1 files changed, 16 insertions, 4 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 1c864c0efe2b..59c6e98f7bea 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2495,7 +2495,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
         }
 
         if (value && len) {
-                rc = security_sid_to_context(newsid, &context, &clen);
+                rc = security_sid_to_context_force(newsid, &context, &clen);
                 if (rc) {
                         kfree(namep);
                         return rc;
@@ -2669,6 +2669,11 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
                 return rc;
 
         rc = security_context_to_sid(value, size, &newsid);
+        if (rc == -EINVAL) {
+                if (!capable(CAP_MAC_ADMIN))
+                        return rc;
+                rc = security_context_to_sid_force(value, size, &newsid);
+        }
         if (rc)
                 return rc;
 
@@ -2703,10 +2708,11 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
                 return;
         }
 
-        rc = security_context_to_sid(value, size, &newsid);
+        rc = security_context_to_sid_force(value, size, &newsid);
         if (rc) {
-                printk(KERN_WARNING "%s:  unable to obtain SID for context "
-                       "%s, rc=%d\n", __func__, (char *)value, -rc);
+                printk(KERN_ERR "SELinux:  unable to map context to SID"
+                       "for (%s, %lu), rc=%d\n",
+                       inode->i_sb->s_id, inode->i_ino, -rc);
                 return;
         }
 
@@ -5153,6 +5159,12 @@ static int selinux_setprocattr(struct task_struct *p,
                         size--;
                 }
                 error = security_context_to_sid(value, size, &sid);
+                if (error == -EINVAL && !strcmp(name, "fscreate")) {
+                        if (!capable(CAP_MAC_ADMIN))
+                                return error;
+                        error = security_context_to_sid_force(value, size,
+                                                              &sid);
+                }
                 if (error)
                         return error;
         }