1 files changed, 69 insertions, 0 deletions

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 85e429884393..b00ec69f0ffd 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1817,6 +1817,75 @@ out:
         return rc;
 }
 
+/*
+ * security_sid_mls_copy() - computes a new sid based on the given
+ * sid and the mls portion of mls_sid.
+ */
+int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
+{
+        struct context *context1;
+        struct context *context2;
+        struct context newcon;
+        char *s;
+        u32 len;
+        int rc = 0;
+
+        if (!ss_initialized) {
+                *new_sid = sid;
+                goto out;
+        }
+
+        context_init(&newcon);
+
+        POLICY_RDLOCK;
+        context1 = sidtab_search(&sidtab, sid);
+        if (!context1) {
+                printk(KERN_ERR "security_sid_mls_copy:  unrecognized SID "
+                       "%d\n", sid);
+                rc = -EINVAL;
+                goto out_unlock;
+        }
+
+        context2 = sidtab_search(&sidtab, mls_sid);
+        if (!context2) {
+                printk(KERN_ERR "security_sid_mls_copy:  unrecognized SID "
+                       "%d\n", mls_sid);
+                rc = -EINVAL;
+                goto out_unlock;
+        }
+
+        newcon.user = context1->user;
+        newcon.role = context1->role;
+        newcon.type = context1->type;
+        rc = mls_copy_context(&newcon, context2);
+        if (rc)
+                goto out_unlock;
+
+
+        /* Check the validity of the new context. */
+        if (!policydb_context_isvalid(&policydb, &newcon)) {
+                rc = convert_context_handle_invalid_context(&newcon);
+                if (rc)
+                        goto bad;
+        }
+
+        rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);
+        goto out_unlock;
+
+bad:
+        if (!context_struct_to_string(&newcon, &s, &len)) {
+                audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+                          "security_sid_mls_copy: invalid context %s", s);
+                kfree(s);
+        }
+
+out_unlock:
+        POLICY_RDUNLOCK;
+        context_destroy(&newcon);
+out:
+        return rc;
+}
+
 struct selinux_audit_rule {
         u32 au_seqno;
         struct context au_ctxt;