SELinux: Convert avc_audit to use lsm_audit.h

[linux-2.6.git] / security / selinux / xfrm.c

diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 7e158205d0810894ebe783320acdfe11e5f2da38..f3cb9ed731a9d927319c37bfc3a2e0d63f330db9 100644 (file)
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -45,7 +45,6 @@
 #include <net/xfrm.h>
 #include <net/checksum.h>
 #include <net/udp.h>
-#include <asm/semaphore.h>
 #include <asm/atomic.h>
 
 #include "avc.h"
@@ -77,20 +76,18 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
  * LSM hook implementation that authorizes that a flow can use
  * a xfrm policy rule.
  */
-int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
+int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
 {
        int rc;
        u32 sel_sid;
-       struct xfrm_sec_ctx *ctx;
 
        /* Context sid is either set to label or ANY_ASSOC */
-       if ((ctx = xp->security)) {
+       if (ctx) {
                if (!selinux_authorizable_ctx(ctx))
                        return -EINVAL;
 
                sel_sid = ctx->ctx_sid;
-       }
-       else
+       } else
                /*
                 * All flows should be treated as polmatch'ing an
                 * otherwise applicable "non-labeled" policy. This
@@ -103,7 +100,7 @@ int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
                          NULL);
 
        if (rc == -EACCES)
-               rc = -ESRCH;
+               return -ESRCH;
 
        return rc;
 }
@@ -183,8 +180,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
 
                                        if (!ckall)
                                                break;
-                               }
-                               else if (*sid != ctx->ctx_sid)
+                               } else if (*sid != ctx->ctx_sid)
                                        return -EINVAL;
                        }
                }
@@ -201,7 +197,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
        struct xfrm_user_sec_ctx *uctx, u32 sid)
 {
        int rc = 0;
-       struct task_security_struct *tsec = current->security;
+       const struct task_security_struct *tsec = current_security();
        struct xfrm_sec_ctx *ctx = NULL;
        char *ctx_str = NULL;
        u32 str_len;
@@ -287,15 +283,14 @@ out2:
  * LSM hook implementation that allocs and transfers uctx spec to
  * xfrm_policy.
  */
-int selinux_xfrm_policy_alloc(struct xfrm_policy *xp,
-               struct xfrm_user_sec_ctx *uctx)
+int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
+                             struct xfrm_user_sec_ctx *uctx)
 {
        int err;
 
-       BUG_ON(!xp);
        BUG_ON(!uctx);
 
-       err = selinux_xfrm_sec_ctx_alloc(&xp->security, uctx, 0);
+       err = selinux_xfrm_sec_ctx_alloc(ctxp, uctx, 0);
        if (err == 0)
                atomic_inc(&selinux_xfrm_refcount);
 
@@ -307,43 +302,38 @@ int selinux_xfrm_policy_alloc(struct xfrm_policy *xp,
  * LSM hook implementation that copies security data structure from old to
  * new for policy cloning.
  */
-int selinux_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
+int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
+                             struct xfrm_sec_ctx **new_ctxp)
 {
-       struct xfrm_sec_ctx *old_ctx, *new_ctx;
-
-       old_ctx = old->security;
+       struct xfrm_sec_ctx *new_ctx;
 
        if (old_ctx) {
-               new_ctx = new->security = kmalloc(sizeof(*new_ctx) +
-                                                 old_ctx->ctx_len,
-                                                 GFP_KERNEL);
-
+               new_ctx = kmalloc(sizeof(*old_ctx) + old_ctx->ctx_len,
+                                 GFP_KERNEL);
                if (!new_ctx)
                        return -ENOMEM;
 
                memcpy(new_ctx, old_ctx, sizeof(*new_ctx));
                memcpy(new_ctx->ctx_str, old_ctx->ctx_str, new_ctx->ctx_len);
+               *new_ctxp = new_ctx;
        }
        return 0;
 }
 
 /*
- * LSM hook implementation that frees xfrm_policy security information.
+ * LSM hook implementation that frees xfrm_sec_ctx security information.
  */
-void selinux_xfrm_policy_free(struct xfrm_policy *xp)
+void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
 {
-       struct xfrm_sec_ctx *ctx = xp->security;
-       if (ctx)
-               kfree(ctx);
+       kfree(ctx);
 }
 
 /*
  * LSM hook implementation that authorizes deletion of labeled policies.
  */
-int selinux_xfrm_policy_delete(struct xfrm_policy *xp)
+int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 {
-       struct task_security_struct *tsec = current->security;
-       struct xfrm_sec_ctx *ctx = xp->security;
+       const struct task_security_struct *tsec = current_security();
        int rc = 0;
 
        if (ctx) {
@@ -380,8 +370,7 @@ int selinux_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *uct
 void selinux_xfrm_state_free(struct xfrm_state *x)
 {
        struct xfrm_sec_ctx *ctx = x->security;
-       if (ctx)
-               kfree(ctx);
+       kfree(ctx);
 }
 
  /*
@@ -389,7 +378,7 @@ void selinux_xfrm_state_free(struct xfrm_state *x)
   */
 int selinux_xfrm_state_delete(struct xfrm_state *x)
 {
-       struct task_security_struct *tsec = current->security;
+       const struct task_security_struct *tsec = current_security();
        struct xfrm_sec_ctx *ctx = x->security;
        int rc = 0;
 
@@ -412,7 +401,7 @@ int selinux_xfrm_state_delete(struct xfrm_state *x)
  * gone thru the IPSec process.
  */
 int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
-                               struct avc_audit_data *ad)
+                               struct common_audit_data *ad)
 {
        int i, rc = 0;
        struct sec_path *sp;
@@ -453,12 +442,12 @@ int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb,
  * checked in the selinux_xfrm_state_pol_flow_match hook above.
  */
 int selinux_xfrm_postroute_last(u32 isec_sid, struct sk_buff *skb,
-                                       struct avc_audit_data *ad, u8 proto)
+                                       struct common_audit_data *ad, u8 proto)
 {
        struct dst_entry *dst;
        int rc = 0;
 
-       dst = skb->dst;
+       dst = skb_dst(skb);
 
        if (dst) {
                struct dst_entry *dst_test;