[PATCH v5 1/1] security: Add mechanism to safely (un)load LSMs after boot time

@@ -28,6 +28,7 @@
 #include <linux/security.h>
 #include <linux/init.h>
 #include <linux/rculist.h>
+#include <linux/module.h>
 
 /**
  * union security_list_options - Linux Security Module hook function list

@@ -1967,6 +1968,7 @@ struct security_hook_list {
 	struct hlist_head		*head;
 	union security_list_options	hook;
 	char				*lsm;
+	struct module			*owner;
 } __randomize_layout;
 
 /*

@@ -1976,15 +1978,27 @@ struct security_hook_list {
  * text involved.
  */
 #define LSM_HOOK_INIT(HEAD, HOOK) \
-	{ .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } }
-
+	{						\
+		.head = &security_hook_heads.HEAD,	\
+		.hook = { .HEAD = HOOK },		\
+		.owner = THIS_MODULE,			\
+	}
 extern struct security_hook_heads security_hook_heads;
 extern char *lsm_names;
 
 extern void security_add_hooks(struct security_hook_list *hooks, int count,
 				char *lsm);
 
-#ifdef CONFIG_SECURITY_SELINUX_DISABLE
+#define __lsm_ro_after_init	__ro_after_init
+/* Used to facilitate runtime hook unloading, and loading */
+#ifdef CONFIG_SECURITY_WRITABLE_HOOKS
+#define LSM_HOOK_INIT_MUTABLE(HEAD, HOOK) \
+	{							\
+		.head = &security_hook_heads_mutable.HEAD,	\
+		.hook = { .HEAD = HOOK },			\
+		.owner = THIS_MODULE,				\
+	}
+extern struct security_hook_heads security_hook_heads_mutable;
 /*
  * Assuring the safety of deleting a security module is up to
  * the security module involved. This may entail ordering the

@@ -1997,21 +2011,7 @@ extern void security_add_hooks(struct security_hook_list *hooks, int count,
  * disabling their module is a good idea needs to be at least as
  * careful as the SELinux team.
  */
-static inline void security_delete_hooks(struct security_hook_list *hooks,
-						int count)
-{
-	int i;
-
-	for (i = 0; i < count; i++)
-		hlist_del_rcu(&hooks[i].list);
-}
-#endif /* CONFIG_SECURITY_SELINUX_DISABLE */
-
-/* Currently required to handle SELinux runtime hook disable. */
-#ifdef CONFIG_SECURITY_WRITABLE_HOOKS
-#define __lsm_ro_after_init
-#else
-#define __lsm_ro_after_init	__ro_after_init
+extern void security_delete_hooks(struct security_hook_list *hooks, int count);
 #endif /* CONFIG_SECURITY_WRITABLE_HOOKS */
 
 extern int __init security_module_enable(const char *module);

@@ -32,10 +32,21 @@ config SECURITY
 	  If you are unsure how to answer this question, answer N.
 
 config SECURITY_WRITABLE_HOOKS
-	depends on SECURITY
+	depends on SECURITY && SRCU
 	bool
 	default n
 
+config SECURITY_UNLOADABLE_MODULES
+	depends on SECURITY_WRITABLE_HOOKS && MODULE_UNLOAD
+	default n
+	bool "Enable security module unloading"
+	help
+	  This allows arbitrary security modules to be unloaded by the user
+	  after boot time. This feature can be disabled via the kernel command
+	  line, or via sysfs after boot time.
+
+	  If you are unsure how to answer this question, answer N.
+
 config SECURITYFS
 	bool "Enable the securityfs filesystem"
 	help

@@ -29,6 +29,11 @@
 #include <linux/backing-dev.h>
 #include <linux/string.h>
 #include <net/flow.h>
+#include <linux/srcu.h>
+#include <linux/mutex.h>
+
+#define SECURITY_HOOK_COUNT \
+	(sizeof(security_hook_heads) / sizeof(struct hlist_head))
 
 #define MAX_LSM_EVM_XATTR	2
 

@@ -36,7 +41,9 @@
 #define SECURITY_NAME_MAX	10
 
 struct security_hook_heads security_hook_heads __lsm_ro_after_init;
+
 static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain);
+static DEFINE_MUTEX(security_hook_mutex);
 
 char *lsm_names;
 /* Boot-time LSM user choice */

@@ -52,6 +59,131 @@ static void __init do_security_initcalls(void)
 		call++;
 	}
 }
+#define FOR_EACH_SECURITY_HOOK(ITERATOR, HEAD) \
+	hlist_for_each_entry(ITERATOR, &security_hook_heads.HEAD, list)
+
+#ifdef CONFIG_SECURITY_WRITABLE_HOOKS
+/*
+ * If mutable security hooks are enabled, it exposes a second set of
+ * security_hook_heads. These security_hook_heads will only be executed
+ * if all immutable hooks are executed successfully.
+ */
+struct security_hook_heads security_hook_heads_mutable;
+EXPORT_SYMBOL_GPL(security_hook_heads_mutable);
+DEFINE_STATIC_SRCU(security_hook_srcu);
+
+/*
+ * This blocks the delete_module syscall for hooks that are loaded into the
+ * set of mutable hooks by getting a reference on those modules. This
+ * allows modules to still delete their security hooks, so SELinux
+ * will still be able to unload.
+ */
+static bool allow_unload_hooks =
+	IS_ENABLED(CONFIG_SECURITY_UNLOADABLE_MODULES);
+
+static void lock_existing_hooks(void)
+{
+	struct hlist_head *list = (struct hlist_head *)
+					&security_hook_heads_mutable;
+	struct security_hook_list *P;
+	int i;
+
+	/*
+	 * Prevent module unloading while we're doing this
+	 * try_module_get may fail (safely), if the module
+	 * is already unloading -- allow that.
+	 */
+	mutex_lock(&module_mutex);
+	for (i = 0; i < SECURITY_HOOK_COUNT; i++)
+		hlist_for_each_entry(P, &list[i], list)
+			try_module_get(P->owner);
+	mutex_unlock(&module_mutex);
+}
+
+static int allow_unload_hooks_set(const char *val,
+					const struct kernel_param *kp)
+{
+	bool new_val;
+	int ret = 0;
+
+	ret = strtobool(val, &new_val);
+	if (ret)
+		goto out;
+	mutex_lock(&security_hook_mutex);
+	/* This is a noop */
+	if (new_val == allow_unload_hooks)
+		goto out;
+
+	/* Do not allow for the transition from false -> true */
+	if (new_val) {
+		ret = -EPERM;
+		goto out;
+	}
+
+	allow_unload_hooks = new_val;
+	/* We now need to "lock" all of the existing hooks */
+	lock_existing_hooks();
+out:
+	mutex_unlock(&security_hook_mutex);
+	return ret;
+}
+
+static int allow_unload_hooks_get(char *buffer, const struct kernel_param *kp)
+{
+	int ret;
+
+	mutex_lock(&security_hook_mutex);
+	ret = sprintf(buffer, "%c\n", allow_unload_hooks ? '1' : '0');
+	mutex_unlock(&security_hook_mutex);
+
+	return ret;
+}
+
+static struct kernel_param_ops allow_unload_hooks_param_ops = {
+	.set	= allow_unload_hooks_set,
+	.get	= allow_unload_hooks_get,
+};
+
+module_param_cb(allow_unload_hooks, &allow_unload_hooks_param_ops, NULL, 0644);
+MODULE_PARM_DESC(allow_unload_hooks, "Allow unloading security hooks");
+
+static inline int lock_lsm(void)
+{
+	return srcu_read_lock(&security_hook_srcu);
+}
+
+static inline void unlock_lsm(int idx)
+{
+	srcu_read_unlock(&security_hook_srcu, idx);
+}
+
+void security_delete_hooks(struct security_hook_list *hooks, int count)
+{
+	int i;
+
+	mutex_lock(&security_hook_mutex);
+	for (i = 0; i < count; i++)
+		hlist_del_rcu(&hooks[i].list);
+	mutex_unlock(&security_hook_mutex);
+
+	synchronize_srcu(&security_hook_srcu);
+}
+EXPORT_SYMBOL_GPL(security_delete_hooks);
+
+#define FOR_EACH_SECURITY_HOOK_MUTABLE(ITERATOR, HEAD) \
+	hlist_for_each_entry(ITERATOR, &security_hook_heads_mutable.HEAD, list)
+#else
+static inline int lock_lsm(void)
+{
+	return 0;
+}
+
+static inline void unlock_lsm(int idx) {}
+
+#define allow_unload_hooks	false
+
+#define FOR_EACH_SECURITY_HOOK_MUTABLE(ITERATOR, HEAD)	while (0)
+#endif /* CONFIG_SECURITY_WRITABLE_HOOKS */
 
 /**
  * security_init - initializes the security framework

@@ -60,12 +192,6 @@ static void __init do_security_initcalls(void)
  */
 int __init security_init(void)
 {
-	int i;
-	struct hlist_head *list = (struct hlist_head *) &security_hook_heads;
-
-	for (i = 0; i < sizeof(security_hook_heads) / sizeof(struct hlist_head);
-	     i++)
-		INIT_HLIST_HEAD(&list[i]);
 	pr_info("Security Framework initialized\n");
 
 	/*

@@ -156,18 +282,23 @@ int __init security_module_enable(const char *module)
  *
  * Each LSM has to register its hooks with the infrastructure.
  */
-void __init security_add_hooks(struct security_hook_list *hooks, int count,
-				char *lsm)
+void security_add_hooks(struct security_hook_list *hooks, int count, char *lsm)
 {
 	int i;
 
+	mutex_lock(&security_hook_mutex);
 	for (i = 0; i < count; i++) {
 		hooks[i].lsm = lsm;
 		hlist_add_tail_rcu(&hooks[i].list, hooks[i].head);
+		if (!allow_unload_hooks)
+			WARN_ON(!try_module_get(hooks[i].owner));
 	}
+	mutex_unlock(&security_hook_mutex);
+
 	if (lsm_append(lsm, &lsm_names) < 0)
 		panic("%s - Cannot get early memory.\n", __func__);
 }
+EXPORT_SYMBOL_GPL(security_add_hooks);
 
 int call_lsm_notifier(enum lsm_event event, void *data)
 {

@@ -200,25 +331,48 @@ EXPORT_SYMBOL(unregister_lsm_notifier);
 #define call_void_hook(FUNC, ...)				\
 	do {							\
 		struct security_hook_list *P;			\
+		int srcu_idx;					\
 								\
-		hlist_for_each_entry(P, &security_hook_heads.FUNC, list) \
+		FOR_EACH_SECURITY_HOOK(P, FUNC)			\
 			P->hook.FUNC(__VA_ARGS__);		\
+		srcu_idx = lock_lsm();				\
+		FOR_EACH_SECURITY_HOOK_MUTABLE(P, FUNC)		\
+			P->hook.FUNC(__VA_ARGS__);		\
+		unlock_lsm(srcu_idx);				\
 	} while (0)
 
-#define call_int_hook(FUNC, IRC, ...) ({			\
+#define call_int_hook2(LABEL, FUNC, IRC, ...) ({		\
 	int RC = IRC;						\
+								\
 	do {							\
 		struct security_hook_list *P;			\
+		int srcu_idx;					\
 								\
-		hlist_for_each_entry(P, &security_hook_heads.FUNC, list) { \
+		FOR_EACH_SECURITY_HOOK(P, FUNC) {		\
+			RC = P->hook.FUNC(__VA_ARGS__);		\
+			if (RC != 0)				\
+				goto LABEL;			\
+		}						\
+		srcu_idx = lock_lsm();				\
+		FOR_EACH_SECURITY_HOOK_MUTABLE(P, FUNC) {	\
 			RC = P->hook.FUNC(__VA_ARGS__);		\
 			if (RC != 0)				\
 				break;				\
 		}						\
+		unlock_lsm(srcu_idx);				\
 	} while (0);						\
+LABEL:								\
 	RC;							\
 })
 
+/*
+ * The label for each instance of call_int_hook as it can be
+ * invoked multiple times in a single function definition.
+ */
+#define call_int_hook(FUNC, IRC, ...)	\
+	call_int_hook2(__UNIQUE_ID(FUNC), FUNC, IRC, __VA_ARGS__)
+
+
 /* Security operations */
 
 int security_binder_set_context_mgr(struct task_struct *mgr)

@@ -308,6 +462,7 @@ int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
 {
 	struct security_hook_list *hp;
 	int cap_sys_admin = 1;
+	int srcu_idx;
 	int rc;
 
 	/*

@@ -317,13 +472,25 @@ int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
 	 * agree that it should be set it will. If any module
 	 * thinks it should not be set it won't.
 	 */
-	hlist_for_each_entry(hp, &security_hook_heads.vm_enough_memory, list) {
+	FOR_EACH_SECURITY_HOOK(hp, vm_enough_memory) {
+		rc = hp->hook.vm_enough_memory(mm, pages);
+		if (rc <= 0) {
+			cap_sys_admin = 0;
+			goto out;
+		}
+	}
+
+	srcu_idx = lock_lsm();
+	FOR_EACH_SECURITY_HOOK_MUTABLE(hp, vm_enough_memory) {
 		rc = hp->hook.vm_enough_memory(mm, pages);
 		if (rc <= 0) {
 			cap_sys_admin = 0;
 			break;
 		}
 	}
+	unlock_lsm(srcu_idx);
+
+out:
 	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 

@@ -795,43 +962,71 @@ int security_inode_killpriv(struct dentry *dentry)
 	return call_int_hook(inode_killpriv, 0, dentry);
 }
 
-int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
+int security_inode_getsecurity(struct inode *inode, const char *name,
+			       void **buffer, bool alloc)
 {
 	struct security_hook_list *hp;
-	int rc;
+	int rc = -EOPNOTSUPP;
+	int srcu_idx;
 
 	if (unlikely(IS_PRIVATE(inode)))
 		return -EOPNOTSUPP;
 	/*
 	 * Only one module will provide an attribute with a given name.
 	 */
-	hlist_for_each_entry(hp, &security_hook_heads.inode_getsecurity, list) {
+	FOR_EACH_SECURITY_HOOK(hp, inode_getsecurity) {
+		rc = hp->hook.inode_getsecurity(inode, name, buffer, alloc);
+		if (rc != -EOPNOTSUPP)
+			goto out;
+	}
+
+	srcu_idx = lock_lsm();
+	FOR_EACH_SECURITY_HOOK_MUTABLE(hp, inode_getsecurity) {
 		rc = hp->hook.inode_getsecurity(inode, name, buffer, alloc);
 		if (rc != -EOPNOTSUPP)
-			return rc;
+			break;
 	}
-	return -EOPNOTSUPP;
+	unlock_lsm(srcu_idx);
+
+out:
+	return rc;
 }
 
-int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
+int security_inode_setsecurity(struct inode *inode, const char *name,
+				const void *value, size_t size, int flags)
 {
 	struct security_hook_list *hp;
-	int rc;
+	int rc = -EOPNOTSUPP;
+	int srcu_idx;
 
 	if (unlikely(IS_PRIVATE(inode)))
 		return -EOPNOTSUPP;
 	/*
 	 * Only one module will provide an attribute with a given name.
 	 */
-	hlist_for_each_entry(hp, &security_hook_heads.inode_setsecurity, list) {
+
+	FOR_EACH_SECURITY_HOOK(hp, inode_setsecurity) {
 		rc = hp->hook.inode_setsecurity(inode, name, value, size,
-								flags);
+						flags);
 		if (rc != -EOPNOTSUPP)
-			return rc;
+			goto out;
 	}
-	return -EOPNOTSUPP;
+
+	srcu_idx = lock_lsm();
+	FOR_EACH_SECURITY_HOOK_MUTABLE(hp, inode_setsecurity) {
+		rc = hp->hook.inode_setsecurity(inode, name, value, size,
+						flags);
+		if (rc != -EOPNOTSUPP)
+			break;
+	}
+	unlock_lsm(srcu_idx);
+
+out:
+	return rc;
 }
 
+
+
 int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
 {
 	if (unlikely(IS_PRIVATE(inode)))

@@ -1120,13 +1315,26 @@ int security_task_kill(struct task_struct *p, struct siginfo *info,
 }
 
 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-			 unsigned long arg4, unsigned long arg5)
+			unsigned long arg4, unsigned long arg5)
 {
 	int thisrc;
 	int rc = -ENOSYS;
 	struct security_hook_list *hp;
+	int srcu_idx;
+
+
+	FOR_EACH_SECURITY_HOOK(hp, task_prctl) {
+		thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
+		if (thisrc != -ENOSYS) {
+			rc = thisrc;
+			if (thisrc != 0)
+				goto out;
+		}
+
+	}
 
-	hlist_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
+	srcu_idx = lock_lsm();
+	FOR_EACH_SECURITY_HOOK_MUTABLE(hp, task_prctl) {
 		thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
 		if (thisrc != -ENOSYS) {
 			rc = thisrc;

@@ -1134,6 +1342,9 @@ int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 				break;
 		}
 	}
+	unlock_lsm(srcu_idx);
+
+out:
 	return rc;
 }
 

@@ -1614,10 +1825,11 @@ int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
 }
 
 int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
-				       struct xfrm_policy *xp,
-				       const struct flowi *fl)
+						struct xfrm_policy *xp,
+						const struct flowi *fl)
 {
 	struct security_hook_list *hp;
+	int srcu_idx;
 	int rc = 1;
 
 	/*

@@ -1629,11 +1841,21 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
 	 * For speed optimization, we explicitly break the loop rather than
 	 * using the macro
 	 */
-	hlist_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
-				list) {
+
+
+	FOR_EACH_SECURITY_HOOK(hp, xfrm_state_pol_flow_match) {
+		rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
+		goto out;
+	}
+
+	srcu_idx = lock_lsm();
+	FOR_EACH_SECURITY_HOOK_MUTABLE(hp, xfrm_state_pol_flow_match) {
 		rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
 		break;
 	}
+	unlock_lsm(srcu_idx);
+
+out:
 	return rc;
 }
 

@@ -6396,234 +6396,260 @@ static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
 }
 #endif
 
-static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
-	LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
-	LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
-	LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
-	LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
-
-	LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
-	LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
-	LSM_HOOK_INIT(capget, selinux_capget),
-	LSM_HOOK_INIT(capset, selinux_capset),
-	LSM_HOOK_INIT(capable, selinux_capable),
-	LSM_HOOK_INIT(quotactl, selinux_quotactl),
-	LSM_HOOK_INIT(quota_on, selinux_quota_on),
-	LSM_HOOK_INIT(syslog, selinux_syslog),
-	LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
-
-	LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
-
-	LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
-	LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
-	LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
-
-	LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
-	LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
-	LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
-	LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
-	LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
-	LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
-	LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
-	LSM_HOOK_INIT(sb_mount, selinux_mount),
-	LSM_HOOK_INIT(sb_umount, selinux_umount),
-	LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
-	LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
-	LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
-
-	LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
-	LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
-
-	LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
-	LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
-	LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
-	LSM_HOOK_INIT(inode_create, selinux_inode_create),
-	LSM_HOOK_INIT(inode_link, selinux_inode_link),
-	LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
-	LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
-	LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
-	LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
-	LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
-	LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
-	LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
-	LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
-	LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
-	LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
-	LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
-	LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
-	LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
-	LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
-	LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
-	LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
-	LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
-	LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
-	LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
-	LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
-	LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
-	LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
-
-	LSM_HOOK_INIT(file_permission, selinux_file_permission),
-	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
-	LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
-	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
-	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
-	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
-	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
-	LSM_HOOK_INIT(file_lock, selinux_file_lock),
-	LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
-	LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
-	LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
-	LSM_HOOK_INIT(file_receive, selinux_file_receive),
-
-	LSM_HOOK_INIT(file_open, selinux_file_open),
-
-	LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
-	LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
-	LSM_HOOK_INIT(cred_free, selinux_cred_free),
-	LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
-	LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
-	LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
-	LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
-	LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
-	LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
-	LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
-	LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
-	LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
-	LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
-	LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
-	LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
-	LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
-	LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
-	LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
-	LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
-	LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
-	LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
-	LSM_HOOK_INIT(task_kill, selinux_task_kill),
-	LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
-
-	LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
-	LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
-
-	LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
-	LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
-
-	LSM_HOOK_INIT(msg_queue_alloc_security,
+#ifdef CONFIG_SECURITY_SELINUX_DISABLE
+#define __selinux_ro_after_init
+#define SELINUX_HOOK_INIT	LSM_HOOK_INIT_MUTABLE
+#else
+#define __selinux_ro_after_init	__lsm_ro_after_init
+#define SELINUX_HOOK_INIT	LSM_HOOK_INIT
+#endif
+
+static struct security_hook_list selinux_hooks[] __selinux_ro_after_init = {
+	SELINUX_HOOK_INIT(binder_set_context_mgr,
+				selinux_binder_set_context_mgr),
+	SELINUX_HOOK_INIT(binder_transaction, selinux_binder_transaction),
+	SELINUX_HOOK_INIT(binder_transfer_binder,
+				selinux_binder_transfer_binder),
+	SELINUX_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
+
+	SELINUX_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
+	SELINUX_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
+	SELINUX_HOOK_INIT(capget, selinux_capget),
+	SELINUX_HOOK_INIT(capset, selinux_capset),
+	SELINUX_HOOK_INIT(capable, selinux_capable),
+	SELINUX_HOOK_INIT(quotactl, selinux_quotactl),
+	SELINUX_HOOK_INIT(quota_on, selinux_quota_on),
+	SELINUX_HOOK_INIT(syslog, selinux_syslog),
+	SELINUX_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
+
+	SELINUX_HOOK_INIT(netlink_send, selinux_netlink_send),
+
+	SELINUX_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
+	SELINUX_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
+	SELINUX_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
+
+	SELINUX_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
+	SELINUX_HOOK_INIT(sb_free_security, selinux_sb_free_security),
+	SELINUX_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
+	SELINUX_HOOK_INIT(sb_remount, selinux_sb_remount),
+	SELINUX_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
+	SELINUX_HOOK_INIT(sb_show_options, selinux_sb_show_options),
+	SELINUX_HOOK_INIT(sb_statfs, selinux_sb_statfs),
+	SELINUX_HOOK_INIT(sb_mount, selinux_mount),
+	SELINUX_HOOK_INIT(sb_umount, selinux_umount),
+	SELINUX_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
+	SELINUX_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
+	SELINUX_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
+
+	SELINUX_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
+	SELINUX_HOOK_INIT(dentry_create_files_as,
+				selinux_dentry_create_files_as),
+
+	SELINUX_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
+	SELINUX_HOOK_INIT(inode_free_security, selinux_inode_free_security),
+	SELINUX_HOOK_INIT(inode_init_security, selinux_inode_init_security),
+	SELINUX_HOOK_INIT(inode_create, selinux_inode_create),
+	SELINUX_HOOK_INIT(inode_link, selinux_inode_link),
+	SELINUX_HOOK_INIT(inode_unlink, selinux_inode_unlink),
+	SELINUX_HOOK_INIT(inode_symlink, selinux_inode_symlink),
+	SELINUX_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
+	SELINUX_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
+	SELINUX_HOOK_INIT(inode_mknod, selinux_inode_mknod),
+	SELINUX_HOOK_INIT(inode_rename, selinux_inode_rename),
+	SELINUX_HOOK_INIT(inode_readlink, selinux_inode_readlink),
+	SELINUX_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
+	SELINUX_HOOK_INIT(inode_permission, selinux_inode_permission),
+	SELINUX_HOOK_INIT(inode_setattr, selinux_inode_setattr),
+	SELINUX_HOOK_INIT(inode_getattr, selinux_inode_getattr),
+	SELINUX_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
+	SELINUX_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
+	SELINUX_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
+	SELINUX_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
+	SELINUX_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
+	SELINUX_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
+	SELINUX_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
+	SELINUX_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
+	SELINUX_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
+	SELINUX_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
+	SELINUX_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
+
+	SELINUX_HOOK_INIT(file_permission, selinux_file_permission),
+	SELINUX_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
+	SELINUX_HOOK_INIT(file_free_security, selinux_file_free_security),
+	SELINUX_HOOK_INIT(file_ioctl, selinux_file_ioctl),
+	SELINUX_HOOK_INIT(mmap_file, selinux_mmap_file),
+	SELINUX_HOOK_INIT(mmap_addr, selinux_mmap_addr),
+	SELINUX_HOOK_INIT(file_mprotect, selinux_file_mprotect),
+	SELINUX_HOOK_INIT(file_lock, selinux_file_lock),
+	SELINUX_HOOK_INIT(file_fcntl, selinux_file_fcntl),
+	SELINUX_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
+	SELINUX_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
+	SELINUX_HOOK_INIT(file_receive, selinux_file_receive),
+
+	SELINUX_HOOK_INIT(file_open, selinux_file_open),
+
+	SELINUX_HOOK_INIT(task_alloc, selinux_task_alloc),
+	SELINUX_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
+	SELINUX_HOOK_INIT(cred_free, selinux_cred_free),
+	SELINUX_HOOK_INIT(cred_prepare, selinux_cred_prepare),
+	SELINUX_HOOK_INIT(cred_transfer, selinux_cred_transfer),
+	SELINUX_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
+	SELINUX_HOOK_INIT(kernel_create_files_as,
+				selinux_kernel_create_files_as),
+	SELINUX_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
+	SELINUX_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
+	SELINUX_HOOK_INIT(task_setpgid, selinux_task_setpgid),
+	SELINUX_HOOK_INIT(task_getpgid, selinux_task_getpgid),
+	SELINUX_HOOK_INIT(task_getsid, selinux_task_getsid),
+	SELINUX_HOOK_INIT(task_getsecid, selinux_task_getsecid),
+	SELINUX_HOOK_INIT(task_setnice, selinux_task_setnice),
+	SELINUX_HOOK_INIT(task_setioprio, selinux_task_setioprio),
+	SELINUX_HOOK_INIT(task_getioprio, selinux_task_getioprio),
+	SELINUX_HOOK_INIT(task_prlimit, selinux_task_prlimit),
+	SELINUX_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
+	SELINUX_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
+	SELINUX_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
+	SELINUX_HOOK_INIT(task_movememory, selinux_task_movememory),
+	SELINUX_HOOK_INIT(task_kill, selinux_task_kill),
+	SELINUX_HOOK_INIT(task_to_inode, selinux_task_to_inode),
+
+	SELINUX_HOOK_INIT(ipc_permission, selinux_ipc_permission),
+	SELINUX_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
+
+	SELINUX_HOOK_INIT(msg_msg_alloc_security,
+				selinux_msg_msg_alloc_security),
+	SELINUX_HOOK_INIT(msg_msg_free_security,
+				selinux_msg_msg_free_security),
+
+	SELINUX_HOOK_INIT(msg_queue_alloc_security,
 			selinux_msg_queue_alloc_security),
-	LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
-	LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
-	LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
-	LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
-	LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
-
-	LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
-	LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
-	LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
-	LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
-	LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
-
-	LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
-	LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
-	LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
-	LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
-	LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
-
-	LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
-
-	LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
-	LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
-
-	LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
-	LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
-	LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
-	LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
-	LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
-	LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
-	LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
-	LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
-
-	LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
-	LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
-
-	LSM_HOOK_INIT(socket_create, selinux_socket_create),
-	LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
-	LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
-	LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
-	LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
-	LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
-	LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
-	LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
-	LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
-	LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
-	LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
-	LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
-	LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
-	LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
-	LSM_HOOK_INIT(socket_getpeersec_stream,
+	SELINUX_HOOK_INIT(msg_queue_free_security,
+				selinux_msg_queue_free_security),
+	SELINUX_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
+	SELINUX_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
+	SELINUX_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
+	SELINUX_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
+
+	SELINUX_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
+	SELINUX_HOOK_INIT(shm_free_security, selinux_shm_free_security),
+	SELINUX_HOOK_INIT(shm_associate, selinux_shm_associate),
+	SELINUX_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
+	SELINUX_HOOK_INIT(shm_shmat, selinux_shm_shmat),
+
+	SELINUX_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
+	SELINUX_HOOK_INIT(sem_free_security, selinux_sem_free_security),
+	SELINUX_HOOK_INIT(sem_associate, selinux_sem_associate),
+	SELINUX_HOOK_INIT(sem_semctl, selinux_sem_semctl),
+	SELINUX_HOOK_INIT(sem_semop, selinux_sem_semop),
+
+	SELINUX_HOOK_INIT(d_instantiate, selinux_d_instantiate),
+
+	SELINUX_HOOK_INIT(getprocattr, selinux_getprocattr),
+	SELINUX_HOOK_INIT(setprocattr, selinux_setprocattr),
+
+	SELINUX_HOOK_INIT(ismaclabel, selinux_ismaclabel),
+	SELINUX_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
+	SELINUX_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
+	SELINUX_HOOK_INIT(release_secctx, selinux_release_secctx),
+	SELINUX_HOOK_INIT(inode_invalidate_secctx,
+				selinux_inode_invalidate_secctx),
+	SELINUX_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
+	SELINUX_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
+	SELINUX_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
+
+	SELINUX_HOOK_INIT(unix_stream_connect,
+				selinux_socket_unix_stream_connect),
+	SELINUX_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
+
+	SELINUX_HOOK_INIT(socket_create, selinux_socket_create),
+	SELINUX_HOOK_INIT(socket_post_create, selinux_socket_post_create),
+	SELINUX_HOOK_INIT(socket_bind, selinux_socket_bind),
+	SELINUX_HOOK_INIT(socket_connect, selinux_socket_connect),
+	SELINUX_HOOK_INIT(socket_listen, selinux_socket_listen),
+	SELINUX_HOOK_INIT(socket_accept, selinux_socket_accept),
+	SELINUX_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
+	SELINUX_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
+	SELINUX_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
+	SELINUX_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
+	SELINUX_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
+	SELINUX_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
+	SELINUX_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
+	SELINUX_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
+	SELINUX_HOOK_INIT(socket_getpeersec_stream,
 			selinux_socket_getpeersec_stream),
-	LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
-	LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
-	LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
-	LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
-	LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
-	LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
-	LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
-	LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
-	LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
-	LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
-	LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
-	LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
-	LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
-	LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
-	LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
-	LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
-	LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
-	LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
-	LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
+	SELINUX_HOOK_INIT(socket_getpeersec_dgram,
+				selinux_socket_getpeersec_dgram),
+	SELINUX_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
+	SELINUX_HOOK_INIT(sk_free_security, selinux_sk_free_security),
+	SELINUX_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
+	SELINUX_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
+	SELINUX_HOOK_INIT(sock_graft, selinux_sock_graft),
+	SELINUX_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
+	SELINUX_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
+	SELINUX_HOOK_INIT(inet_conn_established,
+				selinux_inet_conn_established),
+	SELINUX_HOOK_INIT(secmark_relabel_packet,
+				selinux_secmark_relabel_packet),
+	SELINUX_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
+	SELINUX_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
+	SELINUX_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
+	SELINUX_HOOK_INIT(tun_dev_alloc_security,
+				selinux_tun_dev_alloc_security),
+	SELINUX_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
+	SELINUX_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
+	SELINUX_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
+	SELINUX_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
+	SELINUX_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
 #ifdef CONFIG_SECURITY_INFINIBAND
-	LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
-	LSM_HOOK_INIT(ib_endport_manage_subnet,
+	SELINUX_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
+	SELINUX_HOOK_INIT(ib_endport_manage_subnet,
 		      selinux_ib_endport_manage_subnet),
-	LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
-	LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
+	SELINUX_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
+	SELINUX_HOOK_INIT(ib_free_security, selinux_ib_free_security),
 #endif
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
-	LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
-	LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
-	LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
-	LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
-	LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
-	LSM_HOOK_INIT(xfrm_state_alloc_acquire,
+	SELINUX_HOOK_INIT(xfrm_policy_alloc_security,
+				selinux_xfrm_policy_alloc),
+	SELINUX_HOOK_INIT(xfrm_policy_clone_security,
+				selinux_xfrm_policy_clone),
+	SELINUX_HOOK_INIT(xfrm_policy_free_security,
+				selinux_xfrm_policy_free),
+	SELINUX_HOOK_INIT(xfrm_policy_delete_security,
+				selinux_xfrm_policy_delete),
+	SELINUX_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
+	SELINUX_HOOK_INIT(xfrm_state_alloc_acquire,
 			selinux_xfrm_state_alloc_acquire),
-	LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
-	LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
-	LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
-	LSM_HOOK_INIT(xfrm_state_pol_flow_match,
+	SELINUX_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
+	SELINUX_HOOK_INIT(xfrm_state_delete_security,
+				selinux_xfrm_state_delete),
+	SELINUX_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
+	SELINUX_HOOK_INIT(xfrm_state_pol_flow_match,
 			selinux_xfrm_state_pol_flow_match),
-	LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
+	SELINUX_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
 #endif
 
 #ifdef CONFIG_KEYS
-	LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
-	LSM_HOOK_INIT(key_free, selinux_key_free),
-	LSM_HOOK_INIT(key_permission, selinux_key_permission),
-	LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
+	SELINUX_HOOK_INIT(key_alloc, selinux_key_alloc),
+	SELINUX_HOOK_INIT(key_free, selinux_key_free),
+	SELINUX_HOOK_INIT(key_permission, selinux_key_permission),
+	SELINUX_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
 #endif
 
 #ifdef CONFIG_AUDIT
-	LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
-	LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
-	LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
-	LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
+	SELINUX_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
+	SELINUX_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
+	SELINUX_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
+	SELINUX_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
 #endif
 
 #ifdef CONFIG_BPF_SYSCALL
-	LSM_HOOK_INIT(bpf, selinux_bpf),
-	LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
-	LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
-	LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
-	LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
-	LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
-	LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
+	SELINUX_HOOK_INIT(bpf, selinux_bpf),
+	SELINUX_HOOK_INIT(bpf_map, selinux_bpf_map),
+	SELINUX_HOOK_INIT(bpf_prog, selinux_bpf_prog),
+	SELINUX_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
+	SELINUX_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
+	SELINUX_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
+	SELINUX_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
 #endif
 };