[PATCH security-next 2/2] selinux: use pernet operations for hook registration
Paul Moore
paul at paul-moore.com
Wed Apr 26 20:46:22 UTC 2017
On Fri, Apr 21, 2017 at 5:49 AM, Florian Westphal <fw at strlen.de> wrote:
> It will allow us to remove the old netfilter hook api in the near future.
>
> Signed-off-by: Florian Westphal <fw at strlen.de>
> ---
> security/selinux/hooks.c | 24 ++++++++++++++++++++----
> 1 file changed, 20 insertions(+), 4 deletions(-)
Looks fine to me, I'm going to queue this up for after the v4.12 merge window.
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index e67a526d1f30..3aa4268525e2 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -6448,6 +6448,23 @@ static struct nf_hook_ops selinux_nf_ops[] = {
> #endif /* IPV6 */
> };
>
> +static int __net_init selinux_nf_register(struct net *net)
> +{
> + return nf_register_net_hooks(net, selinux_nf_ops,
> + ARRAY_SIZE(selinux_nf_ops));
> +}
> +
> +static void __net_exit selinux_nf_unregister(struct net *net)
> +{
> + nf_unregister_net_hooks(net, selinux_nf_ops,
> + ARRAY_SIZE(selinux_nf_ops));
> +}
> +
> +static struct pernet_operations selinux_net_ops = {
> + .init = selinux_nf_register,
> + .exit = selinux_nf_unregister,
> +};
> +
> static int __init selinux_nf_ip_init(void)
> {
> int err;
> @@ -6457,13 +6474,12 @@ static int __init selinux_nf_ip_init(void)
>
> printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
>
> - err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
> + err = register_pernet_subsys(&selinux_net_ops);
> if (err)
> - panic("SELinux: nf_register_hooks: error %d\n", err);
> + panic("SELinux: register_pernet_subsys: error %d\n", err);
>
> return 0;
> }
> -
> __initcall(selinux_nf_ip_init);
>
> #ifdef CONFIG_SECURITY_SELINUX_DISABLE
> @@ -6471,7 +6487,7 @@ static void selinux_nf_ip_exit(void)
> {
> printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
>
> - nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
> + unregister_pernet_subsys(&selinux_net_ops);
> }
> #endif
>
> --
> 2.10.2
>
--
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
More information about the Linux-security-module-archive
mailing list