3 files changed, 31 insertions, 9 deletions

diff --git a/security/smack/smack.h b/security/smack/smack.h
index e80597a3048a..076b8e8a51ab 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -168,9 +168,13 @@ struct smk_port_label {
 #define SMACK_CIPSO_DOI_INVALID         -1      /* Not a DOI */
 #define SMACK_CIPSO_DIRECT_DEFAULT      250     /* Arbitrary */
 #define SMACK_CIPSO_MAPPED_DEFAULT      251     /* Also arbitrary */
-#define SMACK_CIPSO_MAXCATVAL           63      /* Bigger gets harder */
 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
-#define SMACK_CIPSO_MAXCATNUM           239     /* CIPSO 2.2 standard */
+/*
+ * CIPSO 2.2 standard is 239, but Smack wants to use the
+ * categories in a structured way that limits the value to
+ * the bits in 23 bytes, hence the unusual number.
+ */
+#define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
 
 /*
  * Flag for transmute access
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index ce000a81caf7..19204e11c02c 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3066,6 +3066,8 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
 {
         struct smack_known *skp;
         int found = 0;
+        int acat;
+        int kcat;
 
         if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
                 /*
@@ -3082,12 +3084,28 @@ static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
                 list_for_each_entry(skp, &smack_known_list, list) {
                         if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl)
                                 continue;
-                        if (memcmp(sap->attr.mls.cat,
-                                skp->smk_netlabel.attr.mls.cat,
-                                SMK_CIPSOLEN) != 0)
-                                continue;
-                        found = 1;
-                        break;
+                        /*
+                         * Compare the catsets. Use the netlbl APIs.
+                         */
+                        if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) {
+                                if ((skp->smk_netlabel.flags &
+                                     NETLBL_SECATTR_MLS_CAT) == 0)
+                                        found = 1;
+                                break;
+                        }
+                        for (acat = -1, kcat = -1; acat == kcat; ) {
+                                acat = netlbl_secattr_catmap_walk(
+                                        sap->attr.mls.cat, acat + 1);
+                                kcat = netlbl_secattr_catmap_walk(
+                                        skp->smk_netlabel.attr.mls.cat,
+                                        kcat + 1);
+                                if (acat < 0 || kcat < 0)
+                                        break;
+                        }
+                        if (acat == kcat) {
+                                found = 1;
+                                break;
+                        }
                 }
                 rcu_read_unlock();
 
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 269b270c6473..a07e93f00a0f 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -890,7 +890,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
         for (i = 0; i < catlen; i++) {
                 rule += SMK_DIGITLEN;
                 ret = sscanf(rule, "%u", &cat);
-                if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
+                if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
                         goto out;
 
                 smack_catset_bit(cat, mapcatset);