3 files changed, 29 insertions, 11 deletions

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index cf6020f85403..12e4fb72bf0f 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -242,7 +242,7 @@ void __init avc_init(void)
         avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
                                              0, SLAB_PANIC, NULL, NULL);
 
-        audit_log(current->audit_context, AUDIT_KERNEL, "AVC INITIALIZED\n");
+        audit_log(current->audit_context, GFP_KERNEL, AUDIT_KERNEL, "AVC INITIALIZED\n");
 }
 
 int avc_get_hash_stats(char *page)
@@ -550,7 +550,7 @@ void avc_audit(u32 ssid, u32 tsid,
                         return;
         }
 
-        ab = audit_log_start(current->audit_context, AUDIT_AVC);
+        ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_AVC);
         if (!ab)
                 return;         /* audit_panic has been called */
         audit_log_format(ab, "avc:  %s ", denied ? "denied" : "granted");
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f40c8221ec1b..b13be15165f5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -630,6 +630,16 @@ static inline u16 inode_mode_to_security_class(umode_t mode)
         return SECCLASS_FILE;
 }
 
+static inline int default_protocol_stream(int protocol)
+{
+        return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
+}
+
+static inline int default_protocol_dgram(int protocol)
+{
+        return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
+}
+
 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 {
         switch (family) {
@@ -646,10 +656,16 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
         case PF_INET6:
                 switch (type) {
                 case SOCK_STREAM:
-                        return SECCLASS_TCP_SOCKET;
+                        if (default_protocol_stream(protocol))
+                                return SECCLASS_TCP_SOCKET;
+                        else
+                                return SECCLASS_RAWIP_SOCKET;
                 case SOCK_DGRAM:
-                        return SECCLASS_UDP_SOCKET;
-                case SOCK_RAW:
+                        if (default_protocol_dgram(protocol))
+                                return SECCLASS_UDP_SOCKET;
+                        else
+                                return SECCLASS_RAWIP_SOCKET;
+                default:
                         return SECCLASS_RAWIP_SOCKET;
                 }
                 break;
@@ -2970,6 +2986,8 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
 
         /*
          * If PF_INET or PF_INET6, check name_bind permission for the port.
+         * Multiple address binding for SCTP is not supported yet: we just
+         * check the first address now.
          */
         family = sock->sk->sk_family;
         if (family == PF_INET || family == PF_INET6) {
@@ -3014,12 +3032,12 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                                 goto out;
                 }
                 
-                switch(sk->sk_protocol) {
-                case IPPROTO_TCP:
+                switch(isec->sclass) {
+                case SECCLASS_TCP_SOCKET:
                         node_perm = TCP_SOCKET__NODE_BIND;
                         break;
                         
-                case IPPROTO_UDP:
+                case SECCLASS_UDP_SOCKET:
                         node_perm = UDP_SOCKET__NODE_BIND;
                         break;
                         
@@ -3389,7 +3407,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
         if (err) {
                 if (err == -EINVAL) {
-                        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
+                        audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
                                   "SELinux:  unrecognized netlink message"
                                   " type=%hu for sclass=%hu\n",
                                   nlh->nlmsg_type, isec->sclass);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 92b89dc99bcd..aecdded55e74 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -381,7 +381,7 @@ static int security_validtrans_handle_fail(struct context *ocontext,
                 goto out;
         if (context_struct_to_string(tcontext, &t, &tlen) < 0)
                 goto out;
-        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
+        audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
                   "security_validate_transition:  denied for"
                   " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
                   o, n, t, policydb.p_class_val_to_name[tclass-1]);
@@ -787,7 +787,7 @@ static int compute_sid_handle_invalid_context(
                 goto out;
         if (context_struct_to_string(newcontext, &n, &nlen) < 0)
                 goto out;
-        audit_log(current->audit_context, AUDIT_SELINUX_ERR,
+        audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
                   "security_compute_sid:  invalid context %s"
                   " for scontext=%s"
                   " tcontext=%s"