From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Eric W. Biederman" Subject: [PATCH net-next 39/43] selinux: adapt it to pernet hooks Date: Wed, 17 Jun 2015 10:28:48 -0500 Message-ID: <1434554932-4552-39-git-send-email-ebiederm@xmission.com> References: <87r3pae5hn.fsf@x220.int.ebiederm.org> Cc: , netfilter-devel@vger.kernel.org, Stephen Hemminger , Juanjo Ciarlante , Wensong Zhang , Simon Horman , Julian Anastasov , Pablo Neira Ayuso , Patrick McHardy , Jozsef Kadlecsik , Jamal Hadi Salim , Steffen Klassert , Herbert Xu To: David Miller Return-path: Received: from out01.mta.xmission.com ([166.70.13.231]:45864 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757478AbbFQPia (ORCPT ); Wed, 17 Jun 2015 11:38:30 -0400 In-Reply-To: <87r3pae5hn.fsf@x220.int.ebiederm.org> Sender: netdev-owner@vger.kernel.org List-ID: From: Pablo Neira Ayuso Since pernet hooks, we need to register the hook for each netnamespace space. Signed-off-by: Pablo Neira Ayuso Signed-off-by: Eric W Biederman --- security/selinux/hooks.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 21a5e07b6834..f8db1d2ce9c2 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6147,6 +6147,22 @@ static struct nf_hook_ops selinux_nf_ops[] = { #endif /* IPV6 */ }; +static int selinux_net_init(struct net *net) +{ + return nf_register_hooks(net, selinux_nf_ops, + ARRAY_SIZE(selinux_nf_ops)); +} + +static void selinux_net_exit(struct net *net) +{ + nf_unregister_hooks(net, selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); +} + +static struct pernet_operations selinux_net_ops = { + .init = selinux_net_init, + .exit = selinux_net_exit, +}; + static int __init selinux_nf_ip_init(void) { int err; @@ -6156,8 +6172,7 @@ static int __init selinux_nf_ip_init(void) printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); - err = nf_register_hooks(&init_net, selinux_nf_ops, - ARRAY_SIZE(selinux_nf_ops)); + err = register_pernet_subsys(&selinux_net_ops); if (err) panic("SELinux: nf_register_hooks: error %d\n", err); @@ -6171,7 +6186,7 @@ static void selinux_nf_ip_exit(void) { printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); - nf_unregister_hooks(&init_net, selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops)); + unregister_pernet_subsys(&selinux_net_ops); } #endif -- 2.2.1