2 files changed, 42 insertions, 1 deletions

diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
index 814ddc42f1f4..5c64c746b062 100644
--- a/security/selinux/Kconfig
+++ b/security/selinux/Kconfig
@@ -124,3 +124,40 @@ config SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT
 
           If you are unsure what do do here, select N.
 
+config SECURITY_SELINUX_POLICYDB_VERSION_MAX
+        bool "NSA SELinux maximum supported policy format version"
+        depends on SECURITY_SELINUX
+        default n
+        help
+          This option enables the maximum policy format version supported
+          by SELinux to be set to a particular value.  This value is reported
+          to userspace via /selinux/policyvers and used at policy load time.
+          It can be adjusted downward to support legacy userland (init) that
+          does not correctly handle kernels that support newer policy versions.
+
+          Examples:
+          For the Fedora Core 3 or 4 Linux distributions, enable this option
+          and set the value via the next option. For Fedore Core 5 and later,
+          do not enable this option.
+
+          If you are unsure how to answer this question, answer N.
+
+config SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
+        int "NSA SELinux maximum supported policy format version value"
+        depends on SECURITY_SELINUX_POLICYDB_VERSION_MAX
+        range 15 20
+        default 19
+        help
+          This option sets the value for the maximum policy format version
+          supported by SELinux.
+
+          Examples:
+          For Fedora Core 3, use 18.
+          For Fedora Core 4, use 19.
+
+          If you are unsure how to answer this question, look for the
+          policy format version supported by your policy toolchain, by
+          running 'checkpolicy -V'. Or look at what policy you have
+          installed under /etc/selinux/$SELINUXTYPE/policy, where
+          SELINUXTYPE is defined in your /etc/selinux/config.
+
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 911954a692fa..aa21ca1721af 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -27,7 +27,11 @@
 
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
-#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_AVTAB
+#ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
+#define POLICYDB_VERSION_MAX    CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
+#else
+#define POLICYDB_VERSION_MAX    POLICYDB_VERSION_AVTAB
+#endif
 
 extern int selinux_enabled;
 extern int selinux_mls_enabled;