1 files changed, 133 insertions, 43 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 28482f9e15b8..d85b793c9321 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1420,6 +1420,7 @@ static int cred_has_capability(const struct cred *cred,
                                int cap, int audit)
 {
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         struct av_decision avd;
         u16 sclass;
         u32 sid = cred_sid(cred);
@@ -1427,6 +1428,7 @@ static int cred_has_capability(const struct cred *cred,
         int rc;
 
         COMMON_AUDIT_DATA_INIT(&ad, CAP);
+        ad.selinux_audit_data = &sad;
         ad.tsk = current;
         ad.u.cap = cap;
 
@@ -1492,9 +1494,11 @@ static int inode_has_perm_noadp(const struct cred *cred,
                                 unsigned flags)
 {
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
 
         COMMON_AUDIT_DATA_INIT(&ad, INODE);
         ad.u.inode = inode;
+        ad.selinux_audit_data = &sad;
         return inode_has_perm(cred, inode, perms, &ad, flags);
 }
 
@@ -1507,9 +1511,11 @@ static inline int dentry_has_perm(const struct cred *cred,
 {
         struct inode *inode = dentry->d_inode;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
         ad.u.dentry = dentry;
+        ad.selinux_audit_data = &sad;
         return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
@@ -1522,9 +1528,11 @@ static inline int path_has_perm(const struct cred *cred,
 {
         struct inode *inode = path->dentry->d_inode;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
 
         COMMON_AUDIT_DATA_INIT(&ad, PATH);
         ad.u.path = *path;
+        ad.selinux_audit_data = &sad;
         return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
@@ -1543,11 +1551,13 @@ static int file_has_perm(const struct cred *cred,
         struct file_security_struct *fsec = file->f_security;
         struct inode *inode = file->f_path.dentry->d_inode;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = cred_sid(cred);
         int rc;
 
         COMMON_AUDIT_DATA_INIT(&ad, PATH);
         ad.u.path = file->f_path;
+        ad.selinux_audit_data = &sad;
 
         if (sid != fsec->sid) {
                 rc = avc_has_perm(sid, fsec->sid,
@@ -1577,6 +1587,7 @@ static int may_create(struct inode *dir,
         struct superblock_security_struct *sbsec;
         u32 sid, newsid;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         int rc;
 
         dsec = dir->i_security;
@@ -1587,6 +1598,7 @@ static int may_create(struct inode *dir,
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
         ad.u.dentry = dentry;
+        ad.selinux_audit_data = &sad;
 
         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
                           DIR__ADD_NAME | DIR__SEARCH,
@@ -1631,6 +1643,7 @@ static int may_link(struct inode *dir,
 {
         struct inode_security_struct *dsec, *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
         u32 av;
         int rc;
@@ -1640,6 +1653,7 @@ static int may_link(struct inode *dir,
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
         ad.u.dentry = dentry;
+        ad.selinux_audit_data = &sad;
 
         av = DIR__SEARCH;
         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
@@ -1674,6 +1688,7 @@ static inline int may_rename(struct inode *old_dir,
 {
         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
         u32 av;
         int old_is_dir, new_is_dir;
@@ -1685,6 +1700,7 @@ static inline int may_rename(struct inode *old_dir,
         new_dsec = new_dir->i_security;
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.selinux_audit_data = &sad;
 
         ad.u.dentry = old_dentry;
         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
@@ -1970,6 +1986,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
         struct task_security_struct *new_tsec;
         struct inode_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         struct inode *inode = bprm->file->f_path.dentry->d_inode;
         int rc;
 
@@ -2009,6 +2026,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
         }
 
         COMMON_AUDIT_DATA_INIT(&ad, PATH);
+        ad.selinux_audit_data = &sad;
         ad.u.path = bprm->file->f_path;
 
         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
@@ -2098,6 +2116,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                                             struct files_struct *files)
 {
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         struct file *file, *devnull = NULL;
         struct tty_struct *tty;
         struct fdtable *fdt;
@@ -2135,6 +2154,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
         /* Revalidate access to inherited open files. */
 
         COMMON_AUDIT_DATA_INIT(&ad, INODE);
+        ad.selinux_audit_data = &sad;
 
         spin_lock(&files->file_lock);
         for (;;) {
@@ -2472,6 +2492,7 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
 {
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         int rc;
 
         rc = superblock_doinit(sb, data);
@@ -2483,6 +2504,7 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
                 return 0;
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.selinux_audit_data = &sad;
         ad.u.dentry = sb->s_root;
         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
 }
@@ -2491,8 +2513,10 @@ static int selinux_sb_statfs(struct dentry *dentry)
 {
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.selinux_audit_data = &sad;
         ad.u.dentry = dentry->d_sb->s_root;
         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
 }
@@ -2656,6 +2680,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
 {
         const struct cred *cred = current_cred();
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 perms;
         bool from_access;
         unsigned flags = mask & MAY_NOT_BLOCK;
@@ -2668,10 +2693,11 @@ static int selinux_inode_permission(struct inode *inode, int mask)
                 return 0;
 
         COMMON_AUDIT_DATA_INIT(&ad, INODE);
+        ad.selinux_audit_data = &sad;
         ad.u.inode = inode;
 
         if (from_access)
-                ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
+                ad.selinux_audit_data->auditdeny |= FILE__AUDIT_ACCESS;
 
         perms = file_mask_to_av(inode->i_mode, mask);
 
@@ -2737,6 +2763,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
         struct inode_security_struct *isec = inode->i_security;
         struct superblock_security_struct *sbsec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 newsid, sid = current_sid();
         int rc = 0;
 
@@ -2751,6 +2778,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
                 return -EPERM;
 
         COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+        ad.selinux_audit_data = &sad;
         ad.u.dentry = dentry;
 
         rc = avc_has_perm(sid, isec->sid, isec->sclass,
@@ -3345,10 +3373,12 @@ static int selinux_kernel_module_request(char *kmod_name)
 {
         u32 sid;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
 
         sid = task_sid(current);
 
         COMMON_AUDIT_DATA_INIT(&ad, KMOD);
+        ad.selinux_audit_data = &sad;
         ad.u.kmod_name = kmod_name;
 
         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
@@ -3487,8 +3517,8 @@ static int selinux_parse_skb_ipv4(struct sk_buff *skb,
         if (ihlen < sizeof(_iph))
                 goto out;
 
-        ad->u.net.v4info.saddr = ih->saddr;
-        ad->u.net.v4info.daddr = ih->daddr;
+        ad->u.net->v4info.saddr = ih->saddr;
+        ad->u.net->v4info.daddr = ih->daddr;
         ret = 0;
 
         if (proto)
@@ -3506,8 +3536,8 @@ static int selinux_parse_skb_ipv4(struct sk_buff *skb,
                 if (th == NULL)
                         break;
 
-                ad->u.net.sport = th->source;
-                ad->u.net.dport = th->dest;
+                ad->u.net->sport = th->source;
+                ad->u.net->dport = th->dest;
                 break;
         }
 
@@ -3522,8 +3552,8 @@ static int selinux_parse_skb_ipv4(struct sk_buff *skb,
                 if (uh == NULL)
                         break;
 
-                ad->u.net.sport = uh->source;
-                ad->u.net.dport = uh->dest;
+                ad->u.net->sport = uh->source;
+                ad->u.net->dport = uh->dest;
                 break;
         }
 
@@ -3538,8 +3568,8 @@ static int selinux_parse_skb_ipv4(struct sk_buff *skb,
                 if (dh == NULL)
                         break;
 
-                ad->u.net.sport = dh->dccph_sport;
-                ad->u.net.dport = dh->dccph_dport;
+                ad->u.net->sport = dh->dccph_sport;
+                ad->u.net->dport = dh->dccph_dport;
                 break;
         }
 
@@ -3566,8 +3596,8 @@ static int selinux_parse_skb_ipv6(struct sk_buff *skb,
         if (ip6 == NULL)
                 goto out;
 
-        ad->u.net.v6info.saddr = ip6->saddr;
-        ad->u.net.v6info.daddr = ip6->daddr;
+        ad->u.net->v6info.saddr = ip6->saddr;
+        ad->u.net->v6info.daddr = ip6->daddr;
         ret = 0;
 
         nexthdr = ip6->nexthdr;
@@ -3587,8 +3617,8 @@ static int selinux_parse_skb_ipv6(struct sk_buff *skb,
                 if (th == NULL)
                         break;
 
-                ad->u.net.sport = th->source;
-                ad->u.net.dport = th->dest;
+                ad->u.net->sport = th->source;
+                ad->u.net->dport = th->dest;
                 break;
         }
 
@@ -3599,8 +3629,8 @@ static int selinux_parse_skb_ipv6(struct sk_buff *skb,
                 if (uh == NULL)
                         break;
 
-                ad->u.net.sport = uh->source;
-                ad->u.net.dport = uh->dest;
+                ad->u.net->sport = uh->source;
+                ad->u.net->dport = uh->dest;
                 break;
         }
 
@@ -3611,8 +3641,8 @@ static int selinux_parse_skb_ipv6(struct sk_buff *skb,
                 if (dh == NULL)
                         break;
 
-                ad->u.net.sport = dh->dccph_sport;
-                ad->u.net.dport = dh->dccph_dport;
+                ad->u.net->sport = dh->dccph_sport;
+                ad->u.net->dport = dh->dccph_dport;
                 break;
         }
 
@@ -3632,13 +3662,13 @@ static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
         char *addrp;
         int ret;
 
-        switch (ad->u.net.family) {
+        switch (ad->u.net->family) {
         case PF_INET:
                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
                 if (ret)
                         goto parse_error;
-                addrp = (char *)(src ? &ad->u.net.v4info.saddr :
-                                       &ad->u.net.v4info.daddr);
+                addrp = (char *)(src ? &ad->u.net->v4info.saddr :
+                                       &ad->u.net->v4info.daddr);
                 goto okay;
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -3646,8 +3676,8 @@ static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
                 if (ret)
                         goto parse_error;
-                addrp = (char *)(src ? &ad->u.net.v6info.saddr :
-                                       &ad->u.net.v6info.daddr);
+                addrp = (char *)(src ? &ad->u.net->v6info.saddr :
+                                       &ad->u.net->v6info.daddr);
                 goto okay;
 #endif  /* IPV6 */
         default:
@@ -3721,13 +3751,17 @@ static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
 {
         struct sk_security_struct *sksec = sk->sk_security;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         u32 tsid = task_sid(task);
 
         if (sksec->sid == SECINITSID_KERNEL)
                 return 0;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.sk = sk;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->sk = sk;
 
         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
 }
@@ -3805,6 +3839,8 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                 char *addrp;
                 struct sk_security_struct *sksec = sk->sk_security;
                 struct common_audit_data ad;
+                struct selinux_audit_data sad = {0,};
+                struct lsm_network_audit net = {0,};
                 struct sockaddr_in *addr4 = NULL;
                 struct sockaddr_in6 *addr6 = NULL;
                 unsigned short snum;
@@ -3831,8 +3867,10 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                                 if (err)
                                         goto out;
                                 COMMON_AUDIT_DATA_INIT(&ad, NET);
-                                ad.u.net.sport = htons(snum);
-                                ad.u.net.family = family;
+                                ad.selinux_audit_data = &sad;
+                                ad.u.net = &net;
+                                ad.u.net->sport = htons(snum);
+                                ad.u.net->family = family;
                                 err = avc_has_perm(sksec->sid, sid,
                                                    sksec->sclass,
                                                    SOCKET__NAME_BIND, &ad);
@@ -3864,13 +3902,15 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                         goto out;
 
                 COMMON_AUDIT_DATA_INIT(&ad, NET);
-                ad.u.net.sport = htons(snum);
-                ad.u.net.family = family;
+                ad.selinux_audit_data = &sad;
+                ad.u.net = &net;
+                ad.u.net->sport = htons(snum);
+                ad.u.net->family = family;
 
                 if (family == PF_INET)
-                        ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
+                        ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
                 else
-                        ad.u.net.v6info.saddr = addr6->sin6_addr;
+                        ad.u.net->v6info.saddr = addr6->sin6_addr;
 
                 err = avc_has_perm(sksec->sid, sid,
                                    sksec->sclass, node_perm, &ad);
@@ -3897,6 +3937,8 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
             sksec->sclass == SECCLASS_DCCP_SOCKET) {
                 struct common_audit_data ad;
+                struct selinux_audit_data sad = {0,};
+                struct lsm_network_audit net = {0,};
                 struct sockaddr_in *addr4 = NULL;
                 struct sockaddr_in6 *addr6 = NULL;
                 unsigned short snum;
@@ -3922,8 +3964,10 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
 
                 COMMON_AUDIT_DATA_INIT(&ad, NET);
-                ad.u.net.dport = htons(snum);
-                ad.u.net.family = sk->sk_family;
+                ad.selinux_audit_data = &sad;
+                ad.u.net = &net;
+                ad.u.net->dport = htons(snum);
+                ad.u.net->family = sk->sk_family;
                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
                 if (err)
                         goto out;
@@ -4012,10 +4056,14 @@ static int selinux_socket_unix_stream_connect(struct sock *sock,
         struct sk_security_struct *sksec_other = other->sk_security;
         struct sk_security_struct *sksec_new = newsk->sk_security;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         int err;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.sk = other;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->sk = other;
 
         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
                            sksec_other->sclass,
@@ -4042,9 +4090,13 @@ static int selinux_socket_unix_may_send(struct socket *sock,
         struct sk_security_struct *ssec = sock->sk->sk_security;
         struct sk_security_struct *osec = other->sk->sk_security;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.sk = other->sk;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->sk = other->sk;
 
         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
                             &ad);
@@ -4080,11 +4132,15 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
         struct sk_security_struct *sksec = sk->sk_security;
         u32 sk_sid = sksec->sid;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         char *addrp;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.netif = skb->skb_iif;
-        ad.u.net.family = family;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->netif = skb->skb_iif;
+        ad.u.net->family = family;
         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
         if (err)
                 return err;
@@ -4111,6 +4167,8 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         u16 family = sk->sk_family;
         u32 sk_sid = sksec->sid;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         char *addrp;
         u8 secmark_active;
         u8 peerlbl_active;
@@ -4135,8 +4193,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 return 0;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.netif = skb->skb_iif;
-        ad.u.net.family = family;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->netif = skb->skb_iif;
+        ad.u.net->family = family;
         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
         if (err)
                 return err;
@@ -4471,6 +4531,8 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
         char *addrp;
         u32 peer_sid;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         u8 secmark_active;
         u8 netlbl_active;
         u8 peerlbl_active;
@@ -4488,8 +4550,10 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
                 return NF_DROP;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.netif = ifindex;
-        ad.u.net.family = family;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->netif = ifindex;
+        ad.u.net->family = family;
         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
                 return NF_DROP;
 
@@ -4576,6 +4640,8 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
         struct sock *sk = skb->sk;
         struct sk_security_struct *sksec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         char *addrp;
         u8 proto;
 
@@ -4584,8 +4650,10 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
         sksec = sk->sk_security;
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.netif = ifindex;
-        ad.u.net.family = family;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->netif = ifindex;
+        ad.u.net->family = family;
         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
                 return NF_DROP;
 
@@ -4607,6 +4675,8 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
         u32 peer_sid;
         struct sock *sk;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
+        struct lsm_network_audit net = {0,};
         char *addrp;
         u8 secmark_active;
         u8 peerlbl_active;
@@ -4653,8 +4723,10 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
         }
 
         COMMON_AUDIT_DATA_INIT(&ad, NET);
-        ad.u.net.netif = ifindex;
-        ad.u.net.family = family;
+        ad.selinux_audit_data = &sad;
+        ad.u.net = &net;
+        ad.u.net->netif = ifindex;
+        ad.u.net->family = family;
         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
                 return NF_DROP;
 
@@ -4769,11 +4841,13 @@ static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
 
         isec = ipc_perms->security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = ipc_perms->key;
 
         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
@@ -4794,6 +4868,7 @@ static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
         int rc;
 
@@ -4804,6 +4879,7 @@ static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
         isec = msq->q_perm.security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = msq->q_perm.key;
 
         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
@@ -4824,11 +4900,13 @@ static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
 
         isec = msq->q_perm.security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = msq->q_perm.key;
 
         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
@@ -4868,6 +4946,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
         struct ipc_security_struct *isec;
         struct msg_security_struct *msec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
         int rc;
 
@@ -4889,6 +4968,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
         }
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = msq->q_perm.key;
 
         /* Can this process write to the queue? */
@@ -4913,6 +4993,7 @@ static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
         struct ipc_security_struct *isec;
         struct msg_security_struct *msec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = task_sid(target);
         int rc;
 
@@ -4920,6 +5001,7 @@ static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
         msec = msg->security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = msq->q_perm.key;
 
         rc = avc_has_perm(sid, isec->sid,
@@ -4935,6 +5017,7 @@ static int selinux_shm_alloc_security(struct shmid_kernel *shp)
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
         int rc;
 
@@ -4945,6 +5028,7 @@ static int selinux_shm_alloc_security(struct shmid_kernel *shp)
         isec = shp->shm_perm.security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = shp->shm_perm.key;
 
         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
@@ -4965,11 +5049,13 @@ static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
 
         isec = shp->shm_perm.security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = shp->shm_perm.key;
 
         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
@@ -5027,6 +5113,7 @@ static int selinux_sem_alloc_security(struct sem_array *sma)
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
         int rc;
 
@@ -5037,6 +5124,7 @@ static int selinux_sem_alloc_security(struct sem_array *sma)
         isec = sma->sem_perm.security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = sma->sem_perm.key;
 
         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
@@ -5057,11 +5145,13 @@ static int selinux_sem_associate(struct sem_array *sma, int semflg)
 {
         struct ipc_security_struct *isec;
         struct common_audit_data ad;
+        struct selinux_audit_data sad = {0,};
         u32 sid = current_sid();
 
         isec = sma->sem_perm.security;
 
         COMMON_AUDIT_DATA_INIT(&ad, IPC);
+        ad.selinux_audit_data = &sad;
         ad.u.ipc_id = sma->sem_perm.key;
 
         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,