selinux: xfrm - notify users on dropped packets]

In selinux_xfrm_state_pol_flow_match we have cases where we drop packets without asking the avc. No audit message is generated in this case. Lets at least print out a message to the logs, so the users don't need to dig in the code to find out why these packets are dropped.

Signed-off-by Steffen Klassert <[email protected]>

---
 security/selinux/xfrm.c |   24 ++++++++++++++++--------
 1 files changed, 16 insertions(+), 8 deletions(-)

security/selinux/xfrm.c +16 -8

index 05e1c1c..6d85c17 100644
@@ -120,20 +120,28 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
 	int rc;
 
 	if (!xp->security)
-		if (x->security)
-			/* unlabeled policy and labeled SA can't match */
+		if (x->security) {
+			if (net_ratelimit())
+				printk("selinux: unlabeled policy and labeled"
+				       "SA can't match!\n");
 			return 0;
-		else
+		} else
 			/* unlabeled policy and unlabeled SA match all flows */
 			return 1;
 	else
-		if (!x->security)
-			/* unlabeled SA and labeled policy can't match */
+		if (!x->security) {
+			if (net_ratelimit())
+				printk("selinux: unlabeled SA and labeled"
+				       "policy can't match!\n");
 			return 0;
-		else
-			if (!selinux_authorizable_xfrm(x))
-				/* Not a SELinux-labeled SA */
+		} else {
+			if (!selinux_authorizable_xfrm(x)) {
+				if (net_ratelimit())
+					printk("selinux: Not a"
+					       "SELinux-labeled SA!\n");
 				return 0;
+			}
+		}
 
 	state_sid = x->security->ctx_sid;
 	pol_sid = xp->security->ctx_sid;