5 files changed, 17 insertions, 21 deletions

diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index 00afd85f1edb..d47fc5e545e0 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -11,6 +11,7 @@ selinux-y := avc.o \
              nlmsgtab.o \
              netif.o \
              netnode.o \
+             netport.o \
              exports.o
 
 selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 93c809a6e4fa..34f2d46c7984 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -80,6 +80,7 @@
 #include "objsec.h"
 #include "netif.h"
 #include "netnode.h"
+#include "netport.h"
 #include "xfrm.h"
 #include "netlabel.h"
 
@@ -3670,10 +3671,8 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                         inet_get_local_port_range(&low, &high);
 
                         if (snum < max(PROT_SOCK, low) || snum > high) {
-                                err = security_port_sid(sk->sk_family,
-                                                        sk->sk_type,
-                                                        sk->sk_protocol, snum,
-                                                        &sid);
+                                err = sel_netport_sid(sk->sk_protocol,
+                                                      snum, &sid);
                                 if (err)
                                         goto out;
                                 AVC_AUDIT_DATA_INIT(&ad,NET);
@@ -3761,8 +3760,7 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
                         snum = ntohs(addr6->sin6_port);
                 }
 
-                err = security_port_sid(sk->sk_family, sk->sk_type,
-                                        sk->sk_protocol, snum, &sid);
+                err = sel_netport_sid(sk->sk_protocol, snum, &sid);
                 if (err)
                         goto out;
 
@@ -3993,9 +3991,8 @@ static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
 
         if (!recv_perm)
                 return 0;
-        err = security_port_sid(sk->sk_family, sk->sk_type,
-                                sk->sk_protocol, ntohs(ad->u.net.sport),
-                                &port_sid);
+        err = sel_netport_sid(sk->sk_protocol,
+                              ntohs(ad->u.net.sport), &port_sid);
         if (unlikely(err)) {
                 printk(KERN_WARNING
                        "SELinux: failure in"
@@ -4416,9 +4413,8 @@ static int selinux_ip_postroute_iptables_compat(struct sock *sk,
         if (send_perm != 0)
                 return 0;
 
-        err = security_port_sid(sk->sk_family, sk->sk_type,
-                                sk->sk_protocol, ntohs(ad->u.net.dport),
-                                &port_sid);
+        err = sel_netport_sid(sk->sk_protocol,
+                              ntohs(ad->u.net.dport), &port_sid);
         if (unlikely(err)) {
                 printk(KERN_WARNING
                        "SELinux: failure in"
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 957b10d0f76f..300b61bad7b3 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -103,6 +103,12 @@ struct netnode_security_struct {
         u16 family;                     /* address family */
 };
 
+struct netport_security_struct {
+        u32 sid;                        /* SID for this node */
+        u16 port;                       /* port number */
+        u8 protocol;                    /* transport protocol */
+};
+
 struct sk_security_struct {
         u32 sid;                        /* SID of this object */
         u32 peer_sid;                   /* SID of peer */
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index bc823ef70a12..1904c462a605 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -102,8 +102,7 @@ int security_context_to_sid_default(char *scontext, u32 scontext_len,
 int security_get_user_sids(u32 callsid, char *username,
                            u32 **sids, u32 *nel);
 
-int security_port_sid(u16 domain, u16 type, u8 protocol, u16 port,
-        u32 *out_sid);
+int security_port_sid(u8 protocol, u16 port, u32 *out_sid);
 
 int security_netif_sid(char *name, u32 *if_sid);
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 098c96b6f9de..d75050819b06 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1472,17 +1472,11 @@ err:
 
 /**
  * security_port_sid - Obtain the SID for a port.
- * @domain: communication domain aka address family
- * @type: socket type
  * @protocol: protocol number
  * @port: port number
  * @out_sid: security identifier
  */
-int security_port_sid(u16 domain,
-                      u16 type,
-                      u8 protocol,
-                      u16 port,
-                      u32 *out_sid)
+int security_port_sid(u8 protocol, u16 port, u32 *out_sid)
 {
         struct ocontext *c;
         int rc = 0;