26 files changed, 90 insertions, 3 deletions

diff --git a/include/asm-alpha/socket.h b/include/asm-alpha/socket.h
index b5193229132a..d22ab97ea72e 100644
--- a/include/asm-alpha/socket.h
+++ b/include/asm-alpha/socket.h
@@ -51,6 +51,7 @@
 #define SCM_TIMESTAMP           SO_TIMESTAMP
 
 #define SO_PEERSEC              30
+#define SO_PASSSEC              34
 
 /* Security levels - as per NRL IPv6 - don't actually do anything */
 #define SO_SECURITY_AUTHENTICATION              19
diff --git a/include/asm-arm/socket.h b/include/asm-arm/socket.h
index 3c51da6438c9..19f7df702b06 100644
--- a/include/asm-arm/socket.h
+++ b/include/asm-arm/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-arm26/socket.h b/include/asm-arm26/socket.h
index 3c51da6438c9..19f7df702b06 100644
--- a/include/asm-arm26/socket.h
+++ b/include/asm-arm26/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-cris/socket.h b/include/asm-cris/socket.h
index 8b1da3e58c55..01cfdf1d6d33 100644
--- a/include/asm-cris/socket.h
+++ b/include/asm-cris/socket.h
@@ -50,6 +50,7 @@
 #define SO_ACCEPTCONN          30
 
 #define SO_PEERSEC             31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
 
diff --git a/include/asm-frv/socket.h b/include/asm-frv/socket.h
index 7177f8b9817c..31db18fc871f 100644
--- a/include/asm-frv/socket.h
+++ b/include/asm-frv/socket.h
@@ -48,6 +48,7 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
 
diff --git a/include/asm-h8300/socket.h b/include/asm-h8300/socket.h
index d98cf85bafc1..ebc830fee0d0 100644
--- a/include/asm-h8300/socket.h
+++ b/include/asm-h8300/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-i386/socket.h b/include/asm-i386/socket.h
index 802ae76195b7..5755d57c4e95 100644
--- a/include/asm-i386/socket.h
+++ b/include/asm-i386/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-ia64/socket.h b/include/asm-ia64/socket.h
index a255006fb7b5..d638ef3d50c3 100644
--- a/include/asm-ia64/socket.h
+++ b/include/asm-ia64/socket.h
@@ -57,5 +57,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC             31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_IA64_SOCKET_H */
diff --git a/include/asm-m32r/socket.h b/include/asm-m32r/socket.h
index 8b6680f223c0..acdf748fcdc8 100644
--- a/include/asm-m32r/socket.h
+++ b/include/asm-m32r/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_M32R_SOCKET_H */
diff --git a/include/asm-m68k/socket.h b/include/asm-m68k/socket.h
index f578ca4b776a..a5966ec005ae 100644
--- a/include/asm-m68k/socket.h
+++ b/include/asm-m68k/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC             31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-mips/socket.h b/include/asm-mips/socket.h
index 0bb31e5aaca6..36ebe4e186a7 100644
--- a/include/asm-mips/socket.h
+++ b/include/asm-mips/socket.h
@@ -69,6 +69,7 @@ To add: #define SO_REUSEPORT 0x0200	/* Allow local address and port reuse.  */
 #define SO_PEERSEC              30
 #define SO_SNDBUFFORCE          31
 #define SO_RCVBUFFORCE          33
+#define SO_PASSSEC              34
 
 #ifdef __KERNEL__
 
diff --git a/include/asm-parisc/socket.h b/include/asm-parisc/socket.h
index 1bf54dc53c10..ce2eae1708b5 100644
--- a/include/asm-parisc/socket.h
+++ b/include/asm-parisc/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           0x401c
 
 #define SO_PEERSEC              0x401d
+#define SO_PASSSEC              0x401e
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-powerpc/socket.h b/include/asm-powerpc/socket.h
index e4b8177d4acc..c8b1da50e72d 100644
--- a/include/asm-powerpc/socket.h
+++ b/include/asm-powerpc/socket.h
@@ -55,5 +55,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif  /* _ASM_POWERPC_SOCKET_H */
diff --git a/include/asm-s390/socket.h b/include/asm-s390/socket.h
index 15a5298c8744..1778a49a74c5 100644
--- a/include/asm-s390/socket.h
+++ b/include/asm-s390/socket.h
@@ -56,5 +56,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-sh/socket.h b/include/asm-sh/socket.h
index 553904ff9336..ca70362eb563 100644
--- a/include/asm-sh/socket.h
+++ b/include/asm-sh/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* __ASM_SH_SOCKET_H */
diff --git a/include/asm-sparc/socket.h b/include/asm-sparc/socket.h
index 4e0ce3a35ea9..f6c4e5baf3f7 100644
--- a/include/asm-sparc/socket.h
+++ b/include/asm-sparc/socket.h
@@ -48,6 +48,7 @@
 #define SCM_TIMESTAMP           SO_TIMESTAMP
 
 #define SO_PEERSEC              0x001e
+#define SO_PASSSEC              0x001f
 
 /* Security levels - as per NRL IPv6 - don't actually do anything */
 #define SO_SECURITY_AUTHENTICATION              0x5001
diff --git a/include/asm-sparc64/socket.h b/include/asm-sparc64/socket.h
index 59987dad3359..754d46a50af3 100644
--- a/include/asm-sparc64/socket.h
+++ b/include/asm-sparc64/socket.h
@@ -48,6 +48,7 @@
 #define SCM_TIMESTAMP           SO_TIMESTAMP
 
 #define SO_PEERSEC              0x001e
+#define SO_PASSSEC              0x001f
 
 /* Security levels - as per NRL IPv6 - don't actually do anything */
 #define SO_SECURITY_AUTHENTICATION              0x5001
diff --git a/include/asm-v850/socket.h b/include/asm-v850/socket.h
index 0240d366a0a4..0dfe55ac2ef2 100644
--- a/include/asm-v850/socket.h
+++ b/include/asm-v850/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif /* __V850_SOCKET_H__ */
diff --git a/include/asm-x86_64/socket.h b/include/asm-x86_64/socket.h
index f2cdbeae5d5b..b46702607933 100644
--- a/include/asm-x86_64/socket.h
+++ b/include/asm-x86_64/socket.h
@@ -48,5 +48,6 @@
 #define SO_ACCEPTCONN           30
 
 #define SO_PEERSEC             31
+#define SO_PASSSEC              34
 
 #endif /* _ASM_SOCKET_H */
diff --git a/include/asm-xtensa/socket.h b/include/asm-xtensa/socket.h
index 00f83f3a6d72..971d231be60e 100644
--- a/include/asm-xtensa/socket.h
+++ b/include/asm-xtensa/socket.h
@@ -59,5 +59,6 @@
 
 #define SO_ACCEPTCONN           30
 #define SO_PEERSEC              31
+#define SO_PASSSEC              34
 
 #endif  /* _XTENSA_SOCKET_H */
diff --git a/include/linux/net.h b/include/linux/net.h
index 385e68f5bd93..b20c53c74413 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -61,6 +61,7 @@ typedef enum {
 #define SOCK_ASYNC_WAITDATA     1
 #define SOCK_NOSPACE            2
 #define SOCK_PASSCRED           3
+#define SOCK_PASSSEC            4
 
 #ifndef ARCH_HAS_SOCKET_TYPES
 /**
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 795f81f9ec7f..5ba72d95280c 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -53,10 +53,16 @@ struct unix_address {
 struct unix_skb_parms {
         struct ucred            creds;          /* Skb credentials      */
         struct scm_fp_list      *fp;            /* Passed files         */
+#ifdef CONFIG_SECURITY_NETWORK
+        char                    *secdata;       /* Security context     */
+        u32                     seclen;         /* Security length      */
+#endif
 };
 
 #define UNIXCB(skb)     (*(struct unix_skb_parms*)&((skb)->cb))
 #define UNIXCREDS(skb)  (&UNIXCB((skb)).creds)
+#define UNIXSECDATA(skb)        (&UNIXCB((skb)).secdata)
+#define UNIXSECLEN(skb)         (&UNIXCB((skb)).seclen)
 
 #define unix_state_rlock(s)     spin_lock(&unix_sk(s)->lock)
 #define unix_state_runlock(s)   spin_unlock(&unix_sk(s)->lock)
diff --git a/include/net/scm.h b/include/net/scm.h
index 540619cb7160..02daa097cdcd 100644
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -19,6 +19,10 @@ struct scm_cookie
 {
         struct ucred            creds;          /* Skb credentials      */
         struct scm_fp_list      *fp;            /* Passed files         */
+#ifdef CONFIG_SECURITY_NETWORK
+        char                    *secdata;       /* Security context     */
+        u32                     seclen;         /* Security length      */
+#endif
         unsigned long           seq;            /* Connection seqno     */
 };
 
@@ -48,6 +52,17 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
         return __scm_send(sock, msg, scm);
 }
 
+#ifdef CONFIG_SECURITY_NETWORK
+static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+{
+        if (test_bit(SOCK_PASSSEC, &sock->flags) && scm->secdata != NULL)
+                put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, scm->seclen, scm->secdata);
+}
+#else
+static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+{ }
+#endif /* CONFIG_SECURITY_NETWORK */
+
 static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
                                 struct scm_cookie *scm, int flags)
 {
@@ -62,6 +77,8 @@ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
         if (test_bit(SOCK_PASSCRED, &sock->flags))
                 put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(scm->creds), &scm->creds);
 
+        scm_passec(sock, msg, scm);
+
         if (!scm->fp)
                 return;
         
diff --git a/net/core/sock.c b/net/core/sock.c
index 5d820c376653..204a8dec65cc 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -565,6 +565,13 @@ set_rcvbuf:
                         ret = -ENONET;
                         break;
 
+                case SO_PASSSEC:
+                        if (valbool)
+                                set_bit(SOCK_PASSSEC, &sock->flags);
+                        else
+                                clear_bit(SOCK_PASSSEC, &sock->flags);
+                        break;
+
                 /* We implement the SO_SNDLOWAT etc to
                    not be settable (1003.1g 5.3) */
                 default:
@@ -723,6 +730,10 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                         v.val = sk->sk_state == TCP_LISTEN;
                         break;
 
+                case SO_PASSSEC:
+                        v.val = test_bit(SOCK_PASSSEC, &sock->flags) ? 1 : 0;
+                        break;
+
                 case SO_PEERSEC:
                         return security_socket_getpeersec_stream(sock, optval, optlen, len);
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d901465ce013..fd11d4048b52 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -128,6 +128,30 @@ static atomic_t unix_nr_socks = ATOMIC_INIT(0);
 
 #define UNIX_ABSTRACT(sk)       (unix_sk(sk)->addr->hash != UNIX_HASH_SIZE)
 
+#ifdef CONFIG_SECURITY_NETWORK
+static void unix_get_peersec_dgram(struct sk_buff *skb)
+{
+        int err;
+
+        err = security_socket_getpeersec_dgram(skb, UNIXSECDATA(skb),
+                                               UNIXSECLEN(skb));
+        if (err)
+                *(UNIXSECDATA(skb)) = NULL;
+}
+
+static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
+{
+        scm->secdata = *UNIXSECDATA(skb);
+        scm->seclen = *UNIXSECLEN(skb);
+}
+#else
+static void unix_get_peersec_dgram(struct sk_buff *skb)
+{ }
+
+static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
+{ }
+#endif /* CONFIG_SECURITY_NETWORK */
+
 /*
  *  SMP locking strategy:
  *    hash table is protected with spinlock unix_table_lock
@@ -1291,6 +1315,8 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (siocb->scm->fp)
                 unix_attach_fds(siocb->scm, skb);
 
+        unix_get_peersec_dgram(skb);
+
         skb->h.raw = skb->data;
         err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
         if (err)
@@ -1570,6 +1596,7 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
                 memset(&tmp_scm, 0, sizeof(tmp_scm));
         }
         siocb->scm->creds = *UNIXCREDS(skb);
+        unix_set_secdata(siocb->scm, skb);
 
         if (!(flags & MSG_PEEK))
         {
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b6c378dd4f12..b85afcf38527 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -69,6 +69,7 @@
 #include <linux/sysctl.h>
 #include <linux/audit.h>
 #include <linux/string.h>
+#include <linux/selinux.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -3420,7 +3421,13 @@ out:
 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
 {
         int err = 0;
-        u32 peer_sid = selinux_socket_getpeer_dgram(skb);
+        u32 peer_sid;
+
+        if (skb->sk->sk_family == PF_UNIX)
+                selinux_get_inode_sid(SOCK_INODE(skb->sk->sk_socket),
+                                      &peer_sid);
+        else
+                peer_sid = selinux_socket_getpeer_dgram(skb);
 
         if (peer_sid == SECSID_NULL)
                 return -EINVAL;
@@ -3432,8 +3439,6 @@ static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata,
         return 0;
 }
 
-
-
 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 {
         return sk_alloc_security(sk, family, priority);