diff options
| author |   Paul Moore <paul.moore@hp.com> | 2006-11-17 17:38:53 -0500 |
|---|---|---|
| committer |   David S. Miller <davem@sunset.davemloft.net> | 2006-12-02 21:24:13 -0800 |
| commit | 9f2ad66509b182b399a5b03de487f45bde623524 (patch) | |
| tree | 8376dc2db99a78c1b043644f019c4dc224187f16 /security/selinux/hooks.c | |
| parent | NetLabel: use cipso_v4_doi_search() for local CIPSOv4 functions (diff) | |
| download | linux-dev-9f2ad66509b182b399a5b03de487f45bde623524.tar.xz linux-dev-9f2ad66509b182b399a5b03de487f45bde623524.zip | |
NetLabel: SELinux cleanups
This patch does a lot of cleanup in the SELinux NetLabel support code. A
summary of the changes include:
* Use RCU locking for the NetLabel state variable in the skk_security_struct
instead of using the inode_security_struct mutex.
* Remove unnecessary parameters in selinux_netlbl_socket_post_create().
* Rename selinux_netlbl_sk_clone_security() to
selinux_netlbl_sk_security_clone() to better fit the other NetLabel
sk_security functions.
* Improvements to selinux_netlbl_inode_permission() to help reduce the cost of
the common case.
Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 0cf98740ddc6..975c0dfb5a11 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3140,9 +3140,7 @@ static int selinux_socket_post_create(struct socket *sock, int family, if (sock->sk) { sksec = sock->sk->sk_security; sksec->sid = isec->sid; - err = selinux_netlbl_socket_post_create(sock, - family, - isec->sid); + err = selinux_netlbl_socket_post_create(sock); } return err; @@ -3661,7 +3659,7 @@ static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk) newssec->sid = ssec->sid; newssec->peer_sid = ssec->peer_sid; - selinux_netlbl_sk_clone_security(ssec, newssec); + selinux_netlbl_sk_security_clone(ssec, newssec); } static void selinux_sk_getsecid(struct sock *sk, u32 *secid) @@ -3730,7 +3728,9 @@ static void selinux_inet_csk_clone(struct sock *newsk, So we will wait until sock_graft to do it, by which time it will have been created and available. */ - selinux_netlbl_sk_security_init(newsksec, req->rsk_ops->family); + /* We don't need to take any sort of lock here as we are the only + * thread with access to newsksec */ + selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family); } static void selinux_inet_conn_established(struct sock *sk, |