[MLSXFRM]: Define new SELinux service routine

[deliverable/linux.git] / security / selinux / ss / services.c

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 85e4298843936fb920533ee9007f706774a240c9..b00ec69f0ffd5a6d219fc554fc7cb3fb79213a19 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1817,6 +1817,75 @@ out:
        return rc;
 }
 
+/*
+ * security_sid_mls_copy() - computes a new sid based on the given
+ * sid and the mls portion of mls_sid.
+ */
+int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
+{
+       struct context *context1;
+       struct context *context2;
+       struct context newcon;
+       char *s;
+       u32 len;
+       int rc = 0;
+
+       if (!ss_initialized) {
+               *new_sid = sid;
+               goto out;
+       }
+
+       context_init(&newcon);
+
+       POLICY_RDLOCK;
+       context1 = sidtab_search(&sidtab, sid);
+       if (!context1) {
+               printk(KERN_ERR "security_sid_mls_copy:  unrecognized SID "
+                      "%d\n", sid);
+               rc = -EINVAL;
+               goto out_unlock;
+       }
+
+       context2 = sidtab_search(&sidtab, mls_sid);
+       if (!context2) {
+               printk(KERN_ERR "security_sid_mls_copy:  unrecognized SID "
+                      "%d\n", mls_sid);
+               rc = -EINVAL;
+               goto out_unlock;
+       }
+
+       newcon.user = context1->user;
+       newcon.role = context1->role;
+       newcon.type = context1->type;
+       rc = mls_copy_context(&newcon, context2);
+       if (rc)
+               goto out_unlock;
+
+
+       /* Check the validity of the new context. */
+       if (!policydb_context_isvalid(&policydb, &newcon)) {
+               rc = convert_context_handle_invalid_context(&newcon);
+               if (rc)
+                       goto bad;
+       }
+
+       rc = sidtab_context_to_sid(&sidtab, &newcon, new_sid);
+       goto out_unlock;
+
+bad:
+       if (!context_struct_to_string(&newcon, &s, &len)) {
+               audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
+                         "security_sid_mls_copy: invalid context %s", s);
+               kfree(s);
+       }
+
+out_unlock:
+       POLICY_RDUNLOCK;
+       context_destroy(&newcon);
+out:
+       return rc;
+}
+
 struct selinux_audit_rule {
        u32 au_seqno;
        struct context au_ctxt;