selinux: Fix missing calls to netlbl_skbuff_err()

[linux-2.6-omap-h63xx.git] / security / selinux / netlabel.c

diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index e8ee91ac12efb677ed9ac1a532fbe544e2f99eb0..4053f7fc95fbbb466b2886e358bcf30510a8b820 100644 (file)
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -66,22 +66,24 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
 /**
  * selinux_netlbl_sock_setsid - Label a socket using the NetLabel mechanism
  * @sk: the socket to label
- * @sid: the SID to use
  *
  * Description:
- * Attempt to label a socket using the NetLabel mechanism using the given
- * SID.  Returns zero values on success, negative values on failure.
+ * Attempt to label a socket using the NetLabel mechanism.  Returns zero values
+ * on success, negative values on failure.
  *
  */
-static int selinux_netlbl_sock_setsid(struct sock *sk, u32 sid)
+static int selinux_netlbl_sock_setsid(struct sock *sk)
 {
        int rc;
        struct sk_security_struct *sksec = sk->sk_security;
        struct netlbl_lsm_secattr secattr;
 
+       if (sksec->nlbl_state != NLBL_REQUIRE)
+               return 0;
+
        netlbl_secattr_init(&secattr);
 
-       rc = security_netlbl_sid_to_secattr(sid, &secattr);
+       rc = security_netlbl_sid_to_secattr(sksec->sid, &secattr);
        if (rc != 0)
                goto sock_setsid_return;
        rc = netlbl_sock_setattr(sk, &secattr);
@@ -105,6 +107,24 @@ void selinux_netlbl_cache_invalidate(void)
        netlbl_cache_invalidate();
 }
 
+/**
+ * selinux_netlbl_err - Handle a NetLabel packet error
+ * @skb: the packet
+ * @error: the error code
+ * @gateway: true if host is acting as a gateway, false otherwise
+ *
+ * Description:
+ * When a packet is dropped due to a call to avc_has_perm() pass the error
+ * code to the NetLabel subsystem so any protocol specific processing can be
+ * done.  This is safe to call even if you are unsure if NetLabel labeling is
+ * present on the packet, NetLabel is smart enough to only act when it should.
+ *
+ */
+void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway)
+{
+       netlbl_skbuff_err(skb, error, gateway);
+}
+
 /**
  * selinux_netlbl_sk_security_reset - Reset the NetLabel fields
  * @ssec: the sk_security_struct
@@ -118,7 +138,7 @@ void selinux_netlbl_cache_invalidate(void)
 void selinux_netlbl_sk_security_reset(struct sk_security_struct *ssec,
                                      int family)
 {
-        if (family == PF_INET)
+       if (family == PF_INET)
                ssec->nlbl_state = NLBL_REQUIRE;
        else
                ssec->nlbl_state = NLBL_UNSET;
@@ -174,24 +194,10 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
  */
 void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
 {
-       struct sk_security_struct *sksec = sk->sk_security;
-       struct netlbl_lsm_secattr secattr;
-       u32 nlbl_peer_sid;
-
-       if (sksec->nlbl_state != NLBL_REQUIRE)
-               return;
-
-       netlbl_secattr_init(&secattr);
-       if (netlbl_sock_getattr(sk, &secattr) == 0 &&
-           secattr.flags != NETLBL_SECATTR_NONE &&
-           security_netlbl_secattr_to_sid(&secattr, &nlbl_peer_sid) == 0)
-               sksec->peer_sid = nlbl_peer_sid;
-       netlbl_secattr_destroy(&secattr);
-
        /* Try to set the NetLabel on the socket to save time later, if we fail
         * here we will pick up the pieces in later calls to
         * selinux_netlbl_inode_permission(). */
-       selinux_netlbl_sock_setsid(sk, sksec->sid);
+       selinux_netlbl_sock_setsid(sk);
 }
 
 /**
@@ -205,13 +211,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
  */
 int selinux_netlbl_socket_post_create(struct socket *sock)
 {
-       struct sock *sk = sock->sk;
-       struct sk_security_struct *sksec = sk->sk_security;
-
-       if (sksec->nlbl_state != NLBL_REQUIRE)
-               return 0;
-
-       return selinux_netlbl_sock_setsid(sk, sksec->sid);
+       return selinux_netlbl_sock_setsid(sock->sk);
 }
 
 /**
@@ -246,7 +246,7 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
        local_bh_disable();
        bh_lock_sock_nested(sk);
        if (likely(sksec->nlbl_state == NLBL_REQUIRE))
-               rc = selinux_netlbl_sock_setsid(sk, sksec->sid);
+               rc = selinux_netlbl_sock_setsid(sk);
        else
                rc = 0;
        bh_unlock_sock(sk);
@@ -307,7 +307,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
                return 0;
 
        if (nlbl_sid != SECINITSID_UNLABELED)
-               netlbl_skbuff_err(skb, rc);
+               netlbl_skbuff_err(skb, rc, 0);
        return rc;
 }