* [PATCH smack] smack: remove duplicated hook function
@ 2021-10-11 14:33 Florian Westphal
2021-10-12 14:38 ` Casey Schaufler
0 siblings, 1 reply; 4+ messages in thread
From: Florian Westphal @ 2021-10-11 14:33 UTC (permalink / raw)
To: linux-security-module
Cc: casey, jmorris, serge, linux-kernel, Florian Westphal
ipv4 and ipv6 hook functions are identical, remove one.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
patch targets next branch of
git://github.com/cschaufler/smack-next.
security/smack/smack_netfilter.c | 26 +++-----------------------
1 file changed, 3 insertions(+), 23 deletions(-)
diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c
index fc7399b45373..a7ef2e2abc8a 100644
--- a/security/smack/smack_netfilter.c
+++ b/security/smack/smack_netfilter.c
@@ -18,27 +18,7 @@
#include <net/net_namespace.h>
#include "smack.h"
-#if IS_ENABLED(CONFIG_IPV6)
-
-static unsigned int smack_ipv6_output(void *priv,
- struct sk_buff *skb,
- const struct nf_hook_state *state)
-{
- struct sock *sk = skb_to_full_sk(skb);
- struct socket_smack *ssp;
- struct smack_known *skp;
-
- if (sk && sk->sk_security) {
- ssp = sk->sk_security;
- skp = ssp->smk_out;
- skb->secmark = skp->smk_secid;
- }
-
- return NF_ACCEPT;
-}
-#endif /* IPV6 */
-
-static unsigned int smack_ipv4_output(void *priv,
+static unsigned int smack_hook_output(void *priv,
struct sk_buff *skb,
const struct nf_hook_state *state)
{
@@ -57,14 +37,14 @@ static unsigned int smack_ipv4_output(void *priv,
static const struct nf_hook_ops smack_nf_ops[] = {
{
- .hook = smack_ipv4_output,
+ .hook = smack_hook_output,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_SELINUX_FIRST,
},
#if IS_ENABLED(CONFIG_IPV6)
{
- .hook = smack_ipv6_output,
+ .hook = smack_hook_output,
.pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_SELINUX_FIRST,
--
2.32.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH smack] smack: remove duplicated hook function
2021-10-11 14:33 [PATCH smack] smack: remove duplicated hook function Florian Westphal
@ 2021-10-12 14:38 ` Casey Schaufler
2021-10-12 14:40 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Casey Schaufler @ 2021-10-12 14:38 UTC (permalink / raw)
To: Florian Westphal, linux-security-module
Cc: jmorris, serge, linux-kernel, Casey Schaufler
On 10/11/2021 7:33 AM, Florian Westphal wrote:
> ipv4 and ipv6 hook functions are identical, remove one.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Looks fine, with the one change I've noted below. If you're
OK with that change I can take it for smack-next.
> ---
> patch targets next branch of
> git://github.com/cschaufler/smack-next.
>
> security/smack/smack_netfilter.c | 26 +++-----------------------
> 1 file changed, 3 insertions(+), 23 deletions(-)
>
> diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c
> index fc7399b45373..a7ef2e2abc8a 100644
> --- a/security/smack/smack_netfilter.c
> +++ b/security/smack/smack_netfilter.c
> @@ -18,27 +18,7 @@
> #include <net/net_namespace.h>
> #include "smack.h"
>
> -#if IS_ENABLED(CONFIG_IPV6)
> -
> -static unsigned int smack_ipv6_output(void *priv,
> - struct sk_buff *skb,
> - const struct nf_hook_state *state)
> -{
> - struct sock *sk = skb_to_full_sk(skb);
> - struct socket_smack *ssp;
> - struct smack_known *skp;
> -
> - if (sk && sk->sk_security) {
> - ssp = sk->sk_security;
> - skp = ssp->smk_out;
> - skb->secmark = skp->smk_secid;
> - }
> -
> - return NF_ACCEPT;
> -}
> -#endif /* IPV6 */
> -
> -static unsigned int smack_ipv4_output(void *priv,
> +static unsigned int smack_hook_output(void *priv,
I would prefer smack_ip_output() to smack_hook_output().
> struct sk_buff *skb,
> const struct nf_hook_state *state)
> {
> @@ -57,14 +37,14 @@ static unsigned int smack_ipv4_output(void *priv,
>
> static const struct nf_hook_ops smack_nf_ops[] = {
> {
> - .hook = smack_ipv4_output,
> + .hook = smack_hook_output,
> .pf = NFPROTO_IPV4,
> .hooknum = NF_INET_LOCAL_OUT,
> .priority = NF_IP_PRI_SELINUX_FIRST,
> },
> #if IS_ENABLED(CONFIG_IPV6)
> {
> - .hook = smack_ipv6_output,
> + .hook = smack_hook_output,
> .pf = NFPROTO_IPV6,
> .hooknum = NF_INET_LOCAL_OUT,
> .priority = NF_IP6_PRI_SELINUX_FIRST,
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH smack] smack: remove duplicated hook function
2021-10-12 14:38 ` Casey Schaufler
@ 2021-10-12 14:40 ` Florian Westphal
2021-10-12 15:26 ` Casey Schaufler
0 siblings, 1 reply; 4+ messages in thread
From: Florian Westphal @ 2021-10-12 14:40 UTC (permalink / raw)
To: Casey Schaufler
Cc: Florian Westphal, linux-security-module, jmorris, serge, linux-kernel
Casey Schaufler <casey@schaufler-ca.com> wrote:
> > Signed-off-by: Florian Westphal <fw@strlen.de>
>
> Looks fine, with the one change I've noted below. If you're
> OK with that change I can take it for smack-next.
Sure, smack_ip_output() is fine.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH smack] smack: remove duplicated hook function
2021-10-12 14:40 ` Florian Westphal
@ 2021-10-12 15:26 ` Casey Schaufler
0 siblings, 0 replies; 4+ messages in thread
From: Casey Schaufler @ 2021-10-12 15:26 UTC (permalink / raw)
To: Florian Westphal
Cc: linux-security-module, jmorris, serge, linux-kernel, Casey Schaufler
On 10/12/2021 7:40 AM, Florian Westphal wrote:
> Casey Schaufler <casey@schaufler-ca.com> wrote:
>>> Signed-off-by: Florian Westphal <fw@strlen.de>
>> Looks fine, with the one change I've noted below. If you're
>> OK with that change I can take it for smack-next.
> Sure, smack_ip_output() is fine.
Added to smack-next#next. Thank you.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-10-12 15:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-11 14:33 [PATCH smack] smack: remove duplicated hook function Florian Westphal
2021-10-12 14:38 ` Casey Schaufler
2021-10-12 14:40 ` Florian Westphal
2021-10-12 15:26 ` Casey Schaufler
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.