Merge branch 'consolidate-clksrc-i8253' of master.kernel.org:~rmk/linux-2.6-arm into timers/clocksource

Conflicts:
	arch/ia64/kernel/cyclone.c
	arch/mips/kernel/i8253.c
	arch/x86/kernel/i8253.c

Reason: Resolve conflicts so further cleanups do not conflict further

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

15 files changed, 493 insertions, 243 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 9da6420e2056..1d027e29ce8d 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -471,6 +471,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
  * @avd: access vector decisions
  * @result: result from avc_has_perm_noaudit
  * @a:  auxiliary audit data
+ * @flags: VFS walk flags
  *
  * Audit the granting or denial of permissions in accordance
  * with the policy.  This function is typically called by
@@ -481,9 +482,10 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
  * be performed under a lock, to allow the lock to be released
  * before calling the auditing code.
  */
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
-               struct av_decision *avd, int result, struct common_audit_data *a)
+               struct av_decision *avd, int result, struct common_audit_data *a,
+               unsigned flags)
 {
         struct common_audit_data stack_data;
         u32 denied, audited;
@@ -515,11 +517,24 @@ void avc_audit(u32 ssid, u32 tsid,
         else
                 audited = requested & avd->auditallow;
         if (!audited)
-                return;
+                return 0;
+
         if (!a) {
                 a = &stack_data;
                 COMMON_AUDIT_DATA_INIT(a, NONE);
         }
+
+        /*
+         * When in a RCU walk do the audit on the RCU retry.  This is because
+         * the collection of the dname in an inode audit message is not RCU
+         * safe.  Note this may drop some audits when the situation changes
+         * during retry. However this is logically just as if the operation
+         * happened a little later.
+         */
+        if ((a->type == LSM_AUDIT_DATA_FS) &&
+            (flags & IPERM_FLAG_RCU))
+                return -ECHILD;
+
         a->selinux_audit_data.tclass = tclass;
         a->selinux_audit_data.requested = requested;
         a->selinux_audit_data.ssid = ssid;
@@ -529,6 +544,7 @@ void avc_audit(u32 ssid, u32 tsid,
         a->lsm_pre_audit = avc_audit_pre_callback;
         a->lsm_post_audit = avc_audit_post_callback;
         common_lsm_audit(a);
+        return 0;
 }
 
 /**
@@ -793,6 +809,7 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * @tclass: target security class
  * @requested: requested permissions, interpreted based on @tclass
  * @auditdata: auxiliary audit data
+ * @flags: VFS walk flags
  *
  * Check the AVC to determine whether the @requested permissions are granted
  * for the SID pair (@ssid, @tsid), interpreting the permissions
@@ -802,14 +819,19 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
  * permissions are granted, -%EACCES if any permissions are denied, or
  * another -errno upon other errors.
  */
-int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
-                 u32 requested, struct common_audit_data *auditdata)
+int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
+                       u32 requested, struct common_audit_data *auditdata,
+                       unsigned flags)
 {
         struct av_decision avd;
-        int rc;
+        int rc, rc2;
 
         rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
-        avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
+
+        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata,
+                        flags);
+        if (rc2)
+                return rc2;
         return rc;
 }
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index c8d699270687..8fb248843009 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -24,9 +24,11 @@
  */
 
 #include <linux/init.h>
+#include <linux/kd.h>
 #include <linux/kernel.h>
 #include <linux/tracehook.h>
 #include <linux/errno.h>
+#include <linux/ext2_fs.h>
 #include <linux/sched.h>
 #include <linux/security.h>
 #include <linux/xattr.h>
@@ -36,14 +38,15 @@
 #include <linux/mman.h>
 #include <linux/slab.h>
 #include <linux/pagemap.h>
+#include <linux/proc_fs.h>
 #include <linux/swap.h>
 #include <linux/spinlock.h>
 #include <linux/syscalls.h>
+#include <linux/dcache.h>
 #include <linux/file.h>
 #include <linux/fdtable.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
-#include <linux/proc_fs.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/tty.h>
@@ -70,13 +73,13 @@
 #include <net/ipv6.h>
 #include <linux/hugetlb.h>
 #include <linux/personality.h>
-#include <linux/sysctl.h>
 #include <linux/audit.h>
 #include <linux/string.h>
 #include <linux/selinux.h>
 #include <linux/mutex.h>
 #include <linux/posix-timers.h>
 #include <linux/syslog.h>
+#include <linux/user_namespace.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -1120,39 +1123,35 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
 }
 
 #ifdef CONFIG_PROC_FS
-static int selinux_proc_get_sid(struct proc_dir_entry *de,
+static int selinux_proc_get_sid(struct dentry *dentry,
                                 u16 tclass,
                                 u32 *sid)
 {
-        int buflen, rc;
-        char *buffer, *path, *end;
+        int rc;
+        char *buffer, *path;
 
         buffer = (char *)__get_free_page(GFP_KERNEL);
         if (!buffer)
                 return -ENOMEM;
 
-        buflen = PAGE_SIZE;
-        end = buffer+buflen;
-        *--end = '\0';
-        buflen--;
-        path = end-1;
-        *path = '/';
-        while (de && de != de->parent) {
-                buflen -= de->namelen + 1;
-                if (buflen < 0)
-                        break;
-                end -= de->namelen;
-                memcpy(end, de->name, de->namelen);
-                *--end = '/';
-                path = end;
-                de = de->parent;
+        path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
+        if (IS_ERR(path))
+                rc = PTR_ERR(path);
+        else {
+                /* each process gets a /proc/PID/ entry. Strip off the
+                 * PID part to get a valid selinux labeling.
+                 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
+                while (path[1] >= '0' && path[1] <= '9') {
+                        path[1] = '/';
+                        path++;
+                }
+                rc = security_genfs_sid("proc", path, tclass, sid);
         }
-        rc = security_genfs_sid("proc", path, tclass, sid);
         free_page((unsigned long)buffer);
         return rc;
 }
 #else
-static int selinux_proc_get_sid(struct proc_dir_entry *de,
+static int selinux_proc_get_sid(struct dentry *dentry,
                                 u16 tclass,
                                 u32 *sid)
 {
@@ -1300,10 +1299,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 
                 /* Try to obtain a transition SID. */
                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
-                rc = security_transition_sid(isec->task_sid,
-                                             sbsec->sid,
-                                             isec->sclass,
-                                             &sid);
+                rc = security_transition_sid(isec->task_sid, sbsec->sid,
+                                             isec->sclass, NULL, &sid);
                 if (rc)
                         goto out_unlock;
                 isec->sid = sid;
@@ -1316,10 +1313,9 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
                 isec->sid = sbsec->sid;
 
                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
-                        struct proc_inode *proci = PROC_I(inode);
-                        if (proci->pde) {
+                        if (opt_dentry) {
                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
-                                rc = selinux_proc_get_sid(proci->pde,
+                                rc = selinux_proc_get_sid(opt_dentry,
                                                           isec->sclass,
                                                           &sid);
                                 if (rc)
@@ -1450,8 +1446,11 @@ static int task_has_capability(struct task_struct *tsk,
         }
 
         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
-        if (audit == SECURITY_CAP_AUDIT)
-                avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
+        if (audit == SECURITY_CAP_AUDIT) {
+                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+                if (rc2)
+                        return rc2;
+        }
         return rc;
 }
 
@@ -1471,7 +1470,8 @@ static int task_has_system(struct task_struct *tsk,
 static int inode_has_perm(const struct cred *cred,
                           struct inode *inode,
                           u32 perms,
-                          struct common_audit_data *adp)
+                          struct common_audit_data *adp,
+                          unsigned flags)
 {
         struct inode_security_struct *isec;
         struct common_audit_data ad;
@@ -1491,7 +1491,7 @@ static int inode_has_perm(const struct cred *cred,
                 ad.u.fs.inode = inode;
         }
 
-        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
+        return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
 }
 
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1508,7 +1508,7 @@ static inline int dentry_has_perm(const struct cred *cred,
         COMMON_AUDIT_DATA_INIT(&ad, FS);
         ad.u.fs.path.mnt = mnt;
         ad.u.fs.path.dentry = dentry;
-        return inode_has_perm(cred, inode, av, &ad);
+        return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
 /* Check whether a task can use an open file descriptor to
@@ -1544,7 +1544,7 @@ static int file_has_perm(const struct cred *cred,
         /* av is zero if only checking access to the descriptor. */
         rc = 0;
         if (av)
-                rc = inode_has_perm(cred, inode, av, &ad);
+                rc = inode_has_perm(cred, inode, av, &ad, 0);
 
 out:
         return rc;
@@ -1578,7 +1578,8 @@ static int may_create(struct inode *dir,
                 return rc;
 
         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
-                rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
+                rc = security_transition_sid(sid, dsec->sid, tclass,
+                                             &dentry->d_name, &newsid);
                 if (rc)
                         return rc;
         }
@@ -1851,93 +1852,17 @@ static int selinux_capset(struct cred *new, const struct cred *old,
  */
 
 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
-                           int cap, int audit)
+                           struct user_namespace *ns, int cap, int audit)
 {
         int rc;
 
-        rc = cap_capable(tsk, cred, cap, audit);
+        rc = cap_capable(tsk, cred, ns, cap, audit);
         if (rc)
                 return rc;
 
         return task_has_capability(tsk, cred, cap, audit);
 }
 
-static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
-{
-        int buflen, rc;
-        char *buffer, *path, *end;
-
-        rc = -ENOMEM;
-        buffer = (char *)__get_free_page(GFP_KERNEL);
-        if (!buffer)
-                goto out;
-
-        buflen = PAGE_SIZE;
-        end = buffer+buflen;
-        *--end = '\0';
-        buflen--;
-        path = end-1;
-        *path = '/';
-        while (table) {
-                const char *name = table->procname;
-                size_t namelen = strlen(name);
-                buflen -= namelen + 1;
-                if (buflen < 0)
-                        goto out_free;
-                end -= namelen;
-                memcpy(end, name, namelen);
-                *--end = '/';
-                path = end;
-                table = table->parent;
-        }
-        buflen -= 4;
-        if (buflen < 0)
-                goto out_free;
-        end -= 4;
-        memcpy(end, "/sys", 4);
-        path = end;
-        rc = security_genfs_sid("proc", path, tclass, sid);
-out_free:
-        free_page((unsigned long)buffer);
-out:
-        return rc;
-}
-
-static int selinux_sysctl(ctl_table *table, int op)
-{
-        int error = 0;
-        u32 av;
-        u32 tsid, sid;
-        int rc;
-
-        sid = current_sid();
-
-        rc = selinux_sysctl_get_sid(table, (op == 0001) ?
-                                    SECCLASS_DIR : SECCLASS_FILE, &tsid);
-        if (rc) {
-                /* Default to the well-defined sysctl SID. */
-                tsid = SECINITSID_SYSCTL;
-        }
-
-        /* The op values are "defined" in sysctl.c, thereby creating
-         * a bad coupling between this module and sysctl.c */
-        if (op == 001) {
-                error = avc_has_perm(sid, tsid,
-                                     SECCLASS_DIR, DIR__SEARCH, NULL);
-        } else {
-                av = 0;
-                if (op & 004)
-                        av |= FILE__READ;
-                if (op & 002)
-                        av |= FILE__WRITE;
-                if (av)
-                        error = avc_has_perm(sid, tsid,
-                                             SECCLASS_FILE, av, NULL);
-        }
-
-        return error;
-}
-
 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
 {
         const struct cred *cred = current_cred();
@@ -2012,7 +1937,8 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
         int rc, cap_sys_admin = 0;
 
-        rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
+        rc = selinux_capable(current, current_cred(),
+                             &init_user_ns, CAP_SYS_ADMIN,
                              SECURITY_CAP_NOAUDIT);
         if (rc == 0)
                 cap_sys_admin = 1;
@@ -2060,7 +1986,8 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
         } else {
                 /* Check for a default transition on this program. */
                 rc = security_transition_sid(old_tsec->sid, isec->sid,
-                                             SECCLASS_PROCESS, &new_tsec->sid);
+                                             SECCLASS_PROCESS, NULL,
+                                             &new_tsec->sid);
                 if (rc)
                         return rc;
         }
@@ -2181,7 +2108,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                         file = file_priv->file;
                         inode = file->f_path.dentry->d_inode;
                         if (inode_has_perm(cred, inode,
-                                           FILE__READ | FILE__WRITE, NULL)) {
+                                           FILE__READ | FILE__WRITE, NULL, 0)) {
                                 drop_tty = 1;
                         }
                 }
@@ -2443,6 +2370,91 @@ out:
         return rc;
 }
 
+static int selinux_sb_remount(struct super_block *sb, void *data)
+{
+        int rc, i, *flags;
+        struct security_mnt_opts opts;
+        char *secdata, **mount_options;
+        struct superblock_security_struct *sbsec = sb->s_security;
+
+        if (!(sbsec->flags & SE_SBINITIALIZED))
+                return 0;
+
+        if (!data)
+                return 0;
+
+        if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
+                return 0;
+
+        security_init_mnt_opts(&opts);
+        secdata = alloc_secdata();
+        if (!secdata)
+                return -ENOMEM;
+        rc = selinux_sb_copy_data(data, secdata);
+        if (rc)
+                goto out_free_secdata;
+
+        rc = selinux_parse_opts_str(secdata, &opts);
+        if (rc)
+                goto out_free_secdata;
+
+        mount_options = opts.mnt_opts;
+        flags = opts.mnt_opts_flags;
+
+        for (i = 0; i < opts.num_mnt_opts; i++) {
+                u32 sid;
+                size_t len;
+
+                if (flags[i] == SE_SBLABELSUPP)
+                        continue;
+                len = strlen(mount_options[i]);
+                rc = security_context_to_sid(mount_options[i], len, &sid);
+                if (rc) {
+                        printk(KERN_WARNING "SELinux: security_context_to_sid"
+                               "(%s) failed for (dev %s, type %s) errno=%d\n",
+                               mount_options[i], sb->s_id, sb->s_type->name, rc);
+                        goto out_free_opts;
+                }
+                rc = -EINVAL;
+                switch (flags[i]) {
+                case FSCONTEXT_MNT:
+                        if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
+                                goto out_bad_option;
+                        break;
+                case CONTEXT_MNT:
+                        if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
+                                goto out_bad_option;
+                        break;
+                case ROOTCONTEXT_MNT: {
+                        struct inode_security_struct *root_isec;
+                        root_isec = sb->s_root->d_inode->i_security;
+
+                        if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
+                                goto out_bad_option;
+                        break;
+                }
+                case DEFCONTEXT_MNT:
+                        if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
+                                goto out_bad_option;
+                        break;
+                default:
+                        goto out_free_opts;
+                }
+        }
+
+        rc = 0;
+out_free_opts:
+        security_free_mnt_opts(&opts);
+out_free_secdata:
+        free_secdata(secdata);
+        return rc;
+out_bad_option:
+        printk(KERN_WARNING "SELinux: unable to change security options "
+               "during remount (dev %s, type=%s)\n", sb->s_id,
+               sb->s_type->name);
+        goto out_free_opts;
+}
+
 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
 {
         const struct cred *cred = current_cred();
@@ -2509,8 +2521,8 @@ static void selinux_inode_free_security(struct inode *inode)
 }
 
 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
-                                       char **name, void **value,
-                                       size_t *len)
+                                       const struct qstr *qstr, char **name,
+                                       void **value, size_t *len)
 {
         const struct task_security_struct *tsec = current_security();
         struct inode_security_struct *dsec;
@@ -2531,7 +2543,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
                 rc = security_transition_sid(sid, dsec->sid,
                                              inode_mode_to_security_class(inode->i_mode),
-                                             &newsid);
+                                             qstr, &newsid);
                 if (rc) {
                         printk(KERN_WARNING "%s:  "
                                "security_transition_sid failed, rc=%d (dev=%s "
@@ -2628,7 +2640,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
         return dentry_has_perm(cred, NULL, dentry, FILE__READ);
 }
 
-static int selinux_inode_permission(struct inode *inode, int mask)
+static int selinux_inode_permission(struct inode *inode, int mask, unsigned flags)
 {
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
@@ -2650,7 +2662,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
 
         perms = file_mask_to_av(inode->i_mode, mask);
 
-        return inode_has_perm(cred, inode, perms, &ad);
+        return inode_has_perm(cred, inode, perms, &ad, flags);
 }
 
 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
@@ -2718,7 +2730,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         if (!(sbsec->flags & SE_SBLABELSUPP))
                 return -EOPNOTSUPP;
 
-        if (!is_owner_or_cap(inode))
+        if (!inode_owner_or_capable(inode))
                 return -EPERM;
 
         COMMON_AUDIT_DATA_INIT(&ad, FS);
@@ -2829,7 +2841,8 @@ static int selinux_inode_getsecurity(const struct inode *inode, const char *name
          * and lack of permission just means that we fall back to the
          * in-core context value, not a denial.
          */
-        error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
+        error = selinux_capable(current, current_cred(),
+                                &init_user_ns, CAP_MAC_ADMIN,
                                 SECURITY_CAP_NOAUDIT);
         if (!error)
                 error = security_sid_to_context_force(isec->sid, &context,
@@ -2932,16 +2945,47 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
                               unsigned long arg)
 {
         const struct cred *cred = current_cred();
-        u32 av = 0;
+        int error = 0;
 
-        if (_IOC_DIR(cmd) & _IOC_WRITE)
-                av |= FILE__WRITE;
-        if (_IOC_DIR(cmd) & _IOC_READ)
-                av |= FILE__READ;
-        if (!av)
-                av = FILE__IOCTL;
+        switch (cmd) {
+        case FIONREAD:
+        /* fall through */
+        case FIBMAP:
+        /* fall through */
+        case FIGETBSZ:
+        /* fall through */
+        case EXT2_IOC_GETFLAGS:
+        /* fall through */
+        case EXT2_IOC_GETVERSION:
+                error = file_has_perm(cred, file, FILE__GETATTR);
+                break;
+
+        case EXT2_IOC_SETFLAGS:
+        /* fall through */
+        case EXT2_IOC_SETVERSION:
+                error = file_has_perm(cred, file, FILE__SETATTR);
+                break;
+
+        /* sys_ioctl() checks */
+        case FIONBIO:
+        /* fall through */
+        case FIOASYNC:
+                error = file_has_perm(cred, file, 0);
+                break;
 
-        return file_has_perm(cred, file, av);
+        case KDSKBENT:
+        case KDSKBSENT:
+                error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
+                                        SECURITY_CAP_AUDIT);
+                break;
+
+        /* default case assumes that the command will go
+         * to the file's ioctl() function.
+         */
+        default:
+                error = file_has_perm(cred, file, FILE__IOCTL);
+        }
+        return error;
 }
 
 static int default_noexec;
@@ -3166,7 +3210,7 @@ static int selinux_dentry_open(struct file *file, const struct cred *cred)
          * new inode label or new policy.
          * This check is not redundant - do not remove.
          */
-        return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
+        return inode_has_perm(cred, inode, open_file_to_av(file), NULL, 0);
 }
 
 /* task security operations */
@@ -3644,9 +3688,16 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
 
 /* socket security operations */
 
-static u32 socket_sockcreate_sid(const struct task_security_struct *tsec)
+static int socket_sockcreate_sid(const struct task_security_struct *tsec,
+                                 u16 secclass, u32 *socksid)
 {
-        return tsec->sockcreate_sid ? : tsec->sid;
+        if (tsec->sockcreate_sid > SECSID_NULL) {
+                *socksid = tsec->sockcreate_sid;
+                return 0;
+        }
+
+        return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
+                                       socksid);
 }
 
 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
@@ -3670,12 +3721,16 @@ static int selinux_socket_create(int family, int type,
         const struct task_security_struct *tsec = current_security();
         u32 newsid;
         u16 secclass;
+        int rc;
 
         if (kern)
                 return 0;
 
-        newsid = socket_sockcreate_sid(tsec);
         secclass = socket_type_to_security_class(family, type, protocol);
+        rc = socket_sockcreate_sid(tsec, secclass, &newsid);
+        if (rc)
+                return rc;
+
         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
 }
 
@@ -3687,12 +3742,16 @@ static int selinux_socket_post_create(struct socket *sock, int family,
         struct sk_security_struct *sksec;
         int err = 0;
 
+        isec->sclass = socket_type_to_security_class(family, type, protocol);
+
         if (kern)
                 isec->sid = SECINITSID_KERNEL;
-        else
-                isec->sid = socket_sockcreate_sid(tsec);
+        else {
+                err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
+                if (err)
+                        return err;
+        }
 
-        isec->sclass = socket_type_to_security_class(family, type, protocol);
         isec->initialized = 1;
 
         if (sock->sk) {
@@ -4002,7 +4061,6 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
 {
         int err = 0;
         struct sk_security_struct *sksec = sk->sk_security;
-        u32 peer_sid;
         u32 sk_sid = sksec->sid;
         struct common_audit_data ad;
         char *addrp;
@@ -4021,20 +4079,10 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
                         return err;
         }
 
-        if (selinux_policycap_netpeer) {
-                err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
-                if (err)
-                        return err;
-                err = avc_has_perm(sk_sid, peer_sid,
-                                   SECCLASS_PEER, PEER__RECV, &ad);
-                if (err)
-                        selinux_netlbl_err(skb, err, 0);
-        } else {
-                err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
-                if (err)
-                        return err;
-                err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
-        }
+        err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
+        if (err)
+                return err;
+        err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
 
         return err;
 }
@@ -4306,7 +4354,7 @@ static void selinux_secmark_refcount_dec(void)
 static void selinux_req_classify_flow(const struct request_sock *req,
                                       struct flowi *fl)
 {
-        fl->secid = req->secid;
+        fl->flowi_secid = req->secid;
 }
 
 static int selinux_tun_dev_create(void)
@@ -4529,9 +4577,8 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
                                  SECCLASS_PACKET, PACKET__SEND, &ad))
                         return NF_DROP_ERR(-ECONNREFUSED);
 
-        if (selinux_policycap_netpeer)
-                if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
-                        return NF_DROP_ERR(-ECONNREFUSED);
+        if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
+                return NF_DROP_ERR(-ECONNREFUSED);
 
         return NF_ACCEPT;
 }
@@ -4574,27 +4621,14 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
          * from the sending socket, otherwise use the kernel's sid */
         sk = skb->sk;
         if (sk == NULL) {
-                switch (family) {
-                case PF_INET:
-                        if (IPCB(skb)->flags & IPSKB_FORWARDED)
-                                secmark_perm = PACKET__FORWARD_OUT;
-                        else
-                                secmark_perm = PACKET__SEND;
-                        break;
-                case PF_INET6:
-                        if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
-                                secmark_perm = PACKET__FORWARD_OUT;
-                        else
-                                secmark_perm = PACKET__SEND;
-                        break;
-                default:
-                        return NF_DROP_ERR(-ECONNREFUSED);
-                }
-                if (secmark_perm == PACKET__FORWARD_OUT) {
+                if (skb->skb_iif) {
+                        secmark_perm = PACKET__FORWARD_OUT;
                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
                                 return NF_DROP;
-                } else
+                } else {
+                        secmark_perm = PACKET__SEND;
                         peer_sid = SECINITSID_KERNEL;
+                }
         } else {
                 struct sk_security_struct *sksec = sk->sk_security;
                 peer_sid = sksec->sid;
@@ -4669,6 +4703,7 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
 {
         int err;
         struct common_audit_data ad;
+        u32 sid;
 
         err = cap_netlink_recv(skb, capability);
         if (err)
@@ -4677,8 +4712,9 @@ static int selinux_netlink_recv(struct sk_buff *skb, int capability)
         COMMON_AUDIT_DATA_INIT(&ad, CAP);
         ad.u.cap = capability;
 
-        return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
-                            SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
+        security_task_getsecid(current, &sid);
+        return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
+                            CAP_TO_MASK(capability), &ad);
 }
 
 static int ipc_alloc_security(struct task_struct *task,
@@ -4848,7 +4884,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
                  * message queue this message will be stored in
                  */
                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
-                                             &msec->sid);
+                                             NULL, &msec->sid);
                 if (rc)
                         return rc;
         }
@@ -5402,7 +5438,6 @@ static struct security_operations selinux_ops = {
         .ptrace_traceme =               selinux_ptrace_traceme,
         .capget =                       selinux_capget,
         .capset =                       selinux_capset,
-        .sysctl =                       selinux_sysctl,
         .capable =                      selinux_capable,
         .quotactl =                     selinux_quotactl,
         .quota_on =                     selinux_quota_on,
@@ -5420,6 +5455,7 @@ static struct security_operations selinux_ops = {
         .sb_alloc_security =            selinux_sb_alloc_security,
         .sb_free_security =             selinux_sb_free_security,
         .sb_copy_data =                 selinux_sb_copy_data,
+        .sb_remount =                   selinux_sb_remount,
         .sb_kern_mount =                selinux_sb_kern_mount,
         .sb_show_options =              selinux_sb_show_options,
         .sb_statfs =                    selinux_sb_statfs,
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 5615081b73ec..e77b2ac2908b 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -54,11 +54,11 @@ struct avc_cache_stats {
 
 void __init avc_init(void);
 
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
                u16 tclass, u32 requested,
                struct av_decision *avd,
                int result,
-               struct common_audit_data *a);
+              struct common_audit_data *a, unsigned flags);
 
 #define AVC_STRICT 1 /* Ignore permissive mode. */
 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
@@ -66,9 +66,17 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                          unsigned flags,
                          struct av_decision *avd);
 
-int avc_has_perm(u32 ssid, u32 tsid,
-                 u16 tclass, u32 requested,
-                 struct common_audit_data *auditdata);
+int avc_has_perm_flags(u32 ssid, u32 tsid,
+                       u16 tclass, u32 requested,
+                       struct common_audit_data *auditdata,
+                       unsigned);
+
+static inline int avc_has_perm(u32 ssid, u32 tsid,
+                               u16 tclass, u32 requested,
+                               struct common_audit_data *auditdata)
+{
+        return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
+}
 
 u32 avc_policy_seqno(void);
 
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 7ed3663332ec..b8c53723e09b 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -12,6 +12,10 @@
 #define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
             "write", "associate", "unix_read", "unix_write"
 
+/*
+ * Note: The name for any socket class should be suffixed by "socket",
+ *       and doesn't contain more than one substr of "socket".
+ */
 struct security_class_mapping secclass_map[] = {
         { "security",
           { "compute_av", "compute_create", "compute_member",
@@ -132,8 +136,7 @@ struct security_class_mapping secclass_map[] = {
         { "appletalk_socket",
           { COMMON_SOCK_PERMS, NULL } },
         { "packet",
-          { "send", "recv", "relabelto", "flow_in", "flow_out",
-            "forward_in", "forward_out", NULL } },
+          { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
         { "key",
           { "view", "read", "write", "search", "link", "setattr", "create",
             NULL } },
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 671273eb1115..348eb00cb668 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -8,6 +8,7 @@
 #ifndef _SELINUX_SECURITY_H_
 #define _SELINUX_SECURITY_H_
 
+#include <linux/dcache.h>
 #include <linux/magic.h>
 #include <linux/types.h>
 #include "flask.h"
@@ -28,13 +29,14 @@
 #define POLICYDB_VERSION_POLCAP         22
 #define POLICYDB_VERSION_PERMISSIVE     23
 #define POLICYDB_VERSION_BOUNDARY       24
+#define POLICYDB_VERSION_FILENAME_TRANS 25
 
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
 #ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
 #define POLICYDB_VERSION_MAX    CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
 #else
-#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_BOUNDARY
+#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_FILENAME_TRANS
 #endif
 
 /* Mask for just the mount related flags */
@@ -106,8 +108,8 @@ void security_compute_av(u32 ssid, u32 tsid,
 void security_compute_av_user(u32 ssid, u32 tsid,
                              u16 tclass, struct av_decision *avd);
 
-int security_transition_sid(u32 ssid, u32 tsid,
-                            u16 tclass, u32 *out_sid);
+int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
+                            const struct qstr *qstr, u32 *out_sid);
 
 int security_transition_sid_user(u32 ssid, u32 tsid,
                                  u16 tclass, u32 *out_sid);
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 13128f9a3e5a..b43813c9e049 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -19,7 +19,7 @@ void selinux_xfrm_state_free(struct xfrm_state *x);
 int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
-                        struct xfrm_policy *xp, struct flowi *fl);
+                        struct xfrm_policy *xp, const struct flowi *fl);
 
 /*
  * Extract the security blob from the sock (it's actually on the socket)
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 1c2fc46544bf..c3bf3ed07b06 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -151,7 +151,7 @@ void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec)
  *
  * Description:
  * Called when the NetLabel state of a sk_security_struct needs to be reset.
- * The caller is responsibile for all the NetLabel sk_security_struct locking.
+ * The caller is responsible for all the NetLabel sk_security_struct locking.
  *
  */
 void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec)
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index dff0c75345c1..63ce2f9e441d 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -14,7 +14,7 @@
  *
  * Copyright (C) 2003 Tresys Technology, LLC
  *      This program is free software; you can redistribute it and/or modify
- *      it under the terms of the GNU General Public License as published by
+ *      it under the terms of the GNU General Public License as published by
  *      the Free Software Foundation, version 2.
  *
  * Updated: Yuichi Nakamura <ynakam@hitachisoft.jp>
@@ -27,16 +27,16 @@ struct avtab_key {
         u16 source_type;        /* source type */
         u16 target_type;        /* target type */
         u16 target_class;       /* target object class */
-#define AVTAB_ALLOWED     1
-#define AVTAB_AUDITALLOW  2
-#define AVTAB_AUDITDENY   4
-#define AVTAB_AV         (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY)
-#define AVTAB_TRANSITION 16
-#define AVTAB_MEMBER     32
-#define AVTAB_CHANGE     64
-#define AVTAB_TYPE       (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
-#define AVTAB_ENABLED_OLD    0x80000000 /* reserved for used in cond_avtab */
-#define AVTAB_ENABLED    0x8000 /* reserved for used in cond_avtab */
+#define AVTAB_ALLOWED           0x0001
+#define AVTAB_AUDITALLOW        0x0002
+#define AVTAB_AUDITDENY         0x0004
+#define AVTAB_AV                (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY)
+#define AVTAB_TRANSITION        0x0010
+#define AVTAB_MEMBER            0x0020
+#define AVTAB_CHANGE            0x0040
+#define AVTAB_TYPE              (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
+#define AVTAB_ENABLED_OLD   0x80000000 /* reserved for used in cond_avtab */
+#define AVTAB_ENABLED           0x8000 /* reserved for used in cond_avtab */
         u16 specified;  /* what field is specified */
 };
 
@@ -86,7 +86,6 @@ void avtab_cache_destroy(void);
 
 #define MAX_AVTAB_HASH_BITS 11
 #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS)
-#define MAX_AVTAB_HASH_MASK (MAX_AVTAB_HASH_BUCKETS-1)
 
 #endif  /* _SS_AVTAB_H_ */
 
diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
index 1f4e93c2ae86..922f8afa89dd 100644
--- a/security/selinux/ss/ebitmap.h
+++ b/security/selinux/ss/ebitmap.h
@@ -36,7 +36,6 @@ struct ebitmap {
 };
 
 #define ebitmap_length(e) ((e)->highbit)
-#define ebitmap_startbit(e) ((e)->node ? (e)->node->startbit : 0)
 
 static inline unsigned int ebitmap_start_positive(struct ebitmap *e,
                                                   struct ebitmap_node **n)
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 1ef8e4e89880..e96174216bc9 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -512,7 +512,8 @@ int mls_compute_sid(struct context *scontext,
                     struct context *tcontext,
                     u16 tclass,
                     u32 specified,
-                    struct context *newcontext)
+                    struct context *newcontext,
+                    bool sock)
 {
         struct range_trans rtr;
         struct mls_range *r;
@@ -531,7 +532,7 @@ int mls_compute_sid(struct context *scontext,
                         return mls_range_set(newcontext, r);
                 /* Fallthrough */
         case AVTAB_CHANGE:
-                if (tclass == policydb.process_class)
+                if ((tclass == policydb.process_class) || (sock == true))
                         /* Use the process MLS attributes. */
                         return mls_context_cpy(newcontext, scontext);
                 else
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index cd9152632e54..037bf9d82d41 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -49,7 +49,8 @@ int mls_compute_sid(struct context *scontext,
                     struct context *tcontext,
                     u16 tclass,
                     u32 specified,
-                    struct context *newcontext);
+                    struct context *newcontext,
+                    bool sock);
 
 int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
                          struct context *usercon);
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 57363562f0f8..e6e7ce0d3d55 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -123,6 +123,11 @@ static struct policydb_compat_info policydb_compat[] = {
                 .sym_num        = SYM_NUM,
                 .ocon_num       = OCON_NUM,
         },
+        {
+                .version        = POLICYDB_VERSION_FILENAME_TRANS,
+                .sym_num        = SYM_NUM,
+                .ocon_num       = OCON_NUM,
+        },
 };
 
 static struct policydb_compat_info *policydb_lookup_compat(int version)
@@ -497,7 +502,7 @@ static int policydb_index(struct policydb *p)
                 goto out;
 
         rc = flex_array_prealloc(p->type_val_to_struct_array, 0,
-                                 p->p_types.nprim - 1, GFP_KERNEL | __GFP_ZERO);
+                                 p->p_types.nprim, GFP_KERNEL | __GFP_ZERO);
         if (rc)
                 goto out;
 
@@ -514,7 +519,7 @@ static int policydb_index(struct policydb *p)
                         goto out;
 
                 rc = flex_array_prealloc(p->sym_val_to_name[i],
-                                         0, p->symtab[i].nprim - 1,
+                                         0, p->symtab[i].nprim,
                                          GFP_KERNEL | __GFP_ZERO);
                 if (rc)
                         goto out;
@@ -704,6 +709,7 @@ void policydb_destroy(struct policydb *p)
         int i;
         struct role_allow *ra, *lra = NULL;
         struct role_trans *tr, *ltr = NULL;
+        struct filename_trans *ft, *nft;
 
         for (i = 0; i < SYM_NUM; i++) {
                 cond_resched();
@@ -781,6 +787,15 @@ void policydb_destroy(struct policydb *p)
                 }
                 flex_array_free(p->type_attr_map_array);
         }
+
+        ft = p->filename_trans;
+        while (ft) {
+                nft = ft->next;
+                kfree(ft->name);
+                kfree(ft);
+                ft = nft;
+        }
+
         ebitmap_destroy(&p->policycaps);
         ebitmap_destroy(&p->permissive_map);
 
@@ -1788,6 +1803,76 @@ out:
         return rc;
 }
 
+static int filename_trans_read(struct policydb *p, void *fp)
+{
+        struct filename_trans *ft, *last;
+        u32 nel, len;
+        char *name;
+        __le32 buf[4];
+        int rc, i;
+
+        if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
+                return 0;
+
+        rc = next_entry(buf, fp, sizeof(u32));
+        if (rc)
+                goto out;
+        nel = le32_to_cpu(buf[0]);
+
+        printk(KERN_ERR "%s: nel=%d\n", __func__, nel);
+
+        last = p->filename_trans;
+        while (last && last->next)
+                last = last->next;
+
+        for (i = 0; i < nel; i++) {
+                rc = -ENOMEM;
+                ft = kzalloc(sizeof(*ft), GFP_KERNEL);
+                if (!ft)
+                        goto out;
+
+                /* add it to the tail of the list */
+                if (!last)
+                        p->filename_trans = ft;
+                else
+                        last->next = ft;
+                last = ft;
+
+                /* length of the path component string */
+                rc = next_entry(buf, fp, sizeof(u32));
+                if (rc)
+                        goto out;
+                len = le32_to_cpu(buf[0]);
+
+                rc = -ENOMEM;
+                name = kmalloc(len + 1, GFP_KERNEL);
+                if (!name)
+                        goto out;
+
+                ft->name = name;
+
+                /* path component string */
+                rc = next_entry(name, fp, len);
+                if (rc)
+                        goto out;
+                name[len] = 0;
+
+                printk(KERN_ERR "%s: ft=%p ft->name=%p ft->name=%s\n", __func__, ft, ft->name, ft->name);
+
+                rc = next_entry(buf, fp, sizeof(u32) * 4);
+                if (rc)
+                        goto out;
+
+                ft->stype = le32_to_cpu(buf[0]);
+                ft->ttype = le32_to_cpu(buf[1]);
+                ft->tclass = le32_to_cpu(buf[2]);
+                ft->otype = le32_to_cpu(buf[3]);
+        }
+        rc = 0;
+out:
+        return rc;
+}
+
 static int genfs_read(struct policydb *p, void *fp)
 {
         int i, j, rc;
@@ -2251,6 +2336,10 @@ int policydb_read(struct policydb *p, void *fp)
                 lra = ra;
         }
 
+        rc = filename_trans_read(p, fp);
+        if (rc)
+                goto bad;
+
         rc = policydb_index(p);
         if (rc)
                 goto bad;
@@ -2286,7 +2375,7 @@ int policydb_read(struct policydb *p, void *fp)
                 goto bad;
 
         /* preallocate so we don't have to worry about the put ever failing */
-        rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim - 1,
+        rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim,
                                  GFP_KERNEL | __GFP_ZERO);
         if (rc)
                 goto bad;
@@ -3025,6 +3114,43 @@ static int range_write(struct policydb *p, void *fp)
         return 0;
 }
 
+static int filename_trans_write(struct policydb *p, void *fp)
+{
+        struct filename_trans *ft;
+        u32 len, nel = 0;
+        __le32 buf[4];
+        int rc;
+
+        for (ft = p->filename_trans; ft; ft = ft->next)
+                nel++;
+
+        buf[0] = cpu_to_le32(nel);
+        rc = put_entry(buf, sizeof(u32), 1, fp);
+        if (rc)
+                return rc;
+
+        for (ft = p->filename_trans; ft; ft = ft->next) {
+                len = strlen(ft->name);
+                buf[0] = cpu_to_le32(len);
+                rc = put_entry(buf, sizeof(u32), 1, fp);
+                if (rc)
+                        return rc;
+
+                rc = put_entry(ft->name, sizeof(char), len, fp);
+                if (rc)
+                        return rc;
+
+                buf[0] = ft->stype;
+                buf[1] = ft->ttype;
+                buf[2] = ft->tclass;
+                buf[3] = ft->otype;
+
+                rc = put_entry(buf, sizeof(u32), 4, fp);
+                if (rc)
+                        return rc;
+        }
+        return 0;
+}
 /*
  * Write the configuration data in a policy database
  * structure to a policy database binary representation
@@ -3135,6 +3261,10 @@ int policydb_write(struct policydb *p, void *fp)
         if (rc)
                 return rc;
 
+        rc = filename_trans_write(p, fp);
+        if (rc)
+                return rc;
+
         rc = ocontext_write(p, info, fp);
         if (rc)
                 return rc;
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index 4e3ab9d0b315..732ea4a68682 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -77,6 +77,15 @@ struct role_trans {
         struct role_trans *next;
 };
 
+struct filename_trans {
+        struct filename_trans *next;
+        u32 stype;              /* current process */
+        u32 ttype;              /* parent dir context */
+        u16 tclass;             /* class of new object */
+        const char *name;       /* last path component */
+        u32 otype;              /* expected of new object */
+};
+
 struct role_allow {
         u32 role;               /* current role */
         u32 new_role;           /* new role */
@@ -217,6 +226,9 @@ struct policydb {
         /* role transitions */
         struct role_trans *role_tr;
 
+        /* file transitions with the last path component */
+        struct filename_trans *filename_trans;
+
         /* bools indexed by (value - 1) */
         struct cond_bool_datum **bool_val_to_struct;
         /* type enforcement conditional access vectors and transitions */
@@ -302,7 +314,7 @@ static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
         return 0;
 }
 
-static inline int put_entry(void *buf, size_t bytes, int num, struct policy_file *fp)
+static inline int put_entry(const void *buf, size_t bytes, int num, struct policy_file *fp)
 {
         size_t len = bytes * num;
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index a03cfaf0ee07..6ef4af47dac4 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -201,6 +201,21 @@ static u16 unmap_class(u16 tclass)
         return tclass;
 }
 
+/*
+ * Get kernel value for class from its policy value
+ */
+static u16 map_class(u16 pol_value)
+{
+        u16 i;
+
+        for (i = 1; i < current_mapping_size; i++) {
+                if (current_mapping[i].value == pol_value)
+                        return i;
+        }
+
+        return SECCLASS_NULL;
+}
+
 static void map_decision(u16 tclass, struct av_decision *avd,
                          int allow_unknown)
 {
@@ -1343,10 +1358,27 @@ out:
         return -EACCES;
 }
 
+static void filename_compute_type(struct policydb *p, struct context *newcontext,
+                                  u32 scon, u32 tcon, u16 tclass,
+                                  const struct qstr *qstr)
+{
+        struct filename_trans *ft;
+        for (ft = p->filename_trans; ft; ft = ft->next) {
+                if (ft->stype == scon &&
+                    ft->ttype == tcon &&
+                    ft->tclass == tclass &&
+                    !strcmp(ft->name, qstr->name)) {
+                        newcontext->type = ft->otype;
+                        return;
+                }
+        }
+}
+
 static int security_compute_sid(u32 ssid,
                                 u32 tsid,
                                 u16 orig_tclass,
                                 u32 specified,
+                                const struct qstr *qstr,
                                 u32 *out_sid,
                                 bool kern)
 {
@@ -1357,6 +1389,7 @@ static int security_compute_sid(u32 ssid,
         struct avtab_node *node;
         u16 tclass;
         int rc = 0;
+        bool sock;
 
         if (!ss_initialized) {
                 switch (orig_tclass) {
@@ -1374,10 +1407,13 @@ static int security_compute_sid(u32 ssid,
 
         read_lock(&policy_rwlock);
 
-        if (kern)
+        if (kern) {
                 tclass = unmap_class(orig_tclass);
-        else
+                sock = security_is_socket_class(orig_tclass);
+        } else {
                 tclass = orig_tclass;
+                sock = security_is_socket_class(map_class(tclass));
+        }
 
         scontext = sidtab_search(&sidtab, ssid);
         if (!scontext) {
@@ -1408,7 +1444,7 @@ static int security_compute_sid(u32 ssid,
         }
 
         /* Set the role and type to default values. */
-        if (tclass == policydb.process_class) {
+        if ((tclass == policydb.process_class) || (sock == true)) {
                 /* Use the current role and type of process. */
                 newcontext.role = scontext->role;
                 newcontext.type = scontext->type;
@@ -1442,6 +1478,11 @@ static int security_compute_sid(u32 ssid,
                 newcontext.type = avdatum->data;
         }
 
+        /* if we have a qstr this is a file trans check so check those rules */
+        if (qstr)
+                filename_compute_type(&policydb, &newcontext, scontext->type,
+                                      tcontext->type, tclass, qstr);
+
         /* Check for class-specific changes. */
         if  (tclass == policydb.process_class) {
                 if (specified & AVTAB_TRANSITION) {
@@ -1460,7 +1501,8 @@ static int security_compute_sid(u32 ssid,
 
         /* Set the MLS attributes.
            This is done last because it may allocate memory. */
-        rc = mls_compute_sid(scontext, tcontext, tclass, specified, &newcontext);
+        rc = mls_compute_sid(scontext, tcontext, tclass, specified,
+                             &newcontext, sock);
         if (rc)
                 goto out_unlock;
 
@@ -1495,22 +1537,17 @@ out:
  * if insufficient memory is available, or %0 if the new SID was
  * computed successfully.
  */
-int security_transition_sid(u32 ssid,
-                            u32 tsid,
-                            u16 tclass,
-                            u32 *out_sid)
+int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
+                            const struct qstr *qstr, u32 *out_sid)
 {
         return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
-                                    out_sid, true);
+                                    qstr, out_sid, true);
 }
 
-int security_transition_sid_user(u32 ssid,
-                                 u32 tsid,
-                                 u16 tclass,
-                                 u32 *out_sid)
+int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid)
 {
         return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
-                                    out_sid, false);
+                                    NULL, out_sid, false);
 }
 
 /**
@@ -1531,8 +1568,8 @@ int security_member_sid(u32 ssid,
                         u16 tclass,
                         u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid,
-                                    false);
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,
+                                    out_sid, false);
 }
 
 /**
@@ -1553,8 +1590,8 @@ int security_change_sid(u32 ssid,
                         u16 tclass,
                         u32 *out_sid)
 {
-        return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid,
-                                    false);
+        return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,
+                                    out_sid, false);
 }
 
 /* Clone the SID into the new SID table. */
@@ -2769,7 +2806,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
         case AUDIT_SUBJ_CLR:
         case AUDIT_OBJ_LEV_LOW:
         case AUDIT_OBJ_LEV_HIGH:
-                /* we do not allow a range, indicated by the presense of '-' */
+                /* we do not allow a range, indicated by the presence of '-' */
                 if (strchr(rulestr, '-'))
                         return -EINVAL;
                 break;
@@ -3038,7 +3075,7 @@ static void security_netlbl_cache_add(struct netlbl_lsm_secattr *secattr,
  * Description:
  * Convert the given NetLabel security attributes in @secattr into a
  * SELinux SID.  If the @secattr field does not contain a full SELinux
- * SID/context then use SECINITSID_NETMSG as the foundation.  If possibile the
+ * SID/context then use SECINITSID_NETMSG as the foundation.  If possible the
  * 'cache' field of @secattr is set and the CACHE flag is set; this is to
  * allow the @secattr to be used by NetLabel to cache the secattr to SID
  * conversion for future lookups.  Returns zero on success, negative values on
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index fff78d3b51a2..68178b76a2b3 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -112,7 +112,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
  */
 
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp,
-                        struct flowi *fl)
+                        const struct flowi *fl)
 {
         u32 state_sid;
         int rc;
@@ -135,10 +135,10 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
 
         state_sid = x->security->ctx_sid;
 
-        if (fl->secid != state_sid)
+        if (fl->flowi_secid != state_sid)
                 return 0;
 
-        rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
+        rc = avc_has_perm(fl->flowi_secid, state_sid, SECCLASS_ASSOCIATION,
                           ASSOCIATION__SENDTO,
                           NULL)? 0:1;
 
@@ -208,7 +208,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
         if (!uctx)
                 goto not_from_user;
 
-        if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX)
+        if (uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
                 return -EINVAL;
 
         str_len = uctx->ctx_len;