1 files changed, 21 insertions, 5 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b222e966babe..4fbf2c5f26ce 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -136,12 +136,28 @@ static struct kmem_cache *sel_inode_cache;
  * This function checks the SECMARK reference counter to see if any SECMARK
  * targets are currently configured, if the reference counter is greater than
  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
- * enabled, false (0) if SECMARK is disabled.
+ * enabled, false (0) if SECMARK is disabled.  If the always_check_network
+ * policy capability is enabled, SECMARK is always considered enabled.
  *
  */
 static int selinux_secmark_enabled(void)
 {
-        return (atomic_read(&selinux_secmark_refcount) > 0);
+        return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
+}
+
+/**
+ * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
+ *
+ * Description:
+ * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
+ * (1) if any are enabled or false (0) if neither are enabled.  If the
+ * always_check_network policy capability is enabled, peer labeling
+ * is always considered enabled.
+ *
+ */
+static int selinux_peerlbl_enabled(void)
+{
+        return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 }
 
 /*
@@ -4197,7 +4213,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 return selinux_sock_rcv_skb_compat(sk, skb, family);
 
         secmark_active = selinux_secmark_enabled();
-        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return 0;
 
@@ -4579,7 +4595,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
 
         secmark_active = selinux_secmark_enabled();
         netlbl_active = netlbl_enabled();
-        peerlbl_active = netlbl_active || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return NF_ACCEPT;
 
@@ -4731,7 +4747,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                 return NF_ACCEPT;
 #endif
         secmark_active = selinux_secmark_enabled();
-        peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+        peerlbl_active = selinux_peerlbl_enabled();
         if (!secmark_active && !peerlbl_active)
                 return NF_ACCEPT;