security: update selinux

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / security / selinux / ss / conditional.c

diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index 377d148e715743250c9836b7a5ca6c1a05fa98e0..ba7dd9366104093f47d4d97d62482ddbfcfefc66 100644 (file)
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -15,6 +15,7 @@
 
 #include "security.h"
 #include "conditional.h"
+#include "services.h"
 
 /*
  * cond_evaluate_expr evaluates a conditional expr
@@ -617,10 +618,28 @@ int cond_write_list(struct policydb *p, struct cond_node *list, void *fp)
 
        return 0;
 }
+
+void cond_compute_xperms(struct avtab *ctab, struct avtab_key *key,
+               struct extended_perms_decision *xpermd)
+{
+       struct avtab_node *node;
+
+       if (!ctab || !key || !xpermd)
+               return;
+
+       for (node = avtab_search_node(ctab, key); node;
+                       node = avtab_search_node_next(node, key->specified)) {
+               if (node->key.specified & AVTAB_ENABLED)
+                       services_compute_xperms_decision(xpermd, node);
+       }
+       return;
+
+}
 /* Determine whether additional permissions are granted by the conditional
  * av table, and if so, add them to the result
  */
-void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decision *avd)
+void cond_compute_av(struct avtab *ctab, struct avtab_key *key,
+               struct av_decision *avd, struct extended_perms *xperms)
 {
        struct avtab_node *node;
 
@@ -631,7 +650,7 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decisi
                                node = avtab_search_node_next(node, key->specified)) {
                if ((u16)(AVTAB_ALLOWED|AVTAB_ENABLED) ==
                    (node->key.specified & (AVTAB_ALLOWED|AVTAB_ENABLED)))
-                       avd->allowed |= node->datum.data;
+                       avd->allowed |= node->datum.u.data;
                if ((u16)(AVTAB_AUDITDENY|AVTAB_ENABLED) ==
                    (node->key.specified & (AVTAB_AUDITDENY|AVTAB_ENABLED)))
                        /* Since a '0' in an auditdeny mask represents a
@@ -639,10 +658,13 @@ void cond_compute_av(struct avtab *ctab, struct avtab_key *key, struct av_decisi
                         * the '&' operand to ensure that all '0's in the mask
                         * are retained (much unlike the allow and auditallow cases).
                         */
-                       avd->auditdeny &= node->datum.data;
+                       avd->auditdeny &= node->datum.u.data;
                if ((u16)(AVTAB_AUDITALLOW|AVTAB_ENABLED) ==
                    (node->key.specified & (AVTAB_AUDITALLOW|AVTAB_ENABLED)))
-                       avd->auditallow |= node->datum.data;
+                       avd->auditallow |= node->datum.u.data;
+               if (xperms && (node->key.specified & AVTAB_ENABLED) &&
+                               (node->key.specified & AVTAB_XPERMS))
+                       services_compute_xperms_drivers(xperms, node);
        }
        return;
 }