1 files changed, 22 insertions, 17 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 0753b20e23fe..3c3fff33d1ce 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -47,7 +47,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/tty.h>
 #include <net/icmp.h>
-#include <net/ip.h>             /* for sysctl_local_port_range[] */
+#include <net/ip.h>             /* for local_port_range[] */
 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -3232,8 +3232,6 @@ static int selinux_socket_post_create(struct socket *sock, int family,
 /* Range of port numbers used to automatically bind.
    Need to determine whether we should perform a name_bind
    permission check between the socket and the port number. */
-#define ip_local_port_range_0 sysctl_local_port_range[0]
-#define ip_local_port_range_1 sysctl_local_port_range[1]
 
 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {
@@ -3276,20 +3274,27 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                         addrp = (char *)&addr6->sin6_addr.s6_addr;
                 }
 
-                if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
-                           snum > ip_local_port_range_1)) {
-                        err = security_port_sid(sk->sk_family, sk->sk_type,
-                                                sk->sk_protocol, snum, &sid);
-                        if (err)
-                                goto out;
-                        AVC_AUDIT_DATA_INIT(&ad,NET);
-                        ad.u.net.sport = htons(snum);
-                        ad.u.net.family = family;
-                        err = avc_has_perm(isec->sid, sid,
-                                           isec->sclass,
-                                           SOCKET__NAME_BIND, &ad);
-                        if (err)
-                                goto out;
+                if (snum) {
+                        int low, high;
+
+                        inet_get_local_port_range(&low, &high);
+
+                        if (snum < max(PROT_SOCK, low) || snum > high) {
+                                err = security_port_sid(sk->sk_family,
+                                                        sk->sk_type,
+                                                        sk->sk_protocol, snum,
+                                                        &sid);
+                                if (err)
+                                        goto out;
+                                AVC_AUDIT_DATA_INIT(&ad,NET);
+                                ad.u.net.sport = htons(snum);
+                                ad.u.net.family = family;
+                                err = avc_has_perm(isec->sid, sid,
+                                                   isec->sclass,
+                                                   SOCKET__NAME_BIND, &ad);
+                                if (err)
+                                        goto out;
+                        }
                 }
                 
                 switch(isec->sclass) {