aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
authorwzt.wzt@gmail.com <wzt.wzt@gmail.com>2010-02-23 23:15:28 +0800
committerJames Morris <jmorris@namei.org>2010-02-24 08:11:02 +1100
commit189b3b1c89761054fee3438f063d7f257306e2d8 (patch)
tree8099352fa731fca91b95d862ac0d7199f21ca54d /security/selinux
parent2ae3ba39389b51d8502123de0a59374bec899c4d (diff)
downloadmrst-s0i3-test-189b3b1c89761054fee3438f063d7f257306e2d8.tar.gz
mrst-s0i3-test-189b3b1c89761054fee3438f063d7f257306e2d8.tar.xz
mrst-s0i3-test-189b3b1c89761054fee3438f063d7f257306e2d8.zip
Security: add static to security_ops and default_security_ops variable
Enhance the security framework to support resetting the active security module. This eliminates the need for direct use of the security_ops and default_security_ops variables outside of security.c, so make security_ops and default_security_ops static. Also remove the secondary_ops variable as a cleanup since there is no use for that. secondary_ops was originally used by SELinux to call the "secondary" security module (capability or dummy), but that was replaced by direct calls to capability and the only remaining use is to save and restore the original security ops pointer value if SELinux is disabled by early userspace based on /etc/selinux/config. Further, if we support this directly in the security framework, then we can just use &default_security_ops for this purpose since that is now available. Signed-off-by: Zhitong Wang <zhitong.wangzt@alibaba-inc.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/hooks.c13
1 files changed, 1 insertions, 12 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6b36ce2eef2..dc7660074b9 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -126,13 +126,6 @@ __setup("selinux=", selinux_enabled_setup);
int selinux_enabled = 1;
#endif
-
-/*
- * Minimal support for a secondary security module,
- * just to allow the use of the capability module.
- */
-static struct security_operations *secondary_ops;
-
/* Lists of inode and superblock security structures initialized
before the policy was loaded. */
static LIST_HEAD(superblock_security_head);
@@ -5674,9 +5667,6 @@ static __init int selinux_init(void)
0, SLAB_PANIC, NULL);
avc_init();
- secondary_ops = security_ops;
- if (!secondary_ops)
- panic("SELinux: No initial security operations\n");
if (register_security(&selinux_ops))
panic("SELinux: Unable to register with kernel.\n");
@@ -5837,8 +5827,7 @@ int selinux_disable(void)
selinux_disabled = 1;
selinux_enabled = 0;
- /* Reset security_ops to the secondary module, dummy or capability. */
- security_ops = secondary_ops;
+ reset_security_ops();
/* Try to destroy the avc node cache */
avc_disable();