1 files changed, 85 insertions, 0 deletions

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 8ee04a424df7..7f0ee1b91e1d 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2054,6 +2054,91 @@ out:
         return rc;
 }
 
+/**
+ * security_net_peersid_resolve - Compare and resolve two network peer SIDs
+ * @nlbl_sid: NetLabel SID
+ * @nlbl_type: NetLabel labeling protocol type
+ * @xfrm_sid: XFRM SID
+ *
+ * Description:
+ * Compare the @nlbl_sid and @xfrm_sid values and if the two SIDs can be
+ * resolved into a single SID it is returned via @peer_sid and the function
+ * returns zero.  Otherwise @peer_sid is set to SECSID_NULL and the function
+ * returns a negative value.  A table summarizing the behavior is below:
+ *
+ *                                 | function return |      @sid
+ *   ------------------------------+-----------------+-----------------
+ *   no peer labels                |        0        |    SECSID_NULL
+ *   single peer label             |        0        |    <peer_label>
+ *   multiple, consistent labels   |        0        |    <peer_label>
+ *   multiple, inconsistent labels |    -<errno>     |    SECSID_NULL
+ *
+ */
+int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,
+                                 u32 xfrm_sid,
+                                 u32 *peer_sid)
+{
+        int rc;
+        struct context *nlbl_ctx;
+        struct context *xfrm_ctx;
+
+        /* handle the common (which also happens to be the set of easy) cases
+         * right away, these two if statements catch everything involving a
+         * single or absent peer SID/label */
+        if (xfrm_sid == SECSID_NULL) {
+                *peer_sid = nlbl_sid;
+                return 0;
+        }
+        /* NOTE: an nlbl_type == NETLBL_NLTYPE_UNLABELED is a "fallback" label
+         * and is treated as if nlbl_sid == SECSID_NULL when a XFRM SID/label
+         * is present */
+        if (nlbl_sid == SECSID_NULL || nlbl_type == NETLBL_NLTYPE_UNLABELED) {
+                *peer_sid = xfrm_sid;
+                return 0;
+        }
+
+        /* we don't need to check ss_initialized here since the only way both
+         * nlbl_sid and xfrm_sid are not equal to SECSID_NULL would be if the
+         * security server was initialized and ss_initialized was true */
+        if (!selinux_mls_enabled) {
+                *peer_sid = SECSID_NULL;
+                return 0;
+        }
+
+        POLICY_RDLOCK;
+
+        nlbl_ctx = sidtab_search(&sidtab, nlbl_sid);
+        if (!nlbl_ctx) {
+                printk(KERN_ERR
+                       "security_sid_mls_cmp:  unrecognized SID %d\n",
+                       nlbl_sid);
+                rc = -EINVAL;
+                goto out_slowpath;
+        }
+        xfrm_ctx = sidtab_search(&sidtab, xfrm_sid);
+        if (!xfrm_ctx) {
+                printk(KERN_ERR
+                       "security_sid_mls_cmp:  unrecognized SID %d\n",
+                       xfrm_sid);
+                rc = -EINVAL;
+                goto out_slowpath;
+        }
+        rc = (mls_context_cmp(nlbl_ctx, xfrm_ctx) ? 0 : -EACCES);
+
+out_slowpath:
+        POLICY_RDUNLOCK;
+        if (rc == 0)
+                /* at present NetLabel SIDs/labels really only carry MLS
+                 * information so if the MLS portion of the NetLabel SID
+                 * matches the MLS portion of the labeled XFRM SID/label
+                 * then pass along the XFRM SID as it is the most
+                 * expressive */
+                *peer_sid = xfrm_sid;
+        else
+                *peer_sid = SECSID_NULL;
+        return rc;
+}
+
 static int get_classes_callback(void *k, void *d, void *args)
 {
         struct class_datum *datum = d;