Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 89c86576 authored by Thomas Liu's avatar Thomas Liu Committed by James Morris
Browse files

selinux: clean up avc node cache when disabling selinux 



Added a call to free the avc_node_cache when inside selinux_disable because
it should not waste resources allocated during avc_init if SELinux is disabled
and the cache will never be used.

Signed-off-by: default avatarThomas Liu <tliu@redhat.com>
Acked-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent a893a84e

security/selinux/avc.c

+6 −0
Original line number Original line Diff line number Diff line
@@ -970,3 +970,9 @@ u32 avc_policy_seqno(void) 
{

{

	return avc_cache.latest_notif;

	return avc_cache.latest_notif;

}

}



void avc_disable(void)

{

	if (avc_node_cachep)

		kmem_cache_destroy(avc_node_cachep);

}

security/selinux/hooks.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -5683,6 +5683,9 @@ int selinux_disable(void) 
	selinux_disabled = 1;

	selinux_disabled = 1;

	selinux_enabled = 0;

	selinux_enabled = 0;





	/* Try to destroy the avc node cache */

	avc_disable();



	/* Reset security_ops to the secondary module, dummy or capability. */

	/* Reset security_ops to the secondary module, dummy or capability. */

	security_ops = secondary_ops;

	security_ops = secondary_ops;

security/selinux/include/avc.h

+3 −0
Original line number Original line Diff line number Diff line
@@ -131,6 +131,9 @@ int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid, 
int avc_get_hash_stats(char *page);

int avc_get_hash_stats(char *page);

extern unsigned int avc_cache_threshold;

extern unsigned int avc_cache_threshold;





/* Attempt to free avc node cache */

void avc_disable(void);



#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS

#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS

DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);

DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);

#endif

#endif