[PATCH 35/97] NET: Remove scaffolding on new secmarks
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2019-02-28 22:20:40
Also in:
selinux
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Replace the lsm_export scaffolding in nft_meta. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- net/netfilter/nft_meta.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index a03de2ab833a..9f5040140fe0 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c@@ -568,11 +568,17 @@ static int nft_secmark_compute_secid(struct nft_secmark *priv) u32 tmp_secid = 0; int err; + lsm_export_init(&le); err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &le); if (err) return err; - lsm_export_secid(&le, &tmp_secid); + /* Use the "best" secid */ + if (le.selinux) + tmp_secid = le.selinux; + else + tmp_secid = le.smack; + if (!tmp_secid) return -ENOENT;
--
2.17.0