/* LSM hook that controls access to unlabelled packets. If a xfrm_state is authorizable (defined by macro) then it was already authorized by the IPSec process. If not, then we need to check for unlabelled access since this may not have gone thru the IPSec process.  */
int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb, struct common_audit_data *ad)
/* LSM hook that controls access to unlabelled packets. If a xfrm_state is authorizable (defined by macro) then it was already authorized by the IPSec process. If not, then we need to check for unlabelled access since this may not have gone thru the IPSec process.  */
int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb, struct common_audit_data *ad)
{
	int i, rc = 0;
	struct sec_path *sp;
	u32 sel_sid = SECINITSID_UNLABELED;
	sp = skb->sp;
	if (sp) {
		for (i = 0; i < sp->len; i++) {
			struct xfrm_state *x = sp->xvec[i];
			if (x && selinux_authorizable_xfrm(x)) {
				struct xfrm_sec_ctx *ctx = x->security;
				sel_sid = ctx->ctx_sid;
				break;
			}
		}
	}
	rc = avc_has_perm(isec_sid, sel_sid, SECCLASS_ASSOCIATION,
			  ASSOCIATION__RECVFROM, ad);
	return rc;
}