SELinux: unify the selinux_audit_data and selinux_late_audit_data

[~andy/linux] / security / selinux / hooks.c

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8417a6afaf30c6a82a499deddab24c68b5a52b77..2578de549ad7e704d74a78c38f4a58fd8d491d38 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1420,16 +1420,13 @@ static int cred_has_capability(const struct cred *cred,
                               int cap, int audit)
 {
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct av_decision avd;
        u16 sclass;
        u32 sid = cred_sid(cred);
        u32 av = CAP_TO_MASK(cap);
        int rc;
 
-       COMMON_AUDIT_DATA_INIT(&ad, CAP);
-       ad.selinux_audit_data = &sad;
-       ad.tsk = current;
+       ad.type = LSM_AUDIT_DATA_CAP;
        ad.u.cap = cap;
 
        switch (CAP_TO_INDEX(cap)) {
@@ -1497,11 +1494,9 @@ static inline int dentry_has_perm(const struct cred *cred,
 {
        struct inode *inode = dentry->d_inode;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+       ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;
-       ad.selinux_audit_data = &sad;
        return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
@@ -1514,11 +1509,9 @@ static inline int path_has_perm(const struct cred *cred,
 {
        struct inode *inode = path->dentry->d_inode;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
 
-       COMMON_AUDIT_DATA_INIT(&ad, PATH);
+       ad.type = LSM_AUDIT_DATA_PATH;
        ad.u.path = *path;
-       ad.selinux_audit_data = &sad;
        return inode_has_perm(cred, inode, av, &ad, 0);
 }
 
@@ -1537,13 +1530,11 @@ static int file_has_perm(const struct cred *cred,
        struct file_security_struct *fsec = file->f_security;
        struct inode *inode = file->f_path.dentry->d_inode;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = cred_sid(cred);
        int rc;
 
-       COMMON_AUDIT_DATA_INIT(&ad, PATH);
+       ad.type = LSM_AUDIT_DATA_PATH;
        ad.u.path = file->f_path;
-       ad.selinux_audit_data = &sad;
 
        if (sid != fsec->sid) {
                rc = avc_has_perm(sid, fsec->sid,
@@ -1573,7 +1564,6 @@ static int may_create(struct inode *dir,
        struct superblock_security_struct *sbsec;
        u32 sid, newsid;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        int rc;
 
        dsec = dir->i_security;
@@ -1582,9 +1572,8 @@ static int may_create(struct inode *dir,
        sid = tsec->sid;
        newsid = tsec->create_sid;
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+       ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;
-       ad.selinux_audit_data = &sad;
 
        rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
                          DIR__ADD_NAME | DIR__SEARCH,
@@ -1629,7 +1618,6 @@ static int may_link(struct inode *dir,
 {
        struct inode_security_struct *dsec, *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
        u32 av;
        int rc;
@@ -1637,9 +1625,8 @@ static int may_link(struct inode *dir,
        dsec = dir->i_security;
        isec = dentry->d_inode->i_security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
+       ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;
-       ad.selinux_audit_data = &sad;
 
        av = DIR__SEARCH;
        av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
@@ -1674,7 +1661,6 @@ static inline int may_rename(struct inode *old_dir,
 {
        struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
        u32 av;
        int old_is_dir, new_is_dir;
@@ -1685,8 +1671,7 @@ static inline int may_rename(struct inode *old_dir,
        old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
        new_dsec = new_dir->i_security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_DENTRY;
 
        ad.u.dentry = old_dentry;
        rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
@@ -1972,7 +1957,6 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
        struct task_security_struct *new_tsec;
        struct inode_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct inode *inode = bprm->file->f_path.dentry->d_inode;
        int rc;
 
@@ -2011,8 +1995,7 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
                        return rc;
        }
 
-       COMMON_AUDIT_DATA_INIT(&ad, PATH);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_PATH;
        ad.u.path = bprm->file->f_path;
 
        if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
@@ -2102,7 +2085,6 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                                            struct files_struct *files)
 {
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct file *file, *devnull = NULL;
        struct tty_struct *tty;
        struct fdtable *fdt;
@@ -2135,8 +2117,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
 
        /* Revalidate access to inherited open files. */
 
-       COMMON_AUDIT_DATA_INIT(&ad, INODE);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_INODE;
 
        spin_lock(&files->file_lock);
        for (;;) {
@@ -2474,7 +2455,6 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
 {
        const struct cred *cred = current_cred();
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        int rc;
 
        rc = superblock_doinit(sb, data);
@@ -2485,8 +2465,7 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
        if (flags & MS_KERNMOUNT)
                return 0;
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = sb->s_root;
        return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
 }
@@ -2495,10 +2474,8 @@ static int selinux_sb_statfs(struct dentry *dentry)
 {
        const struct cred *cred = current_cred();
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry->d_sb->s_root;
        return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
 }
@@ -2658,11 +2635,27 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *na
        return dentry_has_perm(cred, dentry, FILE__READ);
 }
 
+static noinline int audit_inode_permission(struct inode *inode,
+                                          u32 perms, u32 audited, u32 denied,
+                                          unsigned flags)
+{
+       struct common_audit_data ad;
+       struct inode_security_struct *isec = inode->i_security;
+       int rc;
+
+       ad.type = LSM_AUDIT_DATA_INODE;
+       ad.u.inode = inode;
+
+       rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
+                           audited, denied, &ad, flags);
+       if (rc)
+               return rc;
+       return 0;
+}
+
 static int selinux_inode_permission(struct inode *inode, int mask)
 {
        const struct cred *cred = current_cred();
-       struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 perms;
        bool from_access;
        unsigned flags = mask & MAY_NOT_BLOCK;
@@ -2696,15 +2689,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
        if (likely(!audited))
                return rc;
 
-       COMMON_AUDIT_DATA_INIT(&ad, INODE);
-       ad.selinux_audit_data = &sad;
-       ad.u.inode = inode;
-
-       if (from_access)
-               ad.selinux_audit_data->auditdeny |= FILE__AUDIT_ACCESS;
-
-       rc2 = slow_avc_audit(sid, isec->sid, isec->sclass, perms,
-                            audited, denied, &ad, flags);
+       rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
        if (rc2)
                return rc2;
        return rc;
@@ -2773,7 +2758,6 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        struct inode_security_struct *isec = inode->i_security;
        struct superblock_security_struct *sbsec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 newsid, sid = current_sid();
        int rc = 0;
 
@@ -2787,8 +2771,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
        if (!inode_owner_or_capable(inode))
                return -EPERM;
 
-       COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_DENTRY;
        ad.u.dentry = dentry;
 
        rc = avc_has_perm(sid, isec->sid, isec->sclass,
@@ -3398,12 +3381,10 @@ static int selinux_kernel_module_request(char *kmod_name)
 {
        u32 sid;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
 
        sid = task_sid(current);
 
-       COMMON_AUDIT_DATA_INIT(&ad, KMOD);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_KMOD;
        ad.u.kmod_name = kmod_name;
 
        return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
@@ -3776,15 +3757,13 @@ static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
 {
        struct sk_security_struct *sksec = sk->sk_security;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        u32 tsid = task_sid(task);
 
        if (sksec->sid == SECINITSID_KERNEL)
                return 0;
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->sk = sk;
 
@@ -3864,7 +3843,6 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                char *addrp;
                struct sk_security_struct *sksec = sk->sk_security;
                struct common_audit_data ad;
-               struct selinux_audit_data sad = {0,};
                struct lsm_network_audit net = {0,};
                struct sockaddr_in *addr4 = NULL;
                struct sockaddr_in6 *addr6 = NULL;
@@ -3891,8 +3869,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                                                      snum, &sid);
                                if (err)
                                        goto out;
-                               COMMON_AUDIT_DATA_INIT(&ad, NET);
-                               ad.selinux_audit_data = &sad;
+                               ad.type = LSM_AUDIT_DATA_NET;
                                ad.u.net = &net;
                                ad.u.net->sport = htons(snum);
                                ad.u.net->family = family;
@@ -3926,8 +3903,7 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
                if (err)
                        goto out;
 
-               COMMON_AUDIT_DATA_INIT(&ad, NET);
-               ad.selinux_audit_data = &sad;
+               ad.type = LSM_AUDIT_DATA_NET;
                ad.u.net = &net;
                ad.u.net->sport = htons(snum);
                ad.u.net->family = family;
@@ -3962,7 +3938,6 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
        if (sksec->sclass == SECCLASS_TCP_SOCKET ||
            sksec->sclass == SECCLASS_DCCP_SOCKET) {
                struct common_audit_data ad;
-               struct selinux_audit_data sad = {0,};
                struct lsm_network_audit net = {0,};
                struct sockaddr_in *addr4 = NULL;
                struct sockaddr_in6 *addr6 = NULL;
@@ -3988,8 +3963,7 @@ static int selinux_socket_connect(struct socket *sock, struct sockaddr *address,
                perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
                       TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
 
-               COMMON_AUDIT_DATA_INIT(&ad, NET);
-               ad.selinux_audit_data = &sad;
+               ad.type = LSM_AUDIT_DATA_NET;
                ad.u.net = &net;
                ad.u.net->dport = htons(snum);
                ad.u.net->family = sk->sk_family;
@@ -4081,12 +4055,10 @@ static int selinux_socket_unix_stream_connect(struct sock *sock,
        struct sk_security_struct *sksec_other = other->sk_security;
        struct sk_security_struct *sksec_new = newsk->sk_security;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        int err;
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->sk = other;
 
@@ -4115,11 +4087,9 @@ static int selinux_socket_unix_may_send(struct socket *sock,
        struct sk_security_struct *ssec = sock->sk->sk_security;
        struct sk_security_struct *osec = other->sk->sk_security;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->sk = other->sk;
 
@@ -4157,12 +4127,10 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
        struct sk_security_struct *sksec = sk->sk_security;
        u32 sk_sid = sksec->sid;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        char *addrp;
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->netif = skb->skb_iif;
        ad.u.net->family = family;
@@ -4192,7 +4160,6 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
        u16 family = sk->sk_family;
        u32 sk_sid = sksec->sid;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        char *addrp;
        u8 secmark_active;
@@ -4217,8 +4184,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
        if (!secmark_active && !peerlbl_active)
                return 0;
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->netif = skb->skb_iif;
        ad.u.net->family = family;
@@ -4556,7 +4522,6 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
        char *addrp;
        u32 peer_sid;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        u8 secmark_active;
        u8 netlbl_active;
@@ -4574,8 +4539,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
        if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
                return NF_DROP;
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->netif = ifindex;
        ad.u.net->family = family;
@@ -4665,7 +4629,6 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
        struct sock *sk = skb->sk;
        struct sk_security_struct *sksec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        char *addrp;
        u8 proto;
@@ -4674,8 +4637,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
                return NF_ACCEPT;
        sksec = sk->sk_security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->netif = ifindex;
        ad.u.net->family = family;
@@ -4700,7 +4662,6 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
        u32 peer_sid;
        struct sock *sk;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        struct lsm_network_audit net = {0,};
        char *addrp;
        u8 secmark_active;
@@ -4747,8 +4708,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
                secmark_perm = PACKET__SEND;
        }
 
-       COMMON_AUDIT_DATA_INIT(&ad, NET);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_NET;
        ad.u.net = &net;
        ad.u.net->netif = ifindex;
        ad.u.net->family = family;
@@ -4866,13 +4826,11 @@ static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
 
        isec = ipc_perms->security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = ipc_perms->key;
 
        return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
@@ -4893,7 +4851,6 @@ static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
        int rc;
 
@@ -4903,8 +4860,7 @@ static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
 
        isec = msq->q_perm.security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = msq->q_perm.key;
 
        rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
@@ -4925,13 +4881,11 @@ static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
 
        isec = msq->q_perm.security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = msq->q_perm.key;
 
        return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
@@ -4971,7 +4925,6 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
        struct ipc_security_struct *isec;
        struct msg_security_struct *msec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
        int rc;
 
@@ -4992,8 +4945,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
                        return rc;
        }
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = msq->q_perm.key;
 
        /* Can this process write to the queue? */
@@ -5018,15 +4970,13 @@ static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
        struct ipc_security_struct *isec;
        struct msg_security_struct *msec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = task_sid(target);
        int rc;
 
        isec = msq->q_perm.security;
        msec = msg->security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = msq->q_perm.key;
 
        rc = avc_has_perm(sid, isec->sid,
@@ -5042,7 +4992,6 @@ static int selinux_shm_alloc_security(struct shmid_kernel *shp)
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
        int rc;
 
@@ -5052,8 +5001,7 @@ static int selinux_shm_alloc_security(struct shmid_kernel *shp)
 
        isec = shp->shm_perm.security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = shp->shm_perm.key;
 
        rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
@@ -5074,13 +5022,11 @@ static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
 
        isec = shp->shm_perm.security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = shp->shm_perm.key;
 
        return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
@@ -5138,7 +5084,6 @@ static int selinux_sem_alloc_security(struct sem_array *sma)
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
        int rc;
 
@@ -5148,8 +5093,7 @@ static int selinux_sem_alloc_security(struct sem_array *sma)
 
        isec = sma->sem_perm.security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = sma->sem_perm.key;
 
        rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
@@ -5170,13 +5114,11 @@ static int selinux_sem_associate(struct sem_array *sma, int semflg)
 {
        struct ipc_security_struct *isec;
        struct common_audit_data ad;
-       struct selinux_audit_data sad = {0,};
        u32 sid = current_sid();
 
        isec = sma->sem_perm.security;
 
-       COMMON_AUDIT_DATA_INIT(&ad, IPC);
-       ad.selinux_audit_data = &sad;
+       ad.type = LSM_AUDIT_DATA_IPC;
        ad.u.ipc_id = sma->sem_perm.key;
 
        return avc_has_perm(sid, isec->sid, SECCLASS_SEM,