Merge branch 'stable-3.16' of git://git.infradead.org/users/pcmoore/selinux into...

diff --combined include/linux/security.h
index 9c6b9722ff48d5a2304367f5f2448a7201ea55b4,794be735ff4ba7e3aad3dcdb473d86bb7b48f43c..59820f8782a1184e01b31644f8680068ef284e83
--- 1/include/linux/security.h
--- 2/include/linux/security.h
+++ b/include/linux/security.h
@@@ -987,7 -987,10 +987,10 @@@ static inline void security_free_mnt_op
   *    Retrieve the LSM-specific secid for the sock to enable caching of network
   *    authorizations.
   * @sock_graft:
-  *    Sets the socket's isec sid to the sock's sid.
+  *    This hook is called in response to a newly created sock struct being
+  *    grafted onto an existing socket and allows the security module to
+  *    perform whatever security attribute management is necessary for both
+  *    the sock and socket.
   * @inet_conn_request:
   *    Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
   * @inet_csk_clone:
@@@ -1708,7 -1711,7 +1711,7 @@@ struct security_operations 
        void (*key_free) (struct key *key);
        int (*key_permission) (key_ref_t key_ref,
                               const struct cred *cred,
 -                             key_perm_t perm);
 +                             unsigned perm);
        int (*key_getsecurity)(struct key *key, char **_buffer);
  #endif        /* CONFIG_KEYS */
  
@@@ -3034,7 -3037,7 +3037,7 @@@ static inline int security_path_chroot(
  int security_key_alloc(struct key *key, const struct cred *cred, unsigned long flags);
  void security_key_free(struct key *key);
  int security_key_permission(key_ref_t key_ref,
 -                          const struct cred *cred, key_perm_t perm);
 +                          const struct cred *cred, unsigned perm);
  int security_key_getsecurity(struct key *key, char **_buffer);
  
  #else
@@@ -3052,7 -3055,7 +3055,7 @@@ static inline void security_key_free(st
  
  static inline int security_key_permission(key_ref_t key_ref,
                                          const struct cred *cred,
 -                                        key_perm_t perm)
 +                                        unsigned perm)
  {
        return 0;
  }

diff --combined security/selinux/hooks.c
index 83d06db34d0358df289f8337b37f200d800b6c41,b3a6754e932b8f90cdf9443be42760d9006b4a3e..a1ac1c5c729b0818d43ea26e03e8c1ca6eb23afa
--- 1/security/selinux/hooks.c
--- 2/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@@ -4499,9 -4499,18 +4499,18 @@@ static void selinux_sock_graft(struct s
        struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
        struct sk_security_struct *sksec = sk->sk_security;
  
-       if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
-           sk->sk_family == PF_UNIX)
+       switch (sk->sk_family) {
+       case PF_INET:
+       case PF_INET6:
+       case PF_UNIX:
                isec->sid = sksec->sid;
+               break;
+       default:
+               /* by default there is no special labeling mechanism for the
+                * sksec label so inherit the label from the parent socket */
+               BUG_ON(sksec->sid != SECINITSID_UNLABELED);
+               sksec->sid = isec->sid;
+       }
        sksec->sclass = isec->sclass;
  }
  
@@@ -5725,7 -5734,7 +5734,7 @@@ static void selinux_key_free(struct ke
  
  static int selinux_key_permission(key_ref_t key_ref,
                                  const struct cred *cred,
 -                                key_perm_t perm)
 +                                unsigned perm)
  {
        struct key *key;
        struct key_security_struct *ksec;