3 files changed, 29 insertions, 19 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 0753b20e23fe..3c3fff33d1ce 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -47,7 +47,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/tty.h>
 #include <net/icmp.h>
-#include <net/ip.h>             /* for sysctl_local_port_range[] */
+#include <net/ip.h>             /* for local_port_range[] */
 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -3232,8 +3232,6 @@ static int selinux_socket_post_create(struct socket *sock, int family,
 /* Range of port numbers used to automatically bind.
    Need to determine whether we should perform a name_bind
    permission check between the socket and the port number. */
-#define ip_local_port_range_0 sysctl_local_port_range[0]
-#define ip_local_port_range_1 sysctl_local_port_range[1]
 
 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {
@@ -3276,20 +3274,27 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                         addrp = (char *)&addr6->sin6_addr.s6_addr;
                 }
 
-                if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
-                           snum > ip_local_port_range_1)) {
-                        err = security_port_sid(sk->sk_family, sk->sk_type,
-                                                sk->sk_protocol, snum, &sid);
-                        if (err)
-                                goto out;
-                        AVC_AUDIT_DATA_INIT(&ad,NET);
-                        ad.u.net.sport = htons(snum);
-                        ad.u.net.family = family;
-                        err = avc_has_perm(isec->sid, sid,
-                                           isec->sclass,
-                                           SOCKET__NAME_BIND, &ad);
-                        if (err)
-                                goto out;
+                if (snum) {
+                        int low, high;
+
+                        inet_get_local_port_range(&low, &high);
+
+                        if (snum < max(PROT_SOCK, low) || snum > high) {
+                                err = security_port_sid(sk->sk_family,
+                                                        sk->sk_type,
+                                                        sk->sk_protocol, snum,
+                                                        &sid);
+                                if (err)
+                                        goto out;
+                                AVC_AUDIT_DATA_INIT(&ad,NET);
+                                ad.u.net.sport = htons(snum);
+                                ad.u.net.family = family;
+                                err = avc_has_perm(isec->sid, sid,
+                                                   isec->sclass,
+                                                   SOCKET__NAME_BIND, &ad);
+                                if (err)
+                                        goto out;
+                        }
                 }
                 
                 switch(isec->sclass) {
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index b10c34e8a743..e87ab948104c 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -20,6 +20,7 @@
 #include <linux/notifier.h>
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
+#include <net/net_namespace.h>
 
 #include "security.h"
 #include "objsec.h"
@@ -234,6 +235,9 @@ static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
 {
         struct net_device *dev = ptr;
 
+        if (dev->nd_net != &init_net)
+                return NOTIFY_DONE;
+
         if (event == NETDEV_DOWN)
                 sel_netif_kill(dev);
 
diff --git a/security/selinux/netlink.c b/security/selinux/netlink.c
index f49046de63a2..b59871d74dad 100644
--- a/security/selinux/netlink.c
+++ b/security/selinux/netlink.c
@@ -17,6 +17,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/selinux_netlink.h>
+#include <net/net_namespace.h>
 
 static struct sock *selnl;
 
@@ -104,8 +105,8 @@ void selnl_notify_policyload(u32 seqno)
 
 static int __init selnl_init(void)
 {
-        selnl = netlink_kernel_create(NETLINK_SELINUX, SELNLGRP_MAX, NULL, NULL,
-                                      THIS_MODULE);
+        selnl = netlink_kernel_create(&init_net, NETLINK_SELINUX,
+                                      SELNLGRP_MAX, NULL, NULL, THIS_MODULE);
         if (selnl == NULL)
                 panic("SELinux:  Cannot create netlink socket.");
         netlink_set_nonroot(NETLINK_SELINUX, NL_NONROOT_RECV);