cladatum->constraints, fp);
+        if (rc)
+                return rc;
+
+        /* write out the validatetrans rule */
+        ncons = 0;
+        for (c = cladatum->validatetrans; c; c = c->next)
+                ncons++;
+
+        buf[0] = cpu_to_le32(ncons);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        rc = write_cons_helper(p, cladatum->validatetrans, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int role_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct role_datum *role = datum;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        struct policydb *p = pd->p;
+        __le32 buf[3];
+        size_t items, len;
+        int rc;
+
+        len = strlen(key);
+        items = 0;
+        buf[items++] = cpu_to_le32(len);
+        buf[items++] = cpu_to_le32(role->value);
+        if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
+                buf[items++] = cpu_to_le32(role->bounds);
+
+        BUG_ON(items > (sizeof(buf)/sizeof(buf[0])));
+
+        rc = put_entry(buf, sizeof(u32), items, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        rc = ebitmap_write(&role->dominates, fp);
+        if (rc)
+                return rc;
+
+        rc = ebitmap_write(&role->types, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int type_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct type_datum *typdatum = datum;
+        struct policy_data *pd = ptr;
+        struct policydb *p = pd->p;
+        void *fp = pd->fp;
+        __le32 buf[4];
+        int rc;
+        size_t items, len;
+
+        len = strlen(key);
+        items = 0;
+        buf[items++] = cpu_to_le32(len);
+        buf[items++] = cpu_to_le32(typdatum->value);
+        if (p->policyvers >= POLICYDB_VERSION_BOUNDARY) {
+                u32 properties = 0;
+
+                if (typdatum->primary)
+                        properties |= TYPEDATUM_PROPERTY_PRIMARY;
+
+                if (typdatum->attribute)
+                        properties |= TYPEDATUM_PROPERTY_ATTRIBUTE;
+
+                buf[items++] = cpu_to_le32(properties);
+                buf[items++] = cpu_to_le32(typdatum->bounds);
+        } else {
+                buf[items++] = cpu_to_le32(typdatum->primary);
+        }
+        BUG_ON(items > (sizeof(buf) / sizeof(buf[0])));
+        rc = put_entry(buf, sizeof(u32), items, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int user_write(void *vkey, void *datum, void *ptr)
+{
+        char *key = vkey;
+        struct user_datum *usrdatum = datum;
+        struct policy_data *pd = ptr;
+        struct policydb *p = pd->p;
+        void *fp = pd->fp;
+        __le32 buf[3];
+        size_t items, len;
+        int rc;
+
+        len = strlen(key);
+        items = 0;
+        buf[items++] = cpu_to_le32(len);
+        buf[items++] = cpu_to_le32(usrdatum->value);
+        if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)
+                buf[items++] = cpu_to_le32(usrdatum->bounds);
+        BUG_ON(items > (sizeof(buf) / sizeof(buf[0])));
+        rc = put_entry(buf, sizeof(u32), items, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(key, 1, len, fp);
+        if (rc)
+                return rc;
+
+        rc = ebitmap_write(&usrdatum->roles, fp);
+        if (rc)
+                return rc;
+
+        rc = mls_write_range_helper(&usrdatum->range, fp);
+        if (rc)
+                return rc;
+
+        rc = mls_write_level(&usrdatum->dfltlevel, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int (*write_f[SYM_NUM]) (void *key, void *datum,
+                                void *datap) =
+{
+        common_write,
+        class_write,
+        role_write,
+        type_write,
+        user_write,
+        cond_write_bool,
+        sens_write,
+        cat_write,
+};
+
+static int ocontext_write(struct policydb *p, struct policydb_compat_info *info,
+                          void *fp)
+{
+        unsigned int i, j, rc;
+        size_t nel, len;
+        __le32 buf[3];
+        u32 nodebuf[8];
+        struct ocontext *c;
+        for (i = 0; i < info->ocon_num; i++) {
+                nel = 0;
+                for (c = p->ocontexts[i]; c; c = c->next)
+                        nel++;
+                buf[0] = cpu_to_le32(nel);
+                rc = put_entry(buf, sizeof(u32), 1, fp);
+                if (rc)
+                        return rc;
+                for (c = p->ocontexts[i]; c; c = c->next) {
+                        switch (i) {
+                        case OCON_ISID:
+                                buf[0] = cpu_to_le32(c->sid[0]);
+                                rc = put_entry(buf, sizeof(u32), 1, fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[0], fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        case OCON_FS:
+                        case OCON_NETIF:
+                                len = strlen(c->u.name);
+                                buf[0] = cpu_to_le32(len);
+                                rc = put_entry(buf, sizeof(u32), 1, fp);
+                                if (rc)
+                                        return rc;
+                                rc = put_entry(c->u.name, 1, len, fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[0], fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[1], fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        case OCON_PORT:
+                                buf[0] = cpu_to_le32(c->u.port.protocol);
+                                buf[1] = cpu_to_le32(c->u.port.low_port);
+                                buf[2] = cpu_to_le32(c->u.port.high_port);
+                                rc = put_entry(buf, sizeof(u32), 3, fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[0], fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        case OCON_NODE:
+                                nodebuf[0] = c->u.node.addr; /* network order */
+                                nodebuf[1] = c->u.node.mask; /* network order */
+                                rc = put_entry(nodebuf, sizeof(u32), 2, fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[0], fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        case OCON_FSUSE:
+                                buf[0] = cpu_to_le32(c->v.behavior);
+                                len = strlen(c->u.name);
+                                buf[1] = cpu_to_le32(len);
+                                rc = put_entry(buf, sizeof(u32), 2, fp);
+                                if (rc)
+                                        return rc;
+                                rc = put_entry(c->u.name, 1, len, fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[0], fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        case OCON_NODE6:
+                                for (j = 0; j < 4; j++)
+                                        nodebuf[j] = c->u.node6.addr[j]; /* network order */
+                                for (j = 0; j < 4; j++)
+                                        nodebuf[j + 4] = c->u.node6.mask[j]; /* network order */
+                                rc = put_entry(nodebuf, sizeof(u32), 8, fp);
+                                if (rc)
+                                        return rc;
+                                rc = context_write(p, &c->context[0], fp);
+                                if (rc)
+                                        return rc;
+                                break;
+                        }
+                }
+        }
+        return 0;
+}
+
+static int genfs_write(struct policydb *p, void *fp)
+{
+        struct genfs *genfs;
+        struct ocontext *c;
+        size_t len;
+        __le32 buf[1];
+        int rc;
+
+        len = 0;
+        for (genfs = p->genfs; genfs; genfs = genfs->next)
+                len++;
+        buf[0] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+        for (genfs = p->genfs; genfs; genfs = genfs->next) {
+                len = strlen(genfs->fstype);
+                buf[0] = cpu_to_le32(len);
+                rc = put_entry(buf, sizeof(u32), 1, fp);
+                if (rc)
+                        return rc;
+                rc = put_entry(genfs->fstype, 1, len, fp);
+                if (rc)
+                        return rc;
+                len = 0;
+                for (c = genfs->head; c; c = c->next)
+                        len++;
+                buf[0] = cpu_to_le32(len);
+                rc = put_entry(buf, sizeof(u32), 1, fp);
+                if (rc)
+                        return rc;
+                for (c = genfs->head; c; c = c->next) {
+                        len = strlen(c->u.name);
+                        buf[0] = cpu_to_le32(len);
+                        rc = put_entry(buf, sizeof(u32), 1, fp);
+                        if (rc)
+                                return rc;
+                        rc = put_entry(c->u.name, 1, len, fp);
+                        if (rc)
+                                return rc;
+                        buf[0] = cpu_to_le32(c->v.sclass);
+                        rc = put_entry(buf, sizeof(u32), 1, fp);
+                        if (rc)
+                                return rc;
+                        rc = context_write(p, &c->context[0], fp);
+                        if (rc)
+                                return rc;
+                }
+        }
+        return 0;
+}
+
+static int hashtab_cnt(void *key, void *data, void *ptr)
+{
+        int *cnt = ptr;
+        *cnt = *cnt + 1;
+
+        return 0;
+}
+
+static int range_write_helper(void *key, void *data, void *ptr)
+{
+        __le32 buf[2];
+        struct range_trans *rt = key;
+        struct mls_range *r = data;
+        struct policy_data *pd = ptr;
+        void *fp = pd->fp;
+        struct policydb *p = pd->p;
+        int rc;
+
+        buf[0] = cpu_to_le32(rt->source_type);
+        buf[1] = cpu_to_le32(rt->target_type);
+        rc = put_entry(buf, sizeof(u32), 2, fp);
+        if (rc)
+                return rc;
+        if (p->policyvers >= POLICYDB_VERSION_RANGETRANS) {
+                buf[0] = cpu_to_le32(rt->target_class);
+                rc = put_entry(buf, sizeof(u32), 1, fp);
+                if (rc)
+                        return rc;
+        }
+        rc = mls_write_range_helper(r, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int range_write(struct policydb *p, void *fp)
+{
+        size_t nel;
+        __le32 buf[1];
+        int rc;
+        struct policy_data pd;
+
+        pd.p = p;
+        pd.fp = fp;
+
+        /* count the number of entries in the hashtab */
+        nel = 0;
+        rc = hashtab_map(p->range_tr, hashtab_cnt, &nel);
+        if (rc)
+                return rc;
+
+        buf[0] = cpu_to_le32(nel);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        /* actually write all of the entries */
+        rc = hashtab_map(p->range_tr, range_write_helper, &pd);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int filename_write_helper(void *key, void *data, void *ptr)
+{
+        __le32 buf[4];
+        struct filename_trans *ft = key;
+        struct filename_trans_datum *otype = data;
+        void *fp = ptr;
+        int rc;
+        u32 len;
+
+        len = strlen(ft->name);
+        buf[0] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        rc = put_entry(ft->name, sizeof(char), len, fp);
+        if (rc)
+                return rc;
+
+        buf[0] = ft->stype;
+        buf[1] = ft->ttype;
+        buf[2] = ft->tclass;
+        buf[3] = otype->otype;
+
+        rc = put_entry(buf, sizeof(u32), 4, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+static int filename_trans_write(struct policydb *p, void *fp)
+{
+        u32 nel;
+        __le32 buf[1];
+        int rc;
+
+        if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
+                return 0;
+
+        nel = 0;
+        rc = hashtab_map(p->filename_trans, hashtab_cnt, &nel);
+        if (rc)
+                return rc;
+
+        buf[0] = cpu_to_le32(nel);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        rc = hashtab_map(p->filename_trans, filename_write_helper, fp);
+        if (rc)
+                return rc;
+
+        return 0;
+}
+
+/*
+ * Write the configuration data in a policy database
+ * structure to a policy database binary representation
+ * file.
+ */
+int policydb_write(struct policydb *p, void *fp)
+{
+        unsigned int i, num_syms;
+        int rc;
+        __le32 buf[4];
+        u32 config;
+        size_t len;
+        struct policydb_compat_info *info;
+
+        /*
+         * refuse to write policy older than compressed avtab
+         * to simplify the writer.  There are other tests dropped
+         * since we assume this throughout the writer code.  Be
+         * careful if you ever try to remove this restriction
+         */
+        if (p->policyvers < POLICYDB_VERSION_AVTAB) {
+                printk(KERN_ERR "SELinux: refusing to write policy version %d."
+                       "  Because it is less than version %d\n", p->policyvers,
+                       POLICYDB_VERSION_AVTAB);
+                return -EINVAL;
+        }
+
+        config = 0;
+        if (p->mls_enabled)
+                config |= POLICYDB_CONFIG_MLS;
+
+        if (p->reject_unknown)
+                config |= REJECT_UNKNOWN;
+        if (p->allow_unknown)
+                config |= ALLOW_UNKNOWN;
+
+        /* Write the magic number and string identifiers. */
+        buf[0] = cpu_to_le32(POLICYDB_MAGIC);
+        len = strlen(POLICYDB_STRING);
+        buf[1] = cpu_to_le32(len);
+        rc = put_entry(buf, sizeof(u32), 2, fp);
+        if (rc)
+                return rc;
+        rc = put_entry(POLICYDB_STRING, 1, len, fp);
+        if (rc)
+                return rc;
+
+        /* Write the version, config, and table sizes. */
+        info = policydb_lookup_compat(p->policyvers);
+        if (!info) {
+                printk(KERN_ERR "SELinux: compatibility lookup failed for policy "
+                    "version %d", p->policyvers);
+                return -EINVAL;
+        }
+
+        buf[0] = cpu_to_le32(p->policyvers);
+        buf[1] = cpu_to_le32(config);
+        buf[2] = cpu_to_le32(info->sym_num);
+        buf[3] = cpu_to_le32(info->ocon_num);
+
+        rc = put_entry(buf, sizeof(u32), 4, fp);
+        if (rc)
+                return rc;
+
+        if (p->policyvers >= POLICYDB_VERSION_POLCAP) {
+                rc = ebitmap_write(&p->policycaps, fp);
+                if (rc)
+                        return rc;
+        }
+
+        if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE) {
+                rc = ebitmap_write(&p->permissive_map, fp);
+                if (rc)
+                        return rc;
+        }
+
+        num_syms = info->sym_num;
+        for (i = 0; i < num_syms; i++) {
+                struct policy_data pd;
+
+                pd.fp = fp;
+                pd.p = p;
+
+                buf[0] = cpu_to_le32(p->symtab[i].nprim);
+                buf[1] = cpu_to_le32(p->symtab[i].table->nel);
+
+                rc = put_entry(buf, sizeof(u32), 2, fp);
+                if (rc)
+                        return rc;
+                rc = hashtab_map(p->symtab[i].table, write_f[i], &pd);
+                if (rc)
+                        return rc;
+        }
+
+        rc = avtab_write(p, &p->te_avtab, fp);
+        if (rc)
+                return rc;
+
+        rc = cond_write_list(p, p->cond_list, fp);
+        if (rc)
+                return rc;
+
+        rc = role_trans_write(p, fp);
+        if (rc)
+                return rc;
+
+        rc = role_allow_write(p->role_allow, fp);
+        if (rc)
+                return rc;
+
+        rc = filename_trans_write(p, fp);
+        if (rc)
+                return rc;
+
+        rc = ocontext_write(p, info, fp);
+        if (rc)
+                return rc;
+
+        rc = genfs_write(p, fp);
+        if (rc)
+                return rc;
+
+        rc = range_write(p, fp);
+        if (rc)
+                return rc;
+
+        for (i = 0; i < p->p_types.nprim; i++) {
+                struct ebitmap *e = flex_array_get(p->type_attr_map_array, i);
+
+                BUG_ON(!e);
+                rc = ebitmap_write(e, fp);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index 310e94442cb8..b846c0387180 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -72,11 +72,23 @@ struct role_datum {
 
 struct role_trans {
         u32 role;               /* current role */
-        u32 type;               /* program executable type */
+        u32 type;               /* program executable type, or new object type */
+        u32 tclass;             /* process class, or new object class */
         u32 new_role;           /* new role */
         struct role_trans *next;
 };
 
+struct filename_trans {
+        u32 stype;              /* current process */
+        u32 ttype;              /* parent dir context */
+        u16 tclass;             /* class of new object */
+        const char *name;       /* last path component */
+};
+
+struct filename_trans_datum {
+        u32 otype;              /* expected of new object */
+};
+
 struct role_allow {
         u32 role;               /* current role */
         u32 new_role;           /* new role */
@@ -203,21 +215,13 @@ struct policydb {
 #define p_cats symtab[SYM_CATS]
 
         /* symbol names indexed by (value - 1) */
-        char **sym_val_to_name[SYM_NUM];
-#define p_common_val_to_name sym_val_to_name[SYM_COMMONS]
-#define p_class_val_to_name sym_val_to_name[SYM_CLASSES]
-#define p_role_val_to_name sym_val_to_name[SYM_ROLES]
-#define p_type_val_to_name sym_val_to_name[SYM_TYPES]
-#define p_user_val_to_name sym_val_to_name[SYM_USERS]
-#define p_bool_val_to_name sym_val_to_name[SYM_BOOLS]
-#define p_sens_val_to_name sym_val_to_name[SYM_LEVELS]
-#define p_cat_val_to_name sym_val_to_name[SYM_CATS]
+        struct flex_array *sym_val_to_name[SYM_NUM];
 
         /* class, role, and user attributes indexed by (value - 1) */
         struct class_datum **class_val_to_struct;
         struct role_datum **role_val_to_struct;
         struct user_datum **user_val_to_struct;
-        struct type_datum **type_val_to_struct;
+        struct flex_array *type_val_to_struct_array;
 
         /* type enforcement access vectors and transitions */
         struct avtab te_avtab;
@@ -225,6 +229,12 @@ struct policydb {
         /* role transitions */
         struct role_trans *role_tr;
 
+        /* file transitions with the last path component */
+        /* quickly exclude lookups when parent ttype has no rules */
+        struct ebitmap filename_trans_ttypes;
+        /* actual set of filename_trans rules */
+        struct hashtab *filename_trans;
+
         /* bools indexed by (value - 1) */
         struct cond_bool_datum **bool_val_to_struct;
         /* type enforcement conditional access vectors and transitions */
@@ -254,6 +264,9 @@ struct policydb {
 
         struct ebitmap permissive_map;
 
+        /* length of this policy when it was loaded */
+        size_t len;
+
         unsigned int policyvers;
 
         unsigned int reject_unknown : 1;
@@ -270,6 +283,7 @@ extern int policydb_class_isvalid(struct policydb *p, unsigned int class);
 extern int policydb_type_isvalid(struct policydb *p, unsigned int type);
 extern int policydb_role_isvalid(struct policydb *p, unsigned int role);
 extern int policydb_read(struct policydb *p, void *fp);
+extern int policydb_write(struct policydb *p, void *fp);
 
 #define PERM_SYMTAB_SIZE 32
 
@@ -290,6 +304,11 @@ struct policy_file {
         size_t len;
 };
 
+struct policy_data {
+        struct policydb *p;
+        void *fp;
+};
+
 static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
 {
         if (bytes > fp->len)
@@ -301,6 +320,24 @@ static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
         return 0;
 }
 
+static inline int put_entry(const void *buf, size_t bytes, int num, struct policy_file *fp)
+{
+        size_t len = bytes * num;
+
+        memcpy(fp->data, buf, len);
+        fp->data += len;
+        fp->len -= len;
+
+        return 0;
+}
+
+static inline char *sym_name(struct policydb *p, unsigned int sym_num, unsigned int element_nr)
+{
+        struct flex_array *fa = p->sym_val_to_name[sym_num];
+
+        return flex_array_get_ptr(fa, element_nr);
+}
+
 extern u16 string_to_security_class(struct policydb *p, const char *name);
 extern u32 string_to_av_perm(struct policydb *p, u16 tclass, const char *name);
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 9ea2feca3cd4..973e00e34fa9 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -51,6 +51,7 @@
 #include <linux/mutex.h>
 #include <linux/selinux.h>
 #include <linux/flex_array.h>
+#include <linux/vmalloc.h>
 #include <net/netlabel.h>
 
 #include "flask.h"
@@ -200,6 +201,21 @@ static u16 unmap_class(u16 tclass)
         return tclass;
 }
 
+/*
+ * Get kernel value for class from its policy value
+ */
+static u16 map_class(u16 pol_value)
+{
+        u16 i;
+
+        for (i = 1; i < current_mapping_size; i++) {
+                if (current_mapping[i].value == pol_value)
+                        return i;
+        }
+
+        return SECCLASS_NULL;
+}
+
 static void map_decision(u16 tclass, struct av_decision *avd,
                          int allow_unknown)
 {
@@ -463,7 +479,7 @@ static void security_dump_masked_av(struct context *scontext,
         if (!permissions)
                 return;
 
-        tclass_name = policydb.p_class_val_to_name[tclass - 1];
+        tclass_name = sym_name(&policydb, SYM_CLASSES, tclass - 1);
         tclass_dat = policydb.class_val_to_struct[tclass - 1];
         common_dat = tclass_dat->comdatum;
 
@@ -529,12 +545,18 @@ static void type_attribute_bounds_av(struct context *scontext,
         struct context lo_scontext;
         struct context lo_tcontext;
         struct av_decision lo_avd;
-        struct type_datum *source
-                = policydb.type_val_to_struct[scontext->type - 1];
-        struct type_datum *target
-                = policydb.type_val_to_struct[tcontext->type - 1];
+        struct type_datum *source;
+        struct type_datum *target;
         u32 masked = 0;
 
+        source = flex_array_get_ptr(policydb.type_val_to_struct_array,
+                                    scontext->type - 1);
+        BUG_ON(!source);
+
+        target = flex_array_get_ptr(policydb.type_val_to_struct_array,
+                                    tcontext->type - 1);
+        BUG_ON(!target);
+
         if (source->bounds) {
                 memset(&lo_avd, 0, sizeof(lo_avd));
 
@@ -700,16 +722,16 @@ static int security_validtrans_handle_fail(struct context *ocontext,
         char *o = NULL, *n = NULL, *t = NULL;
         u32 olen, nlen, tlen;
 
-        if (context_struct_to_string(ocontext, &o, &olen) < 0)
+        if (context_struct_to_string(ocontext, &o, &olen))
                 goto out;
-        if (context_struct_to_string(ncontext, &n, &nlen) < 0)
+        if (context_struct_to_string(ncontext, &n, &nlen))
                 goto out;
-        if (context_struct_to_string(tcontext, &t, &tlen) < 0)
+        if (context_struct_to_string(tcontext, &t, &tlen))
                 goto out;
         audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
                   "security_validate_transition:  denied for"
                   " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
-                  o, n, t, policydb.p_class_val_to_name[tclass-1]);
+                  o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
 out:
         kfree(o);
         kfree(n);
@@ -800,10 +822,11 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
         struct context *old_context, *new_context;
         struct type_datum *type;
         int index;
-        int rc = -EINVAL;
+        int rc;
 
         read_lock(&policy_rwlock);
 
+        rc = -EINVAL;
         old_context = sidtab_search(&sidtab, old_sid);
         if (!old_context) {
                 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
@@ -811,6 +834,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
                 goto out;
         }
 
+        rc = -EINVAL;
         new_context = sidtab_search(&sidtab, new_sid);
         if (!new_context) {
                 printk(KERN_ERR "SELinux: %s: unrecognized SID %u\n",
@@ -818,28 +842,27 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
                 goto out;
         }
 
+        rc = 0;
         /* type/domain unchanged */
-        if (old_context->type == new_context->type) {
-                rc = 0;
+        if (old_context->type == new_context->type)
                 goto out;
-        }
 
         index = new_context->type;
         while (true) {
-                type = policydb.type_val_to_struct[index - 1];
+                type = flex_array_get_ptr(policydb.type_val_to_struct_array,
+                                          index - 1);
                 BUG_ON(!type);
 
                 /* not bounded anymore */
-                if (!type->bounds) {
-                        rc = -EPERM;
+                rc = -EPERM;
+                if (!type->bounds)
                         break;
-                }
 
                 /* @newsid is bounded by @oldsid */
-                if (type->bounds == old_context->type) {
-                        rc = 0;
+                rc = 0;
+                if (type->bounds == old_context->type)
                         break;
-                }
+
                 index = type->bounds;
         }
 
@@ -991,7 +1014,8 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
 {
         char *scontextp;
 
-        *scontext = NULL;
+        if (scontext)
+                *scontext = NULL;
         *scontext_len = 0;
 
         if (context->len) {
@@ -1003,11 +1027,14 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
         }
 
         /* Compute the size of the context. */
-        *scontext_len += strlen(policydb.p_user_val_to_name[context->user - 1]) + 1;
-        *scontext_len += strlen(policydb.p_role_val_to_name[context->role - 1]) + 1;
-        *scontext_len += strlen(policydb.p_type_val_to_name[context->type - 1]) + 1;
+        *scontext_len += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) + 1;
+        *scontext_len += strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) + 1;
+        *scontext_len += strlen(sym_name(&policydb, SYM_TYPES, context->type - 1)) + 1;
         *scontext_len += mls_compute_context_len(context);
 
+        if (!scontext)
+                return 0;
+
         /* Allocate space for the context; caller must free this space. */
         scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
         if (!scontextp)
@@ -1018,12 +1045,12 @@ static int context_struct_to_string(struct context *context, char **scontext, u3
          * Copy the user name, role name and type name into the context.
          */
         sprintf(scontextp, "%s:%s:%s",
-                policydb.p_user_val_to_name[context->user - 1],
-                policydb.p_role_val_to_name[context->role - 1],
-                policydb.p_type_val_to_name[context->type - 1]);
-        scontextp += strlen(policydb.p_user_val_to_name[context->user - 1]) +
-                     1 + strlen(policydb.p_role_val_to_name[context->role - 1]) +
-                     1 + strlen(policydb.p_type_val_to_name[context->type - 1]);
+                sym_name(&policydb, SYM_USERS, context->user - 1),
+                sym_name(&policydb, SYM_ROLES, context->role - 1),
+                sym_name(&policydb, SYM_TYPES, context->type - 1));
+        scontextp += strlen(sym_name(&policydb, SYM_USERS, context->user - 1)) +
+                     1 + strlen(sym_name(&policydb, SYM_ROLES, context->role - 1)) +
+                     1 + strlen(sym_name(&policydb, SYM_TYPES, context->type - 1));
 
         mls_sid_to_context(context, &scontextp);
 
@@ -1047,7 +1074,8 @@ static int security_sid_to_context_core(u32 sid, char **scontext,
         struct context *context;
         int rc = 0;
 
-        *scontext = NULL;
+        if (scontext)
+                *scontext = NULL;
         *scontext_len  = 0;
 
         if (!ss_initialized) {
@@ -1055,6 +1083,8 @@ static int security_sid_to_context_core(u32 sid, char **scontext,
                         char *scontextp;
 
                         *scontext_len = strlen(initial_sid_to_string[sid]) + 1;
+                        if (!scontext)
+                                goto out;
                         scontextp = kmalloc(*scontext_len, GFP_ATOMIC);
                         if (!scontextp) {
                                 rc = -ENOMEM;
@@ -1179,16 +1209,13 @@ static int string_to_context_struct(struct policydb *pol,
         if (rc)
                 goto out;
 
-        if ((p - scontext) < scontext_len) {
-                rc = -EINVAL;
+        rc = -EINVAL;
+        if ((p - scontext) < scontext_len)
                 goto out;
-        }
 
         /* Check the validity of the new context. */
-        if (!policydb_context_isvalid(pol, ctx)) {
-                rc = -EINVAL;
+        if (!policydb_context_isvalid(pol, ctx))
                 goto out;
-        }
         rc = 0;
 out:
         if (rc)
@@ -1227,27 +1254,26 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
 
         if (force) {
                 /* Save another copy for storing in uninterpreted form */
+                rc = -ENOMEM;
                 str = kstrdup(scontext2, gfp_flags);
-                if (!str) {
-                        kfree(scontext2);
-                        return -ENOMEM;
-                }
+                if (!str)
+                        goto out;
         }
 
         read_lock(&policy_rwlock);
-        rc = string_to_context_struct(&policydb, &sidtab,
-                                      scontext2, scontext_len,
-                                      &context, def_sid);
+        rc = string_to_context_struct(&policydb, &sidtab, scontext2,
+                                      scontext_len, &context, def_sid);
         if (rc == -EINVAL && force) {
                 context.str = str;
                 context.len = scontext_len;
                 str = NULL;
         } else if (rc)
-                goto out;
+                goto out_unlock;
         rc = sidtab_context_to_sid(&sidtab, &context, sid);
         context_destroy(&context);
-out:
+out_unlock:
         read_unlock(&policy_rwlock);
+out:
         kfree(scontext2);
         kfree(str);
         return rc;
@@ -1311,18 +1337,18 @@ static int compute_sid_handle_invalid_context(
         char *s = NULL, *t = NULL, *n = NULL;
         u32 slen, tlen, nlen;
 
-        if (context_struct_to_string(scontext, &s, &slen) < 0)
+        if (context_struct_to_string(scontext, &s, &slen))
                 goto out;
-        if (context_struct_to_string(tcontext, &t, &tlen) < 0)
+        if (context_struct_to_string(tcontext, &t, &tlen))
                 goto out;
-        if (context_struct_to_string(newcontext, &n, &nlen) < 0)
+        if (context_struct_to_string(newcontext, &n, &nlen))
                 goto out;
         audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
                   "security_compute_sid:  invalid context %s"
                   " for scontext=%s"
                   " tcontext=%s"
                   " tclass=%s",
-                  n, s, t, policydb.p_class_val_to_name[tclass-1]);
+                  n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
 out:
         kfree(s);
         kfree(t);
@@ -1332,10 +1358,36 @@ out:
         return -EACCES;
 }
 
+static void filename_compute_type(struct policydb *p, struct context *newcontext,
+                                  u32 stype, u32 ttype, u16 tclass,
+                                  const char *objname)
+{
+        struct filename_trans ft;
+        struct filename_trans_datum *otype;
+
+        /*
+         * Most filename trans rules are going to live in specific directories
+         * like /dev or /var/run.  This bitmap will quickly skip rule searches
+         * if the ttype does not contain any rules.
+         */
+        if (!ebitmap_get_bit(&p->filename_trans_ttypes, ttype))
+                return;
+
+        ft.stype = stype;
+        ft.ttype = ttype;
+        ft.tclass = tclass;
+        ft.name = objname;
+
+        otype = hashtab_search(p->filename_trans, &ft);
+        if (otype)
+                newcontext->type = otype->otype;
+}
+
 static int security_compute_sid(u32 ssid,
                                 u32 tsid,
                                 u16 orig_tclass,
                                 u32 specified,
+                                const char *objname,
                                 u32 *out_sid,
                                 bool kern)
 {
@@ -1346,6 +1398,7 @@ static int security_compute_sid(u32 ssid,
         struct avtab_node *node;
         u16 tclass;
         int rc = 0;
+        bool sock;
 
         if (!ss_initialized) {
                 switch (orig_tclass) {
@@ -1363,10 +1416,13 @@ static int security_compute_sid(u32 ssid,
 
         read_lock(&policy_rwlock);
 
-        if (kern)
+        if (kern) {
                 tclass = unmap_class(orig_tclass);
-        else
+                sock = security_is_socket_class(orig_tclass);
+        } else {
                 tclass = orig_tclass;
+                sock = security_is_socket_class(map_class(tclass));
+        }
 
         scontext = sidtab_search(&sidtab, ssid);
         if (!scontext) {
@@ -1397,7 +1453,7 @@ static int security_compute_sid(u32 ssid,
         }
 
         /* Set the role and type to default values. */
-        if (tclass == policydb.process_class) {
+        if ((tclass == policydb.process_class) || (sock == true)) {
                 /* Use the current role and type of process. */
                 newcontext.role = scontext->role;
                 newcontext.type = scontext->type;
@@ -1431,25 +1487,29 @@ static int security_compute_sid(u32 ssid,
                 newcontext.type = avdatum->data;
         }
 
+        /* if we have a objname this is a file trans check so check those rules */
+        if (objname)
+                filename_compute_type(&policydb, &newcontext, scontext->type,
+                                      tcontext->type, tclass, objname);
+
         /* Check for class-specific changes. */
-        if  (tclass == policydb.process_class) {
-                if (specified & AVTAB_TRANSITION) {
-                        /* Look for a role transition rule. */
-                        for (roletr = policydb.role_tr; roletr;
-                             roletr = roletr->next) {
-                                if (roletr->role == scontext->role &&
-                                    roletr->type == tcontext->type) {
-                                        /* Use the role transition rule. */
-                                        newcontext.role = roletr->new_role;
-                                        break;
-                                }
+        if (specified & AVTAB_TRANSITION) {
+                /* Look for a role transition rule. */
+                for (roletr = policydb.role_tr; roletr; roletr = roletr->next) {
+                        if ((roletr->role == scontext->role) &&
+                            (roletr->type == tcontext->type) &&
+                            (roletr->tclass == tclass)) {
+                                /* Use the role transition rule. */
+                                newcontext.role = roletr->new_role;
+                                break;
                         }
                 }
         }
 
         /* Set the MLS attributes.
            This is done last because it may allocate memory. */
-        rc = mls_compute_sid(scontext, tcontext, tclass, specified, &newcontext);
+        rc = mls_compute_sid(scontext, tcontext, tclass, specified,
+                             &newcontext, sock);
         if (rc)
                 goto out_unlock;
 
@@ -1484,22 +1544,18 @@ out:
  * if insufficient memory is available, or %0 if the new SID was
  * computed successfully.
  */
-int security_transition_sid(u32 ssid,
-                            u32 tsid,
-                            u16 tclass,
-                            u32 *out_sid)
+int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
+                            const struct qstr *qstr, u32 *out_sid)
 {
         return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
-                                    out_sid, true);
+                                    qstr ? qstr->name : NULL, out_sid, true);
 }
 
-int security_transition_sid_user(u32 ssid,
-                                 u32 tsid,
-                                 u16 tclass,
-                                 u32 *out_sid)
+int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass,
+                                 const char *objname, u32 *out_sid)
 {
         return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
-                                    out_sid, false);
+                                    objname, out_sid, false);
 }
 
 /**
@@ -1520,8 +1576,8 @@ int security_member_sid(u32 ssid,
                         u16 tclass,
                         u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid,
-                                    false);
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,
+                                    out_sid, false);
 }
 
 /**
@@ -1542,8 +1598,8 @@ int security_change_sid(u32 ssid,
                         u16 tclass,
                         u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid,
-                                    false);
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,
+                                    out_sid, false);
 }
 
 /* Clone the SID into the new SID table. */
@@ -1561,22 +1617,17 @@ static int clone_sid(u32 sid,
 
 static inline int convert_context_handle_invalid_context(struct context *context)
 {
-        int rc = 0;
+        char *s;
+        u32 len;
 
-        if (selinux_enforcing) {
-                rc = -EINVAL;
-        } else {
-                char *s;
-                u32 len;
-
-                if (!context_struct_to_string(context, &s, &len)) {
-                        printk(KERN_WARNING
-                       "SELinux:  Context %s would be invalid if enforcing\n",
-                               s);
-                        kfree(s);
-                }
+        if (selinux_enforcing)
+                return -EINVAL;
+
+        if (!context_struct_to_string(context, &s, &len)) {
+                printk(KERN_WARNING "SELinux:  Context %s would be invalid if enforcing\n", s);
+                kfree(s);
         }
-        return rc;
+        return 0;
 }
 
 struct convert_context_args {
@@ -1613,17 +1664,17 @@ static int convert_context(u32 key,
 
         if (c->str) {
                 struct context ctx;
+
+                rc = -ENOMEM;
                 s = kstrdup(c->str, GFP_KERNEL);
-                if (!s) {
-                        rc = -ENOMEM;
+                if (!s)
                         goto out;
-                }
+
                 rc = string_to_context_struct(args->newp, NULL, s,
                                               c->len, &ctx, SECSID_NULL);
                 kfree(s);
                 if (!rc) {
-                        printk(KERN_INFO
-                       "SELinux:  Context %s became valid (mapped).\n",
+                        printk(KERN_INFO "SELinux:  Context %s became valid (mapped).\n",
                                c->str);
                         /* Replace string with mapped representation. */
                         kfree(c->str);
@@ -1635,8 +1686,7 @@ static int convert_context(u32 key,
                         goto out;
                 } else {
                         /* Other error condition, e.g. ENOMEM. */
-                        printk(KERN_ERR
-                       "SELinux:   Unable to map context %s, rc = %d.\n",
+                        printk(KERN_ERR "SELinux:   Unable to map context %s, rc = %d.\n",
                                c->str, -rc);
                         goto out;
                 }
@@ -1646,25 +1696,26 @@ static int convert_context(u32 key,
         if (rc)
                 goto out;
 
-        rc = -EINVAL;
-
         /* Convert the user. */
+        rc = -EINVAL;
         usrdatum = hashtab_search(args->newp->p_users.table,
-                                  args->oldp->p_user_val_to_name[c->user - 1]);
+                                  sym_name(args->oldp, SYM_USERS, c->user - 1));
         if (!usrdatum)
                 goto bad;
         c->user = usrdatum->value;
 
         /* Convert the role. */
+        rc = -EINVAL;
         role = hashtab_search(args->newp->p_roles.table,
-                              args->oldp->p_role_val_to_name[c->role - 1]);
+                              sym_name(args->oldp, SYM_ROLES, c->role - 1));
         if (!role)
                 goto bad;
         c->role = role->value;
 
         /* Convert the type. */
+        rc = -EINVAL;
         typdatum = hashtab_search(args->newp->p_types.table,
-                                  args->oldp->p_type_val_to_name[c->type - 1]);
+                                  sym_name(args->oldp, SYM_TYPES, c->type - 1));
         if (!typdatum)
                 goto bad;
         c->type = typdatum->value;
@@ -1692,6 +1743,7 @@ static int convert_context(u32 key,
                 oc = args->newp->ocontexts[OCON_ISID];
                 while (oc && oc->sid[0] != SECINITSID_UNLABELED)
                         oc = oc->next;
+                rc = -EINVAL;
                 if (!oc) {
                         printk(KERN_ERR "SELinux:  unable to look up"
                                 " the initial SIDs list\n");
@@ -1711,19 +1763,20 @@ static int convert_context(u32 key,
         }
 
         context_destroy(&oldc);
+
         rc = 0;
 out:
         return rc;
 bad:
         /* Map old representation to string and save it. */
-        if (context_struct_to_string(&oldc, &s, &len))
-                return -ENOMEM;
+        rc = context_struct_to_string(&oldc, &s, &len);
+        if (rc)
+                return rc;
         context_destroy(&oldc);
         context_destroy(c);
         c->str = s;
         c->len = len;
-        printk(KERN_INFO
-               "SELinux:  Context %s became invalid (unmapped).\n",
+        printk(KERN_INFO "SELinux:  Context %s became invalid (unmapped).\n",
                c->str);
         rc = 0;
         goto out;
@@ -1769,6 +1822,7 @@ int security_load_policy(void *data, size_t len)
                         return rc;
                 }
 
+                policydb.len = len;
                 rc = selinux_set_mapping(&policydb, secclass_map,
                                          &current_mapping,
                                          &current_mapping_size);
@@ -1791,6 +1845,7 @@ int security_load_policy(void *data, size_t len)
                 selinux_complete_init();
                 avc_ss_reset(seqno);
                 selnl_notify_policyload(seqno);
+                selinux_status_update_policyload(seqno);
                 selinux_netlbl_cache_invalidate();
                 selinux_xfrm_notify_policyload();
                 return 0;
@@ -1804,6 +1859,7 @@ int security_load_policy(void *data, size_t len)
         if (rc)
                 return rc;
 
+        newpolicydb.len = len;
         /* If switching between different policy types, log MLS status */
         if (policydb.mls_enabled && !newpolicydb.mls_enabled)
                 printk(KERN_INFO "SELinux: Disabling MLS support...\n");
@@ -1870,6 +1926,7 @@ int security_load_policy(void *data, size_t len)
 
         avc_ss_reset(seqno);
         selnl_notify_policyload(seqno);
+        selinux_status_update_policyload(seqno);
         selinux_netlbl_cache_invalidate();
         selinux_xfrm_notify_policyload();
 
@@ -1883,6 +1940,17 @@ err:
 
 }
 
+size_t security_policydb_len(void)
+{
+        size_t len;
+
+        read_lock(&policy_rwlock);
+        len = policydb.len;
+        read_unlock(&policy_rwlock);
+
+        return len;
+}
+
 /**
  * security_port_sid - Obtain the SID for a port.
  * @protocol: protocol number
@@ -1989,7 +2057,7 @@ int security_node_sid(u16 domain,
                       u32 addrlen,
                       u32 *out_sid)
 {
-        int rc = 0;
+        int rc;
         struct ocontext *c;
 
         read_lock(&policy_rwlock);
@@ -1998,10 +2066,9 @@ int security_node_sid(u16 domain,
         case AF_INET: {
                 u32 addr;
 
-                if (addrlen != sizeof(u32)) {
-                        rc = -EINVAL;
+                rc = -EINVAL;
+                if (addrlen != sizeof(u32))
                         goto out;
-                }
 
                 addr = *((u32 *)addrp);
 
@@ -2015,10 +2082,9 @@ int security_node_sid(u16 domain,
         }
 
         case AF_INET6:
-                if (addrlen != sizeof(u64) * 2) {
-                        rc = -EINVAL;
+                rc = -EINVAL;
+                if (addrlen != sizeof(u64) * 2)
                         goto out;
-                }
                 c = policydb.ocontexts[OCON_NODE6];
                 while (c) {
                         if (match_ipv6_addrmask(addrp, c->u.node6.addr,
@@ -2029,6 +2095,7 @@ int security_node_sid(u16 domain,
                 break;
 
         default:
+                rc = 0;
                 *out_sid = SECINITSID_NODE;
                 goto out;
         }
@@ -2046,6 +2113,7 @@ int security_node_sid(u16 domain,
                 *out_sid = SECINITSID_NODE;
         }
 
+        rc = 0;
 out:
         read_unlock(&policy_rwlock);
         return rc;
@@ -2090,24 +2158,22 @@ int security_get_user_sids(u32 fromsid,
 
         context_init(&usercon);
 
+        rc = -EINVAL;
         fromcon = sidtab_search(&sidtab, fromsid);
-        if (!fromcon) {
-                rc = -EINVAL;
+        if (!fromcon)
                 goto out_unlock;
-        }
 
+        rc = -EINVAL;
         user = hashtab_search(policydb.p_users.table, username);
-        if (!user) {
-                rc = -EINVAL;
+        if (!user)
                 goto out_unlock;
-        }
+
         usercon.user = user->value;
 
+        rc = -ENOMEM;
         mysids = kcalloc(maxnel, sizeof(*mysids), GFP_ATOMIC);
-        if (!mysids) {
-                rc = -ENOMEM;
+        if (!mysids)
                 goto out_unlock;
-        }
 
         ebitmap_for_each_positive_bit(&user->roles, rnode, i) {
                 role = policydb.role_val_to_struct[i];
@@ -2124,12 +2190,11 @@ int security_get_user_sids(u32 fromsid,
                         if (mynel < maxnel) {
                                 mysids[mynel++] = sid;
                         } else {
+                                rc = -ENOMEM;
                                 maxnel += SIDS_NEL;
                                 mysids2 = kcalloc(maxnel, sizeof(*mysids2), GFP_ATOMIC);
-                                if (!mysids2) {
-                                        rc = -ENOMEM;
+                                if (!mysids2)
                                         goto out_unlock;
-                                }
                                 memcpy(mysids2, mysids, mynel * sizeof(*mysids2));
                                 kfree(mysids);
                                 mysids = mysids2;
@@ -2137,7 +2202,7 @@ int security_get_user_sids(u32 fromsid,
                         }
                 }
         }
-
+        rc = 0;
 out_unlock:
         read_unlock(&policy_rwlock);
         if (rc || !mynel) {
@@ -2145,17 +2210,18 @@ out_unlock:
                 goto out;
         }
 
+        rc = -ENOMEM;
         mysids2 = kcalloc(mynel, sizeof(*mysids2), GFP_KERNEL);
         if (!mysids2) {
-                rc = -ENOMEM;
                 kfree(mysids);
                 goto out;
         }
         for (i = 0, j = 0; i < mynel; i++) {
+                struct av_decision dummy_avd;
                 rc = avc_has_perm_noaudit(fromsid, mysids[i],
                                           SECCLASS_PROCESS, /* kernel value */
                                           PROCESS__TRANSITION, AVC_STRICT,
-                                          NULL);
+                                          &dummy_avd);
                 if (!rc)
                         mysids2[j++] = mysids[i];
                 cond_resched();
@@ -2188,7 +2254,7 @@ int security_genfs_sid(const char *fstype,
         u16 sclass;
         struct genfs *genfs;
         struct ocontext *c;
-        int rc = 0, cmp = 0;
+        int rc, cmp = 0;
 
         while (path[0] == '/' && path[1] == '/')
                 path++;
@@ -2196,6 +2262,7 @@ int security_genfs_sid(const char *fstype,
         read_lock(&policy_rwlock);
 
         sclass = unmap_class(orig_sclass);
+        *sid = SECINITSID_UNLABELED;
 
         for (genfs = policydb.genfs; genfs; genfs = genfs->next) {
                 cmp = strcmp(fstype, genfs->fstype);
@@ -2203,11 +2270,9 @@ int security_genfs_sid(const char *fstype,
                         break;
         }
 
-        if (!genfs || cmp) {
-                *sid = SECINITSID_UNLABELED;
-                rc = -ENOENT;
+        rc = -ENOENT;
+        if (!genfs || cmp)
                 goto out;
-        }
 
         for (c = genfs->head; c; c = c->next) {
                 len = strlen(c->u.name);
@@ -2216,21 +2281,18 @@ int security_genfs_sid(const char *fstype,
                         break;
         }
 
-        if (!c) {
-                *sid = SECINITSID_UNLABELED;
-                rc = -ENOENT;
+        rc = -ENOENT;
+        if (!c)
                 goto out;
-        }
 
         if (!c->sid[0]) {
-                rc = sidtab_context_to_sid(&sidtab,
-                                           &c->context[0],
-                                           &c->sid[0]);
+                rc = sidtab_context_to_sid(&sidtab, &c->context[0], &c->sid[0]);
                 if (rc)
                         goto out;
         }
 
         *sid = c->sid[0];
+        rc = 0;
 out:
         read_unlock(&policy_rwlock);
         return rc;
@@ -2262,8 +2324,7 @@ int security_fs_use(
         if (c) {
                 *behavior = c->v.behavior;
                 if (!c->sid[0]) {
-                        rc = sidtab_context_to_sid(&sidtab,
-                                                   &c->context[0],
+                        rc = sidtab_context_to_sid(&sidtab, &c->context[0],
                                                    &c->sid[0]);
                         if (rc)
                                 goto out;
@@ -2286,34 +2347,39 @@ out:
 
 int security_get_bools(int *len, char ***names, int **values)
 {
-        int i, rc = -ENOMEM;
+        int i, rc;
 
         read_lock(&policy_rwlock);
         *names = NULL;
         *values = NULL;
 
+        rc = 0;
         *len = policydb.p_bools.nprim;
-        if (!*len) {
-                rc = 0;
+        if (!*len)
                 goto out;
-        }
 
-       *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC);
+        rc = -ENOMEM;
+        *names = kcalloc(*len, sizeof(char *), GFP_ATOMIC);
         if (!*names)
                 goto err;
 
-       *values = kcalloc(*len, sizeof(int), GFP_ATOMIC);
+        rc = -ENOMEM;
+        *values = kcalloc(*len, sizeof(int), GFP_ATOMIC);
         if (!*values)
                 goto err;
 
         for (i = 0; i < *len; i++) {
                 size_t name_len;
+
                 (*values)[i] = policydb.bool_val_to_struct[i]->state;
-                name_len = strlen(policydb.p_bool_val_to_name[i]) + 1;
-               (*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);
+                name_len = strlen(sym_name(&policydb, SYM_BOOLS, i)) + 1;
+
+                rc = -ENOMEM;
+                (*names)[i] = kmalloc(sizeof(char) * name_len, GFP_ATOMIC);
                 if (!(*names)[i])
                         goto err;
-                strncpy((*names)[i], policydb.p_bool_val_to_name[i], name_len);
+
+                strncpy((*names)[i], sym_name(&policydb, SYM_BOOLS, i), name_len);
                 (*names)[i][name_len - 1] = 0;
         }
         rc = 0;
@@ -2332,24 +2398,23 @@ err:
 
 int security_set_bools(int len, int *values)
 {
-        int i, rc = 0;
+        int i, rc;
         int lenp, seqno = 0;
         struct cond_node *cur;
 
         write_lock_irq(&policy_rwlock);
 
+        rc = -EFAULT;
         lenp = policydb.p_bools.nprim;
-        if (len != lenp) {
-                rc = -EFAULT;
+        if (len != lenp)
                 goto out;
-        }
 
         for (i = 0; i < len; i++) {
                 if (!!values[i] != policydb.bool_val_to_struct[i]->state) {
                         audit_log(current->audit_context, GFP_ATOMIC,
                                 AUDIT_MAC_CONFIG_CHANGE,
                                 "bool=%s val=%d old_val=%d auid=%u ses=%u",
-                                policydb.p_bool_val_to_name[i],
+                                sym_name(&policydb, SYM_BOOLS, i),
                                 !!values[i],
                                 policydb.bool_val_to_struct[i]->state,
                                 audit_get_loginuid(current),
@@ -2368,12 +2433,13 @@ int security_set_bools(int len, int *values)
         }
 
         seqno = ++latest_granting;
-
+        rc = 0;
 out:
         write_unlock_irq(&policy_rwlock);
         if (!rc) {
                 avc_ss_reset(seqno);
                 selnl_notify_policyload(seqno);
+                selinux_status_update_policyload(seqno);
                 selinux_xfrm_notify_policyload();
         }
         return rc;
@@ -2381,16 +2447,15 @@ out:
 
 int security_get_bool_value(int bool)
 {
-        int rc = 0;
+        int rc;
         int len;
 
         read_lock(&policy_rwlock);
 
+        rc = -EFAULT;
         len = policydb.p_bools.nprim;
-        if (bool >= len) {
-                rc = -EFAULT;
+        if (bool >= len)
                 goto out;
-        }
 
         rc = policydb.bool_val_to_struct[bool]->state;
 out:
@@ -2440,8 +2505,9 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
         struct context newcon;
         char *s;
         u32 len;
-        int rc = 0;
+        int rc;
 
+        rc = 0;
         if (!ss_initialized || !policydb.mls_enabled) {
                 *new_sid = sid;
                 goto out;
@@ -2450,19 +2516,20 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
         context_init(&newcon);
 
         read_lock(&policy_rwlock);
+
+        rc = -EINVAL;
         context1 = sidtab_search(&sidtab, sid);
         if (!context1) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
                         __func__, sid);
-                rc = -EINVAL;
                 goto out_unlock;
         }
 
+        rc = -EINVAL;
         context2 = sidtab_search(&sidtab, mls_sid);
         if (!context2) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
                         __func__, mls_sid);
-                rc = -EINVAL;
                 goto out_unlock;
         }
 
@@ -2476,20 +2543,17 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
         /* Check the validity of the new context. */
         if (!policydb_context_isvalid(&policydb, &newcon)) {
                 rc = convert_context_handle_invalid_context(&newcon);
-                if (rc)
-                        goto bad;
+                if (rc) {
+                        if (!context_struct_to_string(&newcon, &s, &len)) {
+                                audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+                                          "security_sid_mls_copy: invalid context %s", s);
+                                kfree(s);
+                        }
+                        goto out_unlock;
+                }
         }
 
         rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);
-        goto out_unlock;
-
-bad:
-        if (!context_struct_to_string(&newcon, &s, &len)) {
-                audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
-                          "security_sid_mls_copy: invalid context %s", s);
-                kfree(s);
-        }
-
 out_unlock:
         read_unlock(&policy_rwlock);
         context_destroy(&newcon);
@@ -2525,6 +2589,8 @@ int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
         struct context *nlbl_ctx;
         struct context *xfrm_ctx;
 
+        *peer_sid = SECSID_NULL;
+
         /* handle the common (which also happens to be the set of easy) cases
          * right away, these two if statements catch everything involving a
          * single or absent peer SID/label */
@@ -2543,40 +2609,37 @@ int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
         /* we don't need to check ss_initialized here since the only way both
          * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
          * security server was initialized and ss_initialized was true */
-        if (!policydb.mls_enabled) {
-                *peer_sid = SECSID_NULL;
+        if (!policydb.mls_enabled)
                 return 0;
-        }
 
         read_lock(&policy_rwlock);
 
+        rc = -EINVAL;
         nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);
         if (!nlbl_ctx) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
                        __func__, nlbl_sid);
-                rc = -EINVAL;
-                goto out_slowpath;
+                goto out;
         }
+        rc = -EINVAL;
         xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);
         if (!xfrm_ctx) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized SID %d\n",
                        __func__, xfrm_sid);
-                rc = -EINVAL;
-                goto out_slowpath;
+                goto out;
         }
         rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);
+        if (rc)
+                goto out;
 
-out_slowpath:
+        /* at present NetLabel SIDs/labels really only carry MLS
+         * information so if the MLS portion of the NetLabel SID
+         * matches the MLS portion of the labeled XFRM SID/label
+         * then pass along the XFRM SID as it is the most
+         * expressive */
+        *peer_sid = xfrm_sid;
+out:
         read_unlock(&policy_rwlock);
-        if (rc == 0)
-                /* at present NetLabel SIDs/labels really only carry MLS
-                 * information so if the MLS portion of the NetLabel SID
-                 * matches the MLS portion of the labeled XFRM SID/label
-                 * then pass along the XFRM SID as it is the most
-                 * expressive */
-                *peer_sid = xfrm_sid;
-        else
-                *peer_sid = SECSID_NULL;
         return rc;
 }
 
@@ -2595,10 +2658,11 @@ static int get_classes_callback(void *k, void *d, void *args)
 
 int security_get_classes(char ***classes, int *nclasses)
 {
-        int rc = -ENOMEM;
+        int rc;
 
         read_lock(&policy_rwlock);
 
+        rc = -ENOMEM;
         *nclasses = policydb.p_classes.nprim;
         *classes = kcalloc(*nclasses, sizeof(**classes), GFP_ATOMIC);
         if (!*classes)
@@ -2606,7 +2670,7 @@ int security_get_classes(char ***classes, int *nclasses)
 
         rc = hashtab_map(policydb.p_classes.table, get_classes_callback,
                         *classes);
-        if (rc < 0) {
+        if (rc) {
                 int i;
                 for (i = 0; i < *nclasses; i++)
                         kfree((*classes)[i]);
@@ -2633,19 +2697,20 @@ static int get_permissions_callback(void *k, void *d, void *args)
 
 int security_get_permissions(char *class, char ***perms, int *nperms)
 {
-        int rc = -ENOMEM, i;
+        int rc, i;
         struct class_datum *match;
 
         read_lock(&policy_rwlock);
 
+        rc = -EINVAL;
         match = hashtab_search(policydb.p_classes.table, class);
         if (!match) {
                 printk(KERN_ERR "SELinux: %s:  unrecognized class %s\n",
                         __func__, class);
-                rc = -EINVAL;
                 goto out;
         }
 
+        rc = -ENOMEM;
         *nperms = match->permissions.nprim;
         *perms = kcalloc(*nperms, sizeof(**perms), GFP_ATOMIC);
         if (!*perms)
@@ -2654,13 +2719,13 @@ int security_get_permissions(char *class, char ***perms, int *nperms)
         if (match->comdatum) {
                 rc = hashtab_map(match->comdatum->permissions.table,
                                 get_permissions_callback, *perms);
-                if (rc < 0)
+                if (rc)
                         goto err;
         }
 
         rc = hashtab_map(match->permissions.table, get_permissions_callback,
                         *perms);
-        if (rc < 0)
+        if (rc)
                 goto err;
 
 out:
@@ -2750,7 +2815,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
         case AUDIT_SUBJ_CLR:
         case AUDIT_OBJ_LEV_LOW:
         case AUDIT_OBJ_LEV_HIGH:
-                /* we do not allow a range, indicated by the presense of '-' */
+                /* we do not allow a range, indicated by the presence of '-' */
                 if (strchr(rulestr, '-'))
                         return -EINVAL;
                 break;
@@ -2772,36 +2837,39 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
         switch (field) {
         case AUDIT_SUBJ_USER:
         case AUDIT_OBJ_USER:
+                rc = -EINVAL;
                 userdatum = hashtab_search(policydb.p_users.table, rulestr);
                 if (!userdatum)
-                        rc = -EINVAL;
-                else
-                        tmprule->au_ctxt.user = userdatum->value;
+                        goto out;
+                tmprule->au_ctxt.user = userdatum->value;
                 break;
         case AUDIT_SUBJ_ROLE:
         case AUDIT_OBJ_ROLE:
+                rc = -EINVAL;
                 roledatum = hashtab_search(policydb.p_roles.table, rulestr);
                 if (!roledatum)
-                        rc = -EINVAL;
-                else
-                        tmprule->au_ctxt.role = roledatum->value;
+                        goto out;
+                tmprule->au_ctxt.role = roledatum->value;
                 break;
         case AUDIT_SUBJ_TYPE:
         case AUDIT_OBJ_TYPE:
+                rc = -EINVAL;
                 typedatum = hashtab_search(policydb.p_types.table, rulestr);
                 if (!typedatum)
-                        rc = -EINVAL;
-                else
-                        tmprule->au_ctxt.type = typedatum->value;
+                        goto out;
+                tmprule->au_ctxt.type = typedatum->value;
                 break;
         case AUDIT_SUBJ_SEN:
         case AUDIT_SUBJ_CLR:
         case AUDIT_OBJ_LEV_LOW:
         case AUDIT_OBJ_LEV_HIGH:
                 rc = mls_from_string(rulestr, &tmprule->au_ctxt, GFP_ATOMIC);
+                if (rc)
+                        goto out;
                 break;
         }
-
+        rc = 0;
+out:
         read_unlock(&policy_rwlock);
 
         if (rc) {
@@ -3016,7 +3084,7 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
  * Description:
  * Convert the given NetLabel security attributes in @secattr into a
  * SELinux SID.  If the @secattr field does not contain a full SELinux
- * SID/context then use SECINITSID_NETMSG as the foundation.  If possibile the
+ * SID/context then use SECINITSID_NETMSG as the foundation.  If possible the
  * 'cache' field of @secattr is set and the CACHE flag is set; this is to
  * allow the @secattr to be used by NetLabel to cache the secattr to SID
  * conversion for future lookups.  Returns zero on success, negative values on
@@ -3026,7 +3094,7 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
 int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
                                    u32 *sid)
 {
-        int rc = -EIDRM;
+        int rc;
         struct context *ctx;
         struct context ctx_new;
 
@@ -3037,16 +3105,15 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
 
         read_lock(&policy_rwlock);
 
-        if (secattr->flags & NETLBL_SECATTR_CACHE) {
+        if (secattr->flags & NETLBL_SECATTR_CACHE)
                 *sid = *(u32 *)secattr->cache->data;
-                rc = 0;
-        } else if (secattr->flags & NETLBL_SECATTR_SECID) {
+        else if (secattr->flags & NETLBL_SECATTR_SECID)
                 *sid = secattr->attr.secid;
-                rc = 0;
-        } else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
+        else if (secattr->flags & NETLBL_SECATTR_MLS_LVL) {
+                rc = -EIDRM;
                 ctx = sidtab_search(&sidtab, SECINITSID_NETMSG);
                 if (ctx == NULL)
-                        goto netlbl_secattr_to_sid_return;
+                        goto out;
 
                 context_init(&ctx_new);
                 ctx_new.user = ctx->user;
@@ -3054,34 +3121,35 @@ int security_netlbl_secattr_to_sid(struct netlbl_lsm_secattr *secattr,
                 ctx_new.type = ctx->type;
                 mls_import_netlbl_lvl(&ctx_new, secattr);
                 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
-                        if (ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
-                                                  secattr->attr.mls.cat) != 0)
-                                goto netlbl_secattr_to_sid_return;
+                        rc = ebitmap_netlbl_import(&ctx_new.range.level[0].cat,
+                                                   secattr->attr.mls.cat);
+                        if (rc)
+                                goto out;
                         memcpy(&ctx_new.range.level[1].cat,
                                &ctx_new.range.level[0].cat,
                                sizeof(ctx_new.range.level[0].cat));
                 }
-                if (mls_context_isvalid(&policydb, &ctx_new) != 1)
-                        goto netlbl_secattr_to_sid_return_cleanup;
+                rc = -EIDRM;
+                if (!mls_context_isvalid(&policydb, &ctx_new))
+                        goto out_free;
 
                 rc = sidtab_context_to_sid(&sidtab, &ctx_new, sid);
-                if (rc != 0)
-                        goto netlbl_secattr_to_sid_return_cleanup;
+                if (rc)
+                        goto out_free;
 
                 security_netlbl_cache_add(secattr, *sid);
 
                 ebitmap_destroy(&ctx_new.range.level[0].cat);
-        } else {
+        } else
                 *sid = SECSID_NULL;
-                rc = 0;
-        }
 
-netlbl_secattr_to_sid_return:
         read_unlock(&policy_rwlock);
-        return rc;
-netlbl_secattr_to_sid_return_cleanup:
+        return 0;
+out_free:
         ebitmap_destroy(&ctx_new.range.level[0].cat);
-        goto netlbl_secattr_to_sid_return;
+out:
+        read_unlock(&policy_rwlock);
+        return rc;
 }
 
 /**
@@ -3103,29 +3171,59 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
                 return 0;
 
         read_lock(&policy_rwlock);
+
+        rc = -ENOENT;
         ctx = sidtab_search(&sidtab, sid);
-        if (ctx == NULL) {
-                rc = -ENOENT;
-                goto netlbl_sid_to_secattr_failure;
-        }
-        secattr->domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
+        if (ctx == NULL)
+                goto out;
+
+        rc = -ENOMEM;
+        secattr->domain = kstrdup(sym_name(&policydb, SYM_TYPES, ctx->type - 1),
                                   GFP_ATOMIC);
-        if (secattr->domain == NULL) {
-                rc = -ENOMEM;
-                goto netlbl_sid_to_secattr_failure;
-        }
+        if (secattr->domain == NULL)
+                goto out;
+
         secattr->attr.secid = sid;
         secattr->flags |= NETLBL_SECATTR_DOMAIN_CPY | NETLBL_SECATTR_SECID;
         mls_export_netlbl_lvl(ctx, secattr);
         rc = mls_export_netlbl_cat(ctx, secattr);
-        if (rc != 0)
-                goto netlbl_sid_to_secattr_failure;
+out:
         read_unlock(&policy_rwlock);
+        return rc;
+}
+#endif /* CONFIG_NETLABEL */
 
-        return 0;
+/**
+ * security_read_policy - read the policy.
+ * @data: binary policy data
+ * @len: length of data in bytes
+ *
+ */
+int security_read_policy(void **data, size_t *len)
+{
+        int rc;
+        struct policy_file fp;
 
-netlbl_sid_to_secattr_failure:
+        if (!ss_initialized)
+                return -EINVAL;
+
+        *len = security_policydb_len();
+
+        *data = vmalloc_user(*len);
+        if (!*data)
+                return -ENOMEM;
+
+        fp.data = *data;
+        fp.len = *len;
+
+        read_lock(&policy_rwlock);
+        rc = policydb_write(&policydb, &fp);
         read_unlock(&policy_rwlock);
-        return rc;
+
+        if (rc)
+                return rc;
+
+        *len = (unsigned long)fp.data - (unsigned long)*data;
+        return 0;
+
 }
-#endif /* CONFIG_NETLABEL */
diff --git a/security/selinux/ss/sidtab.c b/security/selinux/ss/sidtab.c
index e817989764cd..5840a35155fc 100644
--- a/security/selinux/ss/sidtab.c
+++ b/security/selinux/ss/sidtab.c
@@ -147,6 +147,17 @@ out:
         return rc;
 }
 
+static void sidtab_update_cache(struct sidtab *s, struct sidtab_node *n, int loc)
+{
+        BUG_ON(loc >= SIDTAB_CACHE_LEN);
+
+        while (loc > 0) {
+                s->cache[loc] = s->cache[loc - 1];
+                loc--;
+        }
+        s->cache[0] = n;
+}
+
 static inline u32 sidtab_search_context(struct sidtab *s,
                                                   struct context *context)
 {
@@ -156,14 +167,33 @@ static inline u32 sidtab_search_context(struct sidtab *s,
         for (i = 0; i < SIDTAB_SIZE; i++) {
                 cur = s->htable[i];
                 while (cur) {
-                        if (context_cmp(&cur->context, context))
+                        if (context_cmp(&cur->context, context)) {
+                                sidtab_update_cache(s, cur, SIDTAB_CACHE_LEN - 1);
                                 return cur->sid;
+                        }
                         cur = cur->next;
                 }
         }
         return 0;
 }
 
+static inline u32 sidtab_search_cache(struct sidtab *s, struct context *context)
+{
+        int i;
+        struct sidtab_node *node;
+
+        for (i = 0; i < SIDTAB_CACHE_LEN; i++) {
+                node = s->cache[i];
+                if (unlikely(!node))
+                        return 0;
+                if (context_cmp(&node->context, context)) {
+                        sidtab_update_cache(s, node, i);
+                        return node->sid;
+                }
+        }
+        return 0;
+}
+
 int sidtab_context_to_sid(struct sidtab *s,
                           struct context *context,
                           u32 *out_sid)
@@ -174,7 +204,9 @@ int sidtab_context_to_sid(struct sidtab *s,
 
         *out_sid = SECSID_NULL;
 
-        sid = sidtab_search_context(s, context);
+        sid  = sidtab_search_cache(s, context);
+        if (!sid)
+                sid = sidtab_search_context(s, context);
         if (!sid) {
                 spin_lock_irqsave(&s->lock, flags);
                 /* Rescan now that we hold the lock. */
@@ -259,12 +291,15 @@ void sidtab_destroy(struct sidtab *s)
 void sidtab_set(struct sidtab *dst, struct sidtab *src)
 {
         unsigned long flags;
+        int i;
 
         spin_lock_irqsave(&src->lock, flags);
         dst->htable = src->htable;
         dst->nel = src->nel;
         dst->next_sid = src->next_sid;
         dst->shutdown = 0;
+        for (i = 0; i < SIDTAB_CACHE_LEN; i++)
+                dst->cache[i] = NULL;
         spin_unlock_irqrestore(&src->lock, flags);
 }
 
diff --git a/security/selinux/ss/sidtab.h b/security/selinux/ss/sidtab.h
index 64ea5b1cdea4..84dc154d9389 100644
--- a/security/selinux/ss/sidtab.h
+++ b/security/selinux/ss/sidtab.h
@@ -26,6 +26,8 @@ struct sidtab {
         unsigned int nel;       /* number of elements */
         unsigned int next_sid;  /* next SID to allocate */
         unsigned char shutdown;
+#define SIDTAB_CACHE_LEN        3
+        struct sidtab_node *cache[SIDTAB_CACHE_LEN];
         spinlock_t lock;
 };
 
diff --git a/security/selinux/ss/status.c b/security/selinux/ss/status.c
new file mode 100644
index 000000000000..d982365f9d1a
--- /dev/null
+++ b/security/selinux/ss/status.c
@@ -0,0 +1,126 @@
+/*
+ * mmap based event notifications for SELinux
+ *
+ * Author: KaiGai Kohei <kaigai@ak.jp.nec.com>
+ *
+ * Copyright (C) 2010 NEC corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2,
+ * as published by the Free Software Foundation.
+ */
+#include <linux/kernel.h>
+#include <linux/gfp.h>
+#include <linux/mm.h>
+#include <linux/mutex.h>
+#include "avc.h"
+#include "services.h"
+
+/*
+ * The selinux_status_page shall be exposed to userspace applications
+ * using mmap interface on /selinux/status.
+ * It enables to notify applications a few events that will cause reset
+ * of userspace access vector without context switching.
+ *
+ * The selinux_kernel_status structure on the head of status page is
+ * protected from concurrent accesses using seqlock logic, so userspace
+ * application should reference the status page according to the seqlock
+ * logic.
+ *
+ * Typically, application checks status->sequence at the head of access
+ * control routine. If it is odd-number, kernel is updating the status,
+ * so please wait for a moment. If it is changed from the last sequence
+ * number, it means something happen, so application will reset userspace
+ * avc, if needed.
+ * In most cases, application shall confirm the kernel status is not
+ * changed without any system call invocations.
+ */
+static struct page *selinux_status_page;
+static DEFINE_MUTEX(selinux_status_lock);
+
+/*
+ * selinux_kernel_status_page
+ *
+ * It returns a reference to selinux_status_page. If the status page is
+ * not allocated yet, it also tries to allocate it at the first time.
+ */
+struct page *selinux_kernel_status_page(void)
+{
+        struct selinux_kernel_status   *status;
+        struct page                    *result = NULL;
+
+        mutex_lock(&selinux_status_lock);
+        if (!selinux_status_page) {
+                selinux_status_page = alloc_page(GFP_KERNEL|__GFP_ZERO);
+
+                if (selinux_status_page) {
+                        status = page_address(selinux_status_page);
+
+                        status->version = SELINUX_KERNEL_STATUS_VERSION;
+                        status->sequence = 0;
+                        status->enforcing = selinux_enforcing;
+                        /*
+                         * NOTE: the next policyload event shall set
+                         * a positive value on the status->policyload,
+                         * although it may not be 1, but never zero.
+                         * So, application can know it was updated.
+                         */
+                        status->policyload = 0;
+                        status->deny_unknown = !security_get_allow_unknown();
+                }
+        }
+        result = selinux_status_page;
+        mutex_unlock(&selinux_status_lock);
+
+        return result;
+}
+
+/*
+ * selinux_status_update_setenforce
+ *
+ * It updates status of the current enforcing/permissive mode.
+ */
+void selinux_status_update_setenforce(int enforcing)
+{
+        struct selinux_kernel_status   *status;
+
+        mutex_lock(&selinux_status_lock);
+        if (selinux_status_page) {
+                status = page_address(selinux_status_page);
+
+                status->sequence++;
+                smp_wmb();
+
+                status->enforcing = enforcing;
+
+                smp_wmb();
+                status->sequence++;
+        }
+        mutex_unlock(&selinux_status_lock);
+}
+
+/*
+ * selinux_status_update_policyload
+ *
+ * It updates status of the times of policy reloaded, and current
+ * setting of deny_unknown.
+ */
+void selinux_status_update_policyload(int seqno)
+{
+        struct selinux_kernel_status   *status;
+
+        mutex_lock(&selinux_status_lock);
+        if (selinux_status_page) {
+                status = page_address(selinux_status_page);
+
+                status->sequence++;
+                smp_wmb();
+
+                status->policyload = seqno;
+                status->deny_unknown = !security_get_allow_unknown();
+
+                smp_wmb();
+                status->sequence++;
+        }
+        mutex_unlock(&selinux_status_lock);
+}
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index fff78d3b51a2..68178b76a2b3 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -112,7 +112,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
  */
 
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp,
-                        struct flowi *fl)
+                        const struct flowi *fl)
 {
         u32 state_sid;
         int rc;
@@ -135,10 +135,10 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
 
         state_sid = x->security->ctx_sid;
 
-        if (fl->secid != state_sid)
+        if (fl->flowi_secid != state_sid)
                 return 0;
 
-        rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
+        rc = avc_has_perm(fl->flowi_secid, state_sid, SECCLASS_ASSOCIATION,
                           ASSOCIATION__SENDTO,
                           NULL)? 0:1;
 
@@ -208,7 +208,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
         if (!uctx)
                 goto not_from_user;
 
-        if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX)
+        if (uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
                 return -EINVAL;
 
         str_len = uctx->ctx_len;