| .. | .. |
|---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
|---|
| 1 | 2 | /* |
|---|
| 2 | 3 | * Network interface table. |
|---|
| 3 | 4 | * |
|---|
| .. | .. |
|---|
| 9 | 10 | * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> |
|---|
| 10 | 11 | * Copyright (C) 2007 Hewlett-Packard Development Company, L.P. |
|---|
| 11 | 12 | * Paul Moore <paul@paul-moore.com> |
|---|
| 12 | | - * |
|---|
| 13 | | - * This program is free software; you can redistribute it and/or modify |
|---|
| 14 | | - * it under the terms of the GNU General Public License version 2, |
|---|
| 15 | | - * as published by the Free Software Foundation. |
|---|
| 16 | 13 | */ |
|---|
| 17 | 14 | #include <linux/init.h> |
|---|
| 18 | 15 | #include <linux/types.h> |
|---|
| .. | .. |
|---|
| 127 | 124 | * @sid: interface SID |
|---|
| 128 | 125 | * |
|---|
| 129 | 126 | * Description: |
|---|
| 130 | | - * This function determines the SID of a network interface by quering the |
|---|
| 127 | + * This function determines the SID of a network interface by querying the |
|---|
| 131 | 128 | * security policy. The result is added to the network interface table to |
|---|
| 132 | 129 | * speedup future queries. Returns zero on success, negative values on |
|---|
| 133 | 130 | * failure. |
|---|
| .. | .. |
|---|
| 135 | 132 | */ |
|---|
| 136 | 133 | static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) |
|---|
| 137 | 134 | { |
|---|
| 138 | | - int ret; |
|---|
| 135 | + int ret = 0; |
|---|
| 139 | 136 | struct sel_netif *netif; |
|---|
| 140 | | - struct sel_netif *new = NULL; |
|---|
| 137 | + struct sel_netif *new; |
|---|
| 141 | 138 | struct net_device *dev; |
|---|
| 142 | 139 | |
|---|
| 143 | 140 | /* NOTE: we always use init's network namespace since we don't |
|---|
| .. | .. |
|---|
| 154 | 151 | netif = sel_netif_find(ns, ifindex); |
|---|
| 155 | 152 | if (netif != NULL) { |
|---|
| 156 | 153 | *sid = netif->nsec.sid; |
|---|
| 157 | | - ret = 0; |
|---|
| 158 | 154 | goto out; |
|---|
| 159 | 155 | } |
|---|
| 156 | + |
|---|
| 157 | + ret = security_netif_sid(&selinux_state, dev->name, sid); |
|---|
| 158 | + if (ret != 0) |
|---|
| 159 | + goto out; |
|---|
| 160 | 160 | new = kzalloc(sizeof(*new), GFP_ATOMIC); |
|---|
| 161 | | - if (new == NULL) { |
|---|
| 162 | | - ret = -ENOMEM; |
|---|
| 163 | | - goto out; |
|---|
| 161 | + if (new) { |
|---|
| 162 | + new->nsec.ns = ns; |
|---|
| 163 | + new->nsec.ifindex = ifindex; |
|---|
| 164 | + new->nsec.sid = *sid; |
|---|
| 165 | + if (sel_netif_insert(new)) |
|---|
| 166 | + kfree(new); |
|---|
| 164 | 167 | } |
|---|
| 165 | | - ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid); |
|---|
| 166 | | - if (ret != 0) |
|---|
| 167 | | - goto out; |
|---|
| 168 | | - new->nsec.ns = ns; |
|---|
| 169 | | - new->nsec.ifindex = ifindex; |
|---|
| 170 | | - ret = sel_netif_insert(new); |
|---|
| 171 | | - if (ret != 0) |
|---|
| 172 | | - goto out; |
|---|
| 173 | | - *sid = new->nsec.sid; |
|---|
| 174 | 168 | |
|---|
| 175 | 169 | out: |
|---|
| 176 | 170 | spin_unlock_bh(&sel_netif_lock); |
|---|
| 177 | 171 | dev_put(dev); |
|---|
| 178 | | - if (unlikely(ret)) { |
|---|
| 172 | + if (unlikely(ret)) |
|---|
| 179 | 173 | pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n", |
|---|
| 180 | 174 | __func__, ifindex); |
|---|
| 181 | | - kfree(new); |
|---|
| 182 | | - } |
|---|
| 183 | 175 | return ret; |
|---|
| 184 | 176 | } |
|---|
| 185 | 177 | |
|---|
| .. | .. |
|---|
| 274 | 266 | { |
|---|
| 275 | 267 | int i; |
|---|
| 276 | 268 | |
|---|
| 277 | | - if (!selinux_enabled) |
|---|
| 269 | + if (!selinux_enabled_boot) |
|---|
| 278 | 270 | return 0; |
|---|
| 279 | 271 | |
|---|
| 280 | 272 | for (i = 0; i < SEL_NETIF_HASH_SIZE; i++) |
|---|