SELinux: Only store the network interface's ifindex

Instead of storing the packet's network interface name store the ifindex.  This
allows us to defer the need to lookup the net_device structure until the audit
record is generated meaning that in the majority of cases we never need to
bother with this at all.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 81b3dff3cbf0597a4b7464ee9d6f3fdcd121d2b8..e8529e2f51e5ba24042ccd88b77e481c9457a5aa 100644 (file)
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -661,9 +661,18 @@ void avc_audit(u32 ssid, u32 tsid,
                                                    "daddr", "dest");
                                break;
                        }
-                       if (a->u.net.netif)
-                               audit_log_format(ab, " netif=%s",
-                                       a->u.net.netif);
+                       if (a->u.net.netif > 0) {
+                               struct net_device *dev;
+
+                               /* NOTE: we always use init's namespace */
+                               dev = dev_get_by_index(&init_net,
+                                                      a->u.net.netif);
+                               if (dev) {
+                                       audit_log_format(ab, " netif=%s",
+                                                        dev->name);
+                                       dev_put(dev);
+                               }
+                       }
                        break;
                }
        }

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index be544332214cad604c01f4cb8c0052f1ee3a294a..1a1fa3f20ef0db9a750d2eae517a5d347e984192 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3928,7 +3928,7 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                family = PF_INET;
 
        AVC_AUDIT_DATA_INIT(&ad, NET);
-       ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
+       ad.u.net.netif = skb->iif;
        ad.u.net.family = family;
 
        err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
@@ -4259,7 +4259,7 @@ static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
        sksec = sk->sk_security;
 
        AVC_AUDIT_DATA_INIT(&ad, NET);
-       ad.u.net.netif = dev->name;
+       ad.u.net.netif = dev->ifindex;
        ad.u.net.family = family;
 
        err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);

diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 553607a19e92f7e957cb4f5f05fd4f61465fd3d1..80c28fa6621c78527a23ee3fa8f9aa3e20ec6d55 100644 (file)
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -51,7 +51,7 @@ struct avc_audit_data {
                        struct inode *inode;
                } fs;
                struct {
-                       char *netif;
+                       int netif;
                        struct sock *sk;
                        u16 family;
                        __be16 dport;