Revert to Fedora kernel-2.6.17-1.2187_FC5 patched with vs2.0.2.1; there are too many...

[linux-2.6.git] / security / selinux / xfrm.c

diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 6c985ce..abe99d8 100644 (file)
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -26,6 +26,7 @@
  *   2. Emulating a reasonable SO_PEERSEC across machines
  *   3. Testing addition of sk_policy's with security context via setsockopt
  */
+#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -131,7 +132,10 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_us
                goto out;
 
        /*
-        * Does the subject have permission to set security context?
+        * Does the subject have permission to set security or permission to
+        * do the relabel?
+        * Must be permitted to relabel from default socket type (process type)
+        * to specified context
         */
        rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
                          SECCLASS_ASSOCIATION,
@@ -196,23 +200,6 @@ void selinux_xfrm_policy_free(struct xfrm_policy *xp)
                kfree(ctx);
 }
 
-/*
- * LSM hook implementation that authorizes deletion of labeled policies.
- */
-int selinux_xfrm_policy_delete(struct xfrm_policy *xp)
-{
-       struct task_security_struct *tsec = current->security;
-       struct xfrm_sec_ctx *ctx = xp->security;
-       int rc = 0;
-
-       if (ctx)
-               rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
-                                 SECCLASS_ASSOCIATION,
-                                 ASSOCIATION__SETCONTEXT, NULL);
-
-       return rc;
-}
-
 /*
  * LSM hook implementation that allocs and transfers sec_ctx spec to
  * xfrm_state.
@@ -305,23 +292,6 @@ u32 selinux_socket_getpeer_dgram(struct sk_buff *skb)
        return SECSID_NULL;
 }
 
- /*
-  * LSM hook implementation that authorizes deletion of labeled SAs.
-  */
-int selinux_xfrm_state_delete(struct xfrm_state *x)
-{
-       struct task_security_struct *tsec = current->security;
-       struct xfrm_sec_ctx *ctx = x->security;
-       int rc = 0;
-
-       if (ctx)
-               rc = avc_has_perm(tsec->sid, ctx->ctx_sid,
-                                 SECCLASS_ASSOCIATION,
-                                 ASSOCIATION__SETCONTEXT, NULL);
-
-       return rc;
-}
-
 /*
  * LSM hook that controls access to unlabelled packets.  If
  * a xfrm_state is authorizable (defined by macro) then it was
@@ -386,12 +356,18 @@ int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb)
                        struct xfrm_state *x = dst_test->xfrm;
 
                        if (x && selinux_authorizable_xfrm(x))
-                               goto out;
+                               goto accept;
                }
        }
 
        rc = avc_has_perm(isec_sid, SECINITSID_UNLABELED, SECCLASS_ASSOCIATION,
                          ASSOCIATION__SENDTO, NULL);
-out:
-       return rc;
+       if (rc)
+               goto drop;
+
+accept:
+       return NF_ACCEPT;
+
+drop:
+       return NF_DROP;
 }