hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/security/selinux/netif.c
....@@ -1,3 +1,4 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
12 /*
23 * Network interface table.
34 *
....@@ -9,10 +10,6 @@
910 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
1011 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
1112 * Paul Moore <paul@paul-moore.com>
12
- *
13
- * This program is free software; you can redistribute it and/or modify
14
- * it under the terms of the GNU General Public License version 2,
15
- * as published by the Free Software Foundation.
1613 */
1714 #include <linux/init.h>
1815 #include <linux/types.h>
....@@ -127,7 +124,7 @@
127124 * @sid: interface SID
128125 *
129126 * Description:
130
- * This function determines the SID of a network interface by quering the
127
+ * This function determines the SID of a network interface by querying the
131128 * security policy. The result is added to the network interface table to
132129 * speedup future queries. Returns zero on success, negative values on
133130 * failure.
....@@ -135,9 +132,9 @@
135132 */
136133 static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
137134 {
138
- int ret;
135
+ int ret = 0;
139136 struct sel_netif *netif;
140
- struct sel_netif *new = NULL;
137
+ struct sel_netif *new;
141138 struct net_device *dev;
142139
143140 /* NOTE: we always use init's network namespace since we don't
....@@ -154,32 +151,27 @@
154151 netif = sel_netif_find(ns, ifindex);
155152 if (netif != NULL) {
156153 *sid = netif->nsec.sid;
157
- ret = 0;
158154 goto out;
159155 }
156
+
157
+ ret = security_netif_sid(&selinux_state, dev->name, sid);
158
+ if (ret != 0)
159
+ goto out;
160160 new = kzalloc(sizeof(*new), GFP_ATOMIC);
161
- if (new == NULL) {
162
- ret = -ENOMEM;
163
- goto out;
161
+ if (new) {
162
+ new->nsec.ns = ns;
163
+ new->nsec.ifindex = ifindex;
164
+ new->nsec.sid = *sid;
165
+ if (sel_netif_insert(new))
166
+ kfree(new);
164167 }
165
- ret = security_netif_sid(&selinux_state, dev->name, &new->nsec.sid);
166
- if (ret != 0)
167
- goto out;
168
- new->nsec.ns = ns;
169
- new->nsec.ifindex = ifindex;
170
- ret = sel_netif_insert(new);
171
- if (ret != 0)
172
- goto out;
173
- *sid = new->nsec.sid;
174168
175169 out:
176170 spin_unlock_bh(&sel_netif_lock);
177171 dev_put(dev);
178
- if (unlikely(ret)) {
172
+ if (unlikely(ret))
179173 pr_warn("SELinux: failure in %s(), unable to determine network interface label (%d)\n",
180174 __func__, ifindex);
181
- kfree(new);
182
- }
183175 return ret;
184176 }
185177
....@@ -274,7 +266,7 @@
274266 {
275267 int i;
276268
277
- if (!selinux_enabled)
269
+ if (!selinux_enabled_boot)
278270 return 0;
279271
280272 for (i = 0; i < SEL_NETIF_HASH_SIZE; i++)