Merge tag 'keys-next-20140725' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowe...

[firefly-linux-kernel-4.4.55.git] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 83d06db34d0358df289f8337b37f200d800b6c41..7740f61588d6493b7c1e2da18f6562ff9317a529 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -161,6 +161,17 @@ static int selinux_peerlbl_enabled(void)
        return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 }
 
+static int selinux_netcache_avc_callback(u32 event)
+{
+       if (event == AVC_CALLBACK_RESET) {
+               sel_netif_flush();
+               sel_netnode_flush();
+               sel_netport_flush();
+               synchronize_net();
+       }
+       return 0;
+}
+
 /*
  * initialise the security for the init task
  */
@@ -4499,9 +4510,18 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent)
        struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
        struct sk_security_struct *sksec = sk->sk_security;
 
-       if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
-           sk->sk_family == PF_UNIX)
+       switch (sk->sk_family) {
+       case PF_INET:
+       case PF_INET6:
+       case PF_UNIX:
                isec->sid = sksec->sid;
+               break;
+       default:
+               /* by default there is no special labeling mechanism for the
+                * sksec label so inherit the label from the parent socket */
+               BUG_ON(sksec->sid != SECINITSID_UNLABELED);
+               sksec->sid = isec->sid;
+       }
        sksec->sclass = isec->sclass;
 }
 
@@ -5993,6 +6013,9 @@ static __init int selinux_init(void)
        if (register_security(&selinux_ops))
                panic("SELinux: Unable to register with kernel.\n");
 
+       if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
+               panic("SELinux: Unable to register AVC netcache callback\n");
+
        if (selinux_enforcing)
                printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
        else