4 files changed, 30 insertions, 6 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b222e966babe..4fbf2c5f26ce 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -136,12 +136,28 @@ static struct kmem_cache *sel_inode_cache;
  * This function checks the SECMARK reference counter to see if any SECMARK
  * targets are currently configured, if the reference counter is greater than
  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
- * enabled, false (0) if SECMARK is disabled.
+ * enabled, false (0) if SECMARK is disabled.  If the always_check_network
+ * policy capability is enabled, SECMARK is always considered enabled.
  *
  */
 static int selinux_secmark_enabled(void)
 {
-        return (atomic_read(&selinux_secmark_refcount) > 0);
+        return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
+}
+
+/**
+ * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
+ *
+ * Description:
+ * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
+ * (1) if any are enabled or false (0) if neither are enabled.  If the
+ * always_check_network policy capability is enabled, peer labeling
+ * is always considered enabled.
+ *
+ */
+static int selinux_peerlbl_enabled(void)
+{
+        return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 }
 
 /*
@@ -4197,7 +4213,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 return selinux_sock_rcv_skb_compat(sk, skb, family);
 
         secmark_active = selinux_secmark_enabled();
-        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return 0;
 
@@ -4579,7 +4595,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
 
         secmark_active = selinux_secmark_enabled();
         netlbl_active = netlbl_enabled();
-        peerlbl_active = netlbl_active || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return NF_ACCEPT;
 
@@ -4731,7 +4747,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                 return NF_ACCEPT;
 #endif
         secmark_active = selinux_secmark_enabled();
-        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return NF_ACCEPT;
 
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 01a0382c43ca..004a2479880f 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -69,12 +69,15 @@ extern int selinux_enabled;
 enum {
         POLICYDB_CAPABILITY_NETPEER,
         POLICYDB_CAPABILITY_OPENPERM,
+        POLICYDB_CAPABILITY_REDHAT1,
+        POLICYDB_CAPABILITY_ALWAYSNETWORK,
         __POLICYDB_CAPABILITY_MAX
 };
 #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
 
 extern int selinux_policycap_netpeer;
 extern int selinux_policycap_openperm;
+extern int selinux_policycap_alwaysnetwork;
 
 /*
  * type_datum properties
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index ff427733c290..5122affe06a8 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -44,7 +44,9 @@
 /* Policy capability filenames */
 static char *policycap_names[] = {
         "network_peer_controls",
-        "open_perms"
+        "open_perms",
+        "redhat1",
+        "always_check_network"
 };
 
 unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index a90721771615..d106733ad987 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -72,6 +72,7 @@
 
 int selinux_policycap_netpeer;
 int selinux_policycap_openperm;
+int selinux_policycap_alwaysnetwork;
 
 static DEFINE_RWLOCK(policy_rwlock);
 
@@ -1812,6 +1813,8 @@ static void security_load_policycaps(void)
                                                   POLICYDB_CAPABILITY_NETPEER);
         selinux_policycap_openperm = ebitmap_get_bit(&policydb.policycaps,
                                                   POLICYDB_CAPABILITY_OPENPERM);
+        selinux_policycap_alwaysnetwork = ebitmap_get_bit(&policydb.policycaps,
+                                                  POLICYDB_CAPABILITY_ALWAYSNETWORK);
 }
 
 static int security_preserve_bools(struct policydb *p);