Commit 6c5a9d2e authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller
Browse files

selinux: use nf_register_hooks() 



Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Acked-by: default avatarJames Morris <jmorris@namei.org>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e40f51a3

security/selinux/hooks.c

+8 −19
Original line number Diff line number Diff line
@@ -5670,27 +5670,20 @@ static struct nf_hook_ops selinux_ipv6_ops[] = { 
static int __init selinux_nf_ip_init(void)

{

	int err = 0;

	u32 iter;



	if (!selinux_enabled)

		goto out;



	printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");



	for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {

		err = nf_register_hook(&selinux_ipv4_ops[iter]);

	err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));

	if (err)

			panic("SELinux: nf_register_hook for IPv4: error %d\n",

			      err);

	}

		panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);



#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

	for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {

		err = nf_register_hook(&selinux_ipv6_ops[iter]);

	err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));

	if (err)

			panic("SELinux: nf_register_hook for IPv6: error %d\n",

			      err);

	}

		panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);

#endif	/* IPV6 */



out:
@@ -5702,15 +5695,11 @@ __initcall(selinux_nf_ip_init); 
#ifdef CONFIG_SECURITY_SELINUX_DISABLE

static void selinux_nf_ip_exit(void)

{

	u32 iter;



	printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");



	for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)

		nf_unregister_hook(&selinux_ipv4_ops[iter]);

	nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));

#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

	for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)

		nf_unregister_hook(&selinux_ipv6_ops[iter]);

	nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));

#endif	/* IPV6 */

}

#endif