Skip to content

Commit

Permalink
selinux: use pernet operations for hook registration
Browse files Browse the repository at this point in the history
It will allow us to remove the old netfilter hook api in the near future.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
  • Loading branch information
Florian Westphal authored and Paul Moore committed Jun 2, 2017
1 parent 409dcf3 commit 8e71bf7
Showing 1 changed file with 20 additions and 4 deletions.
24 changes: 20 additions & 4 deletions security/selinux/hooks.c
Original file line number Diff line number Diff line change
Expand Up @@ -6540,6 +6540,23 @@ static struct nf_hook_ops selinux_nf_ops[] = {
#endif /* IPV6 */
};

static int __net_init selinux_nf_register(struct net *net)
{
return nf_register_net_hooks(net, selinux_nf_ops,
ARRAY_SIZE(selinux_nf_ops));
}

static void __net_exit selinux_nf_unregister(struct net *net)
{
nf_unregister_net_hooks(net, selinux_nf_ops,
ARRAY_SIZE(selinux_nf_ops));
}

static struct pernet_operations selinux_net_ops = {
.init = selinux_nf_register,
.exit = selinux_nf_unregister,
};

static int __init selinux_nf_ip_init(void)
{
int err;
Expand All @@ -6549,21 +6566,20 @@ static int __init selinux_nf_ip_init(void)

printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");

err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
err = register_pernet_subsys(&selinux_net_ops);
if (err)
panic("SELinux: nf_register_hooks: error %d\n", err);
panic("SELinux: register_pernet_subsys: error %d\n", err);

return 0;
}

__initcall(selinux_nf_ip_init);

#ifdef CONFIG_SECURITY_SELINUX_DISABLE
static void selinux_nf_ip_exit(void)
{
printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");

nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
unregister_pernet_subsys(&selinux_net_ops);
}
#endif

Expand Down

0 comments on commit 8e71bf7

Please sign in to comment.