3 files changed, 38 insertions, 0 deletions

diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 325551cd7fc7..6bdb0ff6a927 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -111,6 +111,11 @@ static struct policydb_compat_info policydb_compat[] = {
                 .version        = POLICYDB_VERSION_POLCAP,
                 .sym_num        = SYM_NUM,
                 .ocon_num       = OCON_NUM,
+        },
+        {
+                .version        = POLICYDB_VERSION_PERMISSIVE,
+                .sym_num        = SYM_NUM,
+                .ocon_num       = OCON_NUM,
         }
 };
 
@@ -194,6 +199,7 @@ static int policydb_init(struct policydb *p)
                 goto out_free_symtab;
 
         ebitmap_init(&p->policycaps);
+        ebitmap_init(&p->permissive_map);
 
 out:
         return rc;
@@ -687,6 +693,7 @@ void policydb_destroy(struct policydb *p)
         kfree(p->type_attr_map);
         kfree(p->undefined_perms);
         ebitmap_destroy(&p->policycaps);
+        ebitmap_destroy(&p->permissive_map);
 
         return;
 }
@@ -1570,6 +1577,10 @@ int policydb_read(struct policydb *p, void *fp)
             ebitmap_read(&p->policycaps, fp) != 0)
                 goto bad;
 
+        if (p->policyvers >= POLICYDB_VERSION_PERMISSIVE &&
+            ebitmap_read(&p->permissive_map, fp) != 0)
+                goto bad;
+
         info = policydb_lookup_compat(p->policyvers);
         if (!info) {
                 printk(KERN_ERR "SELinux:  unable to find policy compat info "
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index c4ce996e202c..ba593a3da877 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -243,6 +243,8 @@ struct policydb {
 
         struct ebitmap policycaps;
 
+        struct ebitmap permissive_map;
+
         unsigned int policyvers;
 
         unsigned int reject_unknown : 1;
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index face5795c760..eefa89ce77a7 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -417,6 +417,31 @@ inval_class:
         return -EINVAL;
 }
 
+/*
+ * Given a sid find if the type has the permissive flag set
+ */
+int security_permissive_sid(u32 sid)
+{
+        struct context *context;
+        u32 type;
+        int rc;
+
+        POLICY_RDLOCK;
+
+        context = sidtab_search(&sidtab, sid);
+        BUG_ON(!context);
+
+        type = context->type;
+        /*
+         * we are intentionally using type here, not type-1, the 0th bit may
+         * someday indicate that we are globally setting permissive in policy.
+         */
+        rc = ebitmap_get_bit(&policydb.permissive_map, type);
+
+        POLICY_RDUNLOCK;
+        return rc;
+}
+
 static int security_validtrans_handle_fail(struct context *ocontext,
                                            struct context *ncontext,
                                            struct context *tcontext,