secmark: make secmark object handling generic

Right now secmark has lots of direct selinux calls.  Use all LSM calls and
remove all SELinux specific knowledge.  The only SELinux specific knowledge
we leave is the mode.  The only point is to make sure that other LSMs at
least test this generic code before they assume it works.  (They may also
have to make changes if they do not represent labels as strings)

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Paul Moore <paul.moore@hp.com>
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 3 insertions, 9 deletions

diff --git a/include/linux/netfilter/xt_SECMARK.h b/include/linux/netfilter/xt_SECMARK.h
index 6fcd3448b18..989092bd627 100644
--- a/include/linux/netfilter/xt_SECMARK.h
+++ b/include/linux/netfilter/xt_SECMARK.h
@@ -11,18 +11,12 @@
  * packets are being marked for.
  */
 #define SECMARK_MODE_SEL        0x01            /* SELinux */
-#define SECMARK_SELCTX_MAX      256
-
-struct xt_secmark_target_selinux_info {
-        __u32 selsid;
-        char selctx[SECMARK_SELCTX_MAX];
-};
+#define SECMARK_SECCTX_MAX      256
 
 struct xt_secmark_target_info {
         __u8 mode;
-        union {
-                struct xt_secmark_target_selinux_info sel;
-        } u;
+        __u32 secid;
+        char secctx[SECMARK_SECCTX_MAX];
 };
 
 #endif /*_XT_SECMARK_H_target */