openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

selinux: clean up avc node cache when disabling selinux 

Added a call to free the avc_node_cache when inside selinux_disable because
it should not waste resources allocated during avc_init if SELinux is disabled
and the cache will never be used.

Signed-off-by: Thomas Liu <tliu@redhat.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Thomas Liu 2009-06-24 17:58:05 -04:00 committed by James Morris
parent a893a84e87
commit 89c86576ec
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
security/selinux/avc.c
View File

@ -970,3 +970,9 @@ u32 avc_policy_seqno(void)
{
return avc_cache.latest_notif;
}
void avc_disable(void)
{
if (avc_node_cachep)
kmem_cache_destroy(avc_node_cachep);
}

3
security/selinux/hooks.c
View File

@ -5683,6 +5683,9 @@ int selinux_disable(void)
selinux_disabled = 1;
selinux_enabled = 0;
/* Try to destroy the avc node cache */
avc_disable();
/* Reset security_ops to the secondary module, dummy or capability. */
security_ops = secondary_ops;

3
security/selinux/include/avc.h
View File

@ -131,6 +131,9 @@ int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid,
int avc_get_hash_stats(char *page);
extern unsigned int avc_cache_threshold;
/* Attempt to free avc node cache */
void avc_disable(void);
#ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
DECLARE_PER_CPU(struct avc_cache_stats, avc_cache_stats);
#endif