.. | .. |
---|
| 1 | +// SPDX-License-Identifier: GPL-2.0-only |
---|
1 | 2 | /* |
---|
2 | 3 | * Network interface table. |
---|
3 | 4 | * |
---|
.. | .. |
---|
9 | 10 | * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com> |
---|
10 | 11 | * Copyright (C) 2007 Hewlett-Packard Development Company, L.P. |
---|
11 | 12 | * Paul Moore <paul@paul-moore.com> |
---|
12 | | - * |
---|
13 | | - * This program is free software; you can redistribute it and/or modify |
---|
14 | | - * it under the terms of the GNU General Public License version 2, |
---|
15 | | - * as published by the Free Software Foundation. |
---|
16 | 13 | */ |
---|
17 | 14 | #include <linux/init.h> |
---|
18 | 15 | #include <linux/types.h> |
---|
.. | .. |
---|
127 | 124 | * @sid: interface SID |
---|
128 | 125 | * |
---|
129 | 126 | * Description: |
---|
130 | | - * This function determines the SID of a network interface by quering the |
---|
| 127 | + * This function determines the SID of a network interface by querying the |
---|
131 | 128 | * security policy. The result is added to the network interface table to |
---|
132 | 129 | * speedup future queries. Returns zero on success, negative values on |
---|
133 | 130 | * failure. |
---|
.. | .. |
---|
135 | 132 | */ |
---|
136 | 133 | static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid) |
---|
137 | 134 | { |
---|
138 | | - int ret; |
---|
| 135 | + int ret = 0; |
---|
139 | 136 | struct sel_netif *netif; |
---|
140 | | - struct sel_netif *new = NULL; |
---|
| 137 | + struct sel_netif *new; |
---|
141 | 138 | struct net_device *dev; |
---|
142 | 139 | |
---|
143 | 140 | /* NOTE: we always use init's network namespace since we don't |
---|
.. | .. |
---|
154 | 151 | netif = sel_netif_find(ns, ifindex); |
---|
155 | 152 | if (netif != NULL) { |
---|
156 | 153 | *sid = netif->nsec.sid; |
---|
157 | | - ret = 0; |
---|
158 | 154 | goto out; |
---|
159 | 155 | } |
---|
| 156 | + |
---|
| 157 | + ret = security_netif_sid(&selinux_state, dev->name, sid); |
---|
| 158 | + if (ret != 0) |
---|
| 159 | + goto out; |
---|
160 | 160 | new = kzalloc(sizeof(*new), GFP_ATOMIC); |
---|
161 | | - if (new == NULL) { |
---|
162 | | - ret = -ENOMEM; |
---|
163 | | - goto out; |
---|
| 161 | + if (new) { |
---|
| 162 | + new->nsec.ns = ns; |
---|
| 163 | + new->nsec.ifindex = ifindex; |
---|
| 164 | + new->nsec.sid = *sid; |
---|
| 165 | + if (sel_netif_insert(new)) |
---|
| 166 | + kfree(new); |
---|
164 | 167 | } |
---|
165 | | - ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid); |
---|
166 | | - if (ret != 0) |
---|
167 | | - goto out; |
---|
168 | | - new->nsec.ns = ns; |
---|
169 | | - new->nsec.ifindex = ifindex; |
---|
170 | | - ret = sel_netif_insert(new); |
---|
171 | | - if (ret != 0) |
---|
172 | | - goto out; |
---|
173 | | - *sid = new->nsec.sid; |
---|
174 | 168 | |
---|
175 | 169 | out: |
---|
176 | 170 | spin_unlock_bh(&sel_netif_lock); |
---|
177 | 171 | dev_put(dev); |
---|
178 | | - if (unlikely(ret)) { |
---|
| 172 | + if (unlikely(ret)) |
---|
179 | 173 | pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n", |
---|
180 | 174 | __func__, ifindex); |
---|
181 | | - kfree(new); |
---|
182 | | - } |
---|
183 | 175 | return ret; |
---|
184 | 176 | } |
---|
185 | 177 | |
---|
.. | .. |
---|
274 | 266 | { |
---|
275 | 267 | int i; |
---|
276 | 268 | |
---|
277 | | - if (!selinux_enabled) |
---|
| 269 | + if (!selinux_enabled_boot) |
---|
278 | 270 | return 0; |
---|
279 | 271 | |
---|
280 | 272 | for (i = 0; i < SEL_NETIF_HASH_SIZE; i++) |
---|