2.6.25-rc7

 security

 selinux

diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 66e013d..0fa2be4 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -36,6 +36,33 @@
 #include "security.h"
 
 /**
+ * selinux_netlbl_sidlookup_cached - Cache a SID lookup
+ * @skb: the packet
+ * @secattr: the NetLabel security attributes
+ * @sid: the SID
+ *
+ * Description:
+ * Query the SELinux security server to lookup the correct SID for the given
+ * security attributes.  If the query is successful, cache the result to speed
+ * up future lookups.  Returns zero on success, negative values on failure.
+ *
+ */
+static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,
+                  struct netlbl_lsm_secattr *secattr,
+                  u32 *sid)
+{
+   int rc;
+
+   rc = security_netlbl_secattr_to_sid(secattr, sid);
+   if (rc == 0 &&
+       (secattr->flags & NETLBL_SECATTR_CACHEABLE) &&
+       (secattr->flags & NETLBL_SECATTR_CACHE))
+      netlbl_cache_add(skb, secattr);
+
+   return rc;
+}
+
+/**
  * selinux_netlbl_sock_setsid - Label a socket using the NetLabel mechanism
  * @sk: the socket to label
  * @sid: the SID to use
@@ -137,14 +164,14 @@ void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
     * lock as other threads could have access to ssec */
    rcu_read_lock();
    selinux_netlbl_sk_security_reset(newssec, ssec->sk->sk_family);
-   newssec->sclass = ssec->sclass;
    rcu_read_unlock();
 }
 
 /**
  * selinux_netlbl_skbuff_getsid - Get the sid of a packet using NetLabel
  * @skb: the packet
- * @base_sid: the SELinux SID to use as a context for MLS only attributes
+ * @family: protocol family
+ * @type: NetLabel labeling protocol type
  * @sid: the SID
  *
  * Description:
@@ -153,7 +180,10 @@ void selinux_netlbl_sk_security_clone(struct sk_security_struct *ssec,
  * assign to the packet.  Returns zero on success, negative values on failure.
  *
  */
-int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
+int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
+             u16 family,
+             u32 *type,
+             u32 *sid)
 {
    int rc;
    struct netlbl_lsm_secattr secattr;
@@ -164,15 +194,12 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
    }
 
    netlbl_secattr_init(&secattr);
-   rc = netlbl_skbuff_getattr(skb, &secattr);
-   if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
-      rc = security_netlbl_secattr_to_sid(&secattr, base_sid, sid);
-      if (rc == 0 &&
-          (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
-          (secattr.flags & NETLBL_SECATTR_CACHE))
-         netlbl_cache_add(skb, &secattr);
-   } else
+   rc = netlbl_skbuff_getattr(skb, family, &secattr);
+   if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
+      rc = selinux_netlbl_sidlookup_cached(skb, &secattr, sid);
+   else
       *sid = SECSID_NULL;
+   *type = secattr.type;
    netlbl_secattr_destroy(&secattr);
 
    return rc;
@@ -190,13 +217,10 @@ int selinux_netlbl_skbuff_getsid(struct sk_buff *skb, u32 base_sid, u32 *sid)
  */
 void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
 {
-   struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
    struct sk_security_struct *sksec = sk->sk_security;
    struct netlbl_lsm_secattr secattr;
    u32 nlbl_peer_sid;
 
-   sksec->sclass = isec->sclass;
-
    rcu_read_lock();
 
    if (sksec->nlbl_state != NLBL_REQUIRE) {
@@ -207,9 +231,7 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
    netlbl_secattr_init(&secattr);
    if (netlbl_sock_getattr(sk, &secattr) == 0 &&
        secattr.flags != NETLBL_SECATTR_NONE &&
-       security_netlbl_secattr_to_sid(&secattr,
-                  SECINITSID_NETMSG,
-                  &nlbl_peer_sid) == 0)
+       security_netlbl_secattr_to_sid(&secattr, &nlbl_peer_sid) == 0)
       sksec->peer_sid = nlbl_peer_sid;
    netlbl_secattr_destroy(&secattr);
 
@@ -234,11 +256,8 @@ int selinux_netlbl_socket_post_create(struct socket *sock)
 {
    int rc = 0;
    struct sock *sk = sock->sk;
-   struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
    struct sk_security_struct *sksec = sk->sk_security;
 
-   sksec->sclass = isec->sclass;
-
    rcu_read_lock();
    if (sksec->nlbl_state == NLBL_REQUIRE)
       rc = selinux_netlbl_sock_setsid(sk, sksec->sid);
@@ -292,6 +311,7 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
  * selinux_netlbl_sock_rcv_skb - Do an inbound access check using NetLabel
  * @sksec: the sock's sk_security_struct
  * @skb: the packet
+ * @family: protocol family
  * @ad: the audit data
  *
  * Description:
@@ -302,6 +322,7 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
  */
 int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
             struct sk_buff *skb,
+            u16 family,
             struct avc_audit_data *ad)
 {
    int rc;
@@ -313,16 +334,10 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
       return 0;
 
    netlbl_secattr_init(&secattr);
-   rc = netlbl_skbuff_getattr(skb, &secattr);
-   if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE) {
-      rc = security_netlbl_secattr_to_sid(&secattr,
-                      SECINITSID_NETMSG,
-                      &nlbl_sid);
-      if (rc == 0 &&
-          (secattr.flags & NETLBL_SECATTR_CACHEABLE) &&
-          (secattr.flags & NETLBL_SECATTR_CACHE))
-         netlbl_cache_add(skb, &secattr);
-   } else
+   rc = netlbl_skbuff_getattr(skb, family, &secattr);
+   if (rc == 0 && secattr.flags != NETLBL_SECATTR_NONE)
+      rc = selinux_netlbl_sidlookup_cached(skb, &secattr, &nlbl_sid);
+   else
       nlbl_sid = SECINITSID_UNLABELED;
    netlbl_secattr_destroy(&secattr);
    if (rc != 0)