IPsec: correct semantics for SELinux policy matching

[firefly-linux-kernel-4.4.55.git] / net / xfrm / xfrm_user.c

diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c59a78d2923a5baf23061e8f693d3114b8120109..2b2e59d8ffbc8ca197c8b84b98248c92511ce365 100644 (file)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -211,6 +211,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
        case XFRM_MODE_TRANSPORT:
        case XFRM_MODE_TUNNEL:
        case XFRM_MODE_ROUTEOPTIMIZATION:
+       case XFRM_MODE_BEET:
                break;
 
        default:
@@ -1991,15 +1992,6 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
        xp->type = XFRM_POLICY_TYPE_MAIN;
        copy_templates(xp, ut, nr);
 
-       if (!xp->security) {
-               int err = security_xfrm_sock_policy_alloc(xp, sk);
-               if (err) {
-                       kfree(xp);
-                       *dir = err;
-                       return NULL;
-               }
-       }
-
        *dir = p->dir;
 
        return xp;