/* LSM hook implementation that authorizes that a flow can use a xfrm policy rule.  */
int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
/* LSM hook implementation that authorizes that a flow can use a xfrm policy rule.  */
int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
{
	int rc;
	u32 sel_sid;
	if (ctx) {
		if (!selinux_authorizable_ctx(ctx))
			return -EINVAL;
		sel_sid = ctx->ctx_sid;
	} else
		return 0;
	rc = avc_has_perm(fl_secid, sel_sid, SECCLASS_ASSOCIATION,
			  ASSOCIATION__POLMATCH,
			  NULL);
	if (rc == -EACCES)
		return -ESRCH;
	return rc;
}