diff options
| author | Florian Westphal <fw@strlen.de> | 2017-04-21 11:49:09 +0200 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2017-06-02 10:27:46 -0400 |
| commit | 8e71bf75efceff07e04e1f8a4b7c0dbff7205949 (patch) | |
| tree | 8d3ac1a5570912e3ebc8f787e0442cb81f6aebc5 /security | |
| parent | 409dcf31538ae6ae96b3a0a1d3211e668bfefe8b (diff) | |
| download | op-kernel-dev-8e71bf75efceff07e04e1f8a4b7c0dbff7205949.zip op-kernel-dev-8e71bf75efceff07e04e1f8a4b7c0dbff7205949.tar.gz | |
selinux: use pernet operations for hook registration
It will allow us to remove the old netfilter hook api in the near future.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/hooks.c | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 158f6a0..9926adb 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6540,6 +6540,23 @@ static struct nf_hook_ops selinux_nf_ops[] = { #endif /* IPV6 */ }; +static int __net_init selinux_nf_register(struct net *net) +{ + return nf_register_net_hooks(net, selinux_nf_ops, + ARRAY_SIZE(selinux_nf_ops)); +} + +static void __net_exit selinux_nf_unregister(struct net *net) +{ + nf_unregister_net_hooks(net, selinux_nf_ops, + ARRAY_SIZE(selinux_nf_ops)); +} + +static struct pernet_operations selinux_net_ops = { + .init = selinux_nf_register, + .exit = selinux_nf_unregister, +}; + static int __init selinux_nf_ip_init(void) { int err; @@ -6549,13 +6566,12 @@ static int __init selinux_nf_ip_init(void) printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); - err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); + err = register_pernet_subsys(&selinux_net_ops); if (err) - panic("SELinux: nf_register_hooks: error %d\n", err); + panic("SELinux: register_pernet_subsys: error %d\n", err); return 0; } - __initcall(selinux_nf_ip_init); #ifdef CONFIG_SECURITY_SELINUX_DISABLE @@ -6563,7 +6579,7 @@ static void selinux_nf_ip_exit(void) { printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); - nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); + unregister_pernet_subsys(&selinux_net_ops); } #endif |
