aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJiri Pirko <jiri@resnulli.us>2014-09-03 11:42:13 -0400
committerPaul Moore <pmoore@redhat.com>2014-09-08 20:42:47 -0400
commit25db6bea1ff5a78ef493eefdcbb9c1d27134e560 (patch)
tree9d3784b924aad3fcccef0fa47287872995196b39
parenta7a91a1928fe69cc98814cb746d5171ae14d757e (diff)
selinux: register nf hooks with single nf_register_hooks call
Push ipv4 and ipv6 nf hooks into single array and register/unregister them via single call. Signed-off-by: Jiri Pirko <jiri@resnulli.us> Signed-off-by: Paul Moore <pmoore@redhat.com>
-rw-r--r--security/selinux/hooks.c35
1 files changed, 10 insertions, 25 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e1e082796a49..50978d3183ea 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6071,7 +6071,7 @@ security_initcall(selinux_init);
6071 6071
6072#if defined(CONFIG_NETFILTER) 6072#if defined(CONFIG_NETFILTER)
6073 6073
6074static struct nf_hook_ops selinux_ipv4_ops[] = { 6074static struct nf_hook_ops selinux_nf_ops[] = {
6075 { 6075 {
6076 .hook = selinux_ipv4_postroute, 6076 .hook = selinux_ipv4_postroute,
6077 .owner = THIS_MODULE, 6077 .owner = THIS_MODULE,
@@ -6092,12 +6092,8 @@ static struct nf_hook_ops selinux_ipv4_ops[] = {
6092 .pf = NFPROTO_IPV4, 6092 .pf = NFPROTO_IPV4,
6093 .hooknum = NF_INET_LOCAL_OUT, 6093 .hooknum = NF_INET_LOCAL_OUT,
6094 .priority = NF_IP_PRI_SELINUX_FIRST, 6094 .priority = NF_IP_PRI_SELINUX_FIRST,
6095 } 6095 },
6096};
6097
6098#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 6096#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6099
6100static struct nf_hook_ops selinux_ipv6_ops[] = {
6101 { 6097 {
6102 .hook = selinux_ipv6_postroute, 6098 .hook = selinux_ipv6_postroute,
6103 .owner = THIS_MODULE, 6099 .owner = THIS_MODULE,
@@ -6111,32 +6107,24 @@ static struct nf_hook_ops selinux_ipv6_ops[] = {
6111 .pf = NFPROTO_IPV6, 6107 .pf = NFPROTO_IPV6,
6112 .hooknum = NF_INET_FORWARD, 6108 .hooknum = NF_INET_FORWARD,
6113 .priority = NF_IP6_PRI_SELINUX_FIRST, 6109 .priority = NF_IP6_PRI_SELINUX_FIRST,
6114 } 6110 },
6115};
6116
6117#endif /* IPV6 */ 6111#endif /* IPV6 */
6112};
6118 6113
6119static int __init selinux_nf_ip_init(void) 6114static int __init selinux_nf_ip_init(void)
6120{ 6115{
6121 int err = 0; 6116 int err;
6122 6117
6123 if (!selinux_enabled) 6118 if (!selinux_enabled)
6124 goto out; 6119 return 0;
6125 6120
6126 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); 6121 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6127 6122
6128 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops)); 6123 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6129 if (err)
6130 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6131
6132#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6133 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6134 if (err) 6124 if (err)
6135 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err); 6125 panic("SELinux: nf_register_hooks: error %d\n", err);
6136#endif /* IPV6 */
6137 6126
6138out: 6127 return 0;
6139 return err;
6140} 6128}
6141 6129
6142__initcall(selinux_nf_ip_init); 6130__initcall(selinux_nf_ip_init);
@@ -6146,10 +6134,7 @@ static void selinux_nf_ip_exit(void)
6146{ 6134{
6147 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); 6135 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6148 6136
6149 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops)); 6137 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6150#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6151 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6152#endif /* IPV6 */
6153} 6138}
6154#endif 6139#endif
6155 6140