summaryrefslogtreecommitdiff
path: root/security/selinux/avc.c
diff options
context:
space:
mode:
authorPaul Moore <paul.moore@hp.com>2008-01-29 16:38:10 +0300
committerJames Morris <jmorris@namei.org>2008-01-30 00:17:22 +0300
commitda5645a28a15aed2e541a814ecf9f7ffcd4c4673 (patch)
tree8cedccebd0e12308de30573ad593d703943e3cbb /security/selinux/avc.c
parente8bfdb9d0dfc1231a6a71e849dfbd4447acdfff6 (diff)
downloadlinux-da5645a28a15aed2e541a814ecf9f7ffcd4c4673.tar.xz
SELinux: Only store the network interface's ifindex
Instead of storing the packet's network interface name store the ifindex. This allows us to defer the need to lookup the net_device structure until the audit record is generated meaning that in the majority of cases we never need to bother with this at all. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/avc.c')
-rw-r--r--security/selinux/avc.c15
1 files changed, 12 insertions, 3 deletions
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 81b3dff3cbf0..e8529e2f51e5 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -661,9 +661,18 @@ void avc_audit(u32 ssid, u32 tsid,
"daddr", "dest");
break;
}
- if (a->u.net.netif)
- audit_log_format(ab, " netif=%s",
- a->u.net.netif);
+ if (a->u.net.netif > 0) {
+ struct net_device *dev;
+
+ /* NOTE: we always use init's namespace */
+ dev = dev_get_by_index(&init_net,
+ a->u.net.netif);
+ if (dev) {
+ audit_log_format(ab, " netif=%s",
+ dev->name);
+ dev_put(dev);
+ }
+ }
break;
}
}