diff options
author | Jiri Pirko <jiri@resnulli.us> | 2014-09-03 11:42:13 -0400 |
---|---|---|
committer | Paul Moore <pmoore@redhat.com> | 2014-09-08 20:42:47 -0400 |
commit | 25db6bea1ff5a78ef493eefdcbb9c1d27134e560 (patch) | |
tree | 9d3784b924aad3fcccef0fa47287872995196b39 | |
parent | a7a91a1928fe69cc98814cb746d5171ae14d757e (diff) |
selinux: register nf hooks with single nf_register_hooks call
Push ipv4 and ipv6 nf hooks into single array and register/unregister
them via single call.
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: Paul Moore <pmoore@redhat.com>
-rw-r--r-- | security/selinux/hooks.c | 35 |
1 files changed, 10 insertions, 25 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index e1e082796a49..50978d3183ea 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c | |||
@@ -6071,7 +6071,7 @@ security_initcall(selinux_init); | |||
6071 | 6071 | ||
6072 | #if defined(CONFIG_NETFILTER) | 6072 | #if defined(CONFIG_NETFILTER) |
6073 | 6073 | ||
6074 | static struct nf_hook_ops selinux_ipv4_ops[] = { | 6074 | static struct nf_hook_ops selinux_nf_ops[] = { |
6075 | { | 6075 | { |
6076 | .hook = selinux_ipv4_postroute, | 6076 | .hook = selinux_ipv4_postroute, |
6077 | .owner = THIS_MODULE, | 6077 | .owner = THIS_MODULE, |
@@ -6092,12 +6092,8 @@ static struct nf_hook_ops selinux_ipv4_ops[] = { | |||
6092 | .pf = NFPROTO_IPV4, | 6092 | .pf = NFPROTO_IPV4, |
6093 | .hooknum = NF_INET_LOCAL_OUT, | 6093 | .hooknum = NF_INET_LOCAL_OUT, |
6094 | .priority = NF_IP_PRI_SELINUX_FIRST, | 6094 | .priority = NF_IP_PRI_SELINUX_FIRST, |
6095 | } | 6095 | }, |
6096 | }; | ||
6097 | |||
6098 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | 6096 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
6099 | |||
6100 | static struct nf_hook_ops selinux_ipv6_ops[] = { | ||
6101 | { | 6097 | { |
6102 | .hook = selinux_ipv6_postroute, | 6098 | .hook = selinux_ipv6_postroute, |
6103 | .owner = THIS_MODULE, | 6099 | .owner = THIS_MODULE, |
@@ -6111,32 +6107,24 @@ static struct nf_hook_ops selinux_ipv6_ops[] = { | |||
6111 | .pf = NFPROTO_IPV6, | 6107 | .pf = NFPROTO_IPV6, |
6112 | .hooknum = NF_INET_FORWARD, | 6108 | .hooknum = NF_INET_FORWARD, |
6113 | .priority = NF_IP6_PRI_SELINUX_FIRST, | 6109 | .priority = NF_IP6_PRI_SELINUX_FIRST, |
6114 | } | 6110 | }, |
6115 | }; | ||
6116 | |||
6117 | #endif /* IPV6 */ | 6111 | #endif /* IPV6 */ |
6112 | }; | ||
6118 | 6113 | ||
6119 | static int __init selinux_nf_ip_init(void) | 6114 | static int __init selinux_nf_ip_init(void) |
6120 | { | 6115 | { |
6121 | int err = 0; | 6116 | int err; |
6122 | 6117 | ||
6123 | if (!selinux_enabled) | 6118 | if (!selinux_enabled) |
6124 | goto out; | 6119 | return 0; |
6125 | 6120 | ||
6126 | printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); | 6121 | printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); |
6127 | 6122 | ||
6128 | err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops)); | 6123 | err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); |
6129 | if (err) | ||
6130 | panic("SELinux: nf_register_hooks for IPv4: error %d\n", err); | ||
6131 | |||
6132 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
6133 | err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops)); | ||
6134 | if (err) | 6124 | if (err) |
6135 | panic("SELinux: nf_register_hooks for IPv6: error %d\n", err); | 6125 | panic("SELinux: nf_register_hooks: error %d\n", err); |
6136 | #endif /* IPV6 */ | ||
6137 | 6126 | ||
6138 | out: | 6127 | return 0; |
6139 | return err; | ||
6140 | } | 6128 | } |
6141 | 6129 | ||
6142 | __initcall(selinux_nf_ip_init); | 6130 | __initcall(selinux_nf_ip_init); |
@@ -6146,10 +6134,7 @@ static void selinux_nf_ip_exit(void) | |||
6146 | { | 6134 | { |
6147 | printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); | 6135 | printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); |
6148 | 6136 | ||
6149 | nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops)); | 6137 | nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); |
6150 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
6151 | nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops)); | ||
6152 | #endif /* IPV6 */ | ||
6153 | } | 6138 | } |
6154 | #endif | 6139 | #endif |
6155 | 6140 | ||