| Message ID | 20250409185019.238841-51-paul@paul-moore.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Rework the LSM initialization | expand |
On Wed, Apr 09, 2025 at 02:50:05PM -0400, Paul Moore wrote: > As the LSM framework only supports one LSM initcall callback for each > initcall type, the init_smk_fs() and smack_nf_ip_init() functions were > wrapped with a new function, smack_initcall() that is registered with > the LSM framework. > > Signed-off-by: Paul Moore <paul@paul-moore.com> > --- > security/smack/smack.h | 6 ++++++ > security/smack/smack_lsm.c | 16 ++++++++++++++++ > security/smack/smack_netfilter.c | 4 +--- > security/smack/smackfs.c | 4 +--- > 4 files changed, 24 insertions(+), 6 deletions(-) > > diff --git a/security/smack/smack.h b/security/smack/smack.h > index bf6a6ed3946c..709e0d6cd5e1 100644 > --- a/security/smack/smack.h > +++ b/security/smack/smack.h > @@ -275,6 +275,12 @@ struct smk_audit_info { > #endif > }; > > +/* > + * Initialization > + */ > +int init_smk_fs(void); > +int smack_nf_ip_init(void); > + > /* > * These functions are in smack_access.c > */ > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index e09b33fed5f0..80b129a0c92c 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -5277,6 +5277,21 @@ static __init int smack_init(void) > return 0; > } > > +static int smack_initcall(void) > +{ > + int rc, rc_tmp; > + > + rc_tmp = init_smk_fs(); > + if (rc_tmp) > + rc = rc_tmp; > + > + rc_tmp = smack_nf_ip_init(); > + if (!rc && rc_tmp) > + rc = rc_tmp; > + > + return rc; > +} This retains the existing behavior, but I think it'd be better to evaluate if the init_smk_fs() call can be tied to the fs init hook instead, yes? Then no new helper is needed, etc. -Kees > + > /* > * Smack requires early initialization in order to label > * all processes and objects when they are created. > @@ -5286,4 +5301,5 @@ DEFINE_LSM(smack) = { > .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, > .blobs = &smack_blob_sizes, > .init = smack_init, > + .initcall_device = smack_initcall, > }; > diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c > index 8fd747b3653a..17ba578b1308 100644 > --- a/security/smack/smack_netfilter.c > +++ b/security/smack/smack_netfilter.c > @@ -68,7 +68,7 @@ static struct pernet_operations smack_net_ops = { > .exit = smack_nf_unregister, > }; > > -static int __init smack_nf_ip_init(void) > +int __init smack_nf_ip_init(void) > { > if (smack_enabled == 0) > return 0; > @@ -76,5 +76,3 @@ static int __init smack_nf_ip_init(void) > printk(KERN_DEBUG "Smack: Registering netfilter hooks\n"); > return register_pernet_subsys(&smack_net_ops); > } > - > -__initcall(smack_nf_ip_init); > diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c > index 90a67e410808..d33dd0368807 100644 > --- a/security/smack/smackfs.c > +++ b/security/smack/smackfs.c > @@ -2980,7 +2980,7 @@ static struct vfsmount *smackfs_mount; > * Returns true if we were not chosen on boot or if > * we were chosen and filesystem registration succeeded. > */ > -static int __init init_smk_fs(void) > +int __init init_smk_fs(void) > { > int err; > int rc; > @@ -3023,5 +3023,3 @@ static int __init init_smk_fs(void) > > return err; > } > - > -__initcall(init_smk_fs); > -- > 2.49.0 >
On 4/9/2025 11:50 AM, Paul Moore wrote: > As the LSM framework only supports one LSM initcall callback for each > initcall type, the init_smk_fs() and smack_nf_ip_init() functions were > wrapped with a new function, smack_initcall() that is registered with > the LSM framework. > > Signed-off-by: Paul Moore <paul@paul-moore.com> > --- > security/smack/smack.h | 6 ++++++ > security/smack/smack_lsm.c | 16 ++++++++++++++++ > security/smack/smack_netfilter.c | 4 +--- > security/smack/smackfs.c | 4 +--- > 4 files changed, 24 insertions(+), 6 deletions(-) > > diff --git a/security/smack/smack.h b/security/smack/smack.h > index bf6a6ed3946c..709e0d6cd5e1 100644 > --- a/security/smack/smack.h > +++ b/security/smack/smack.h > @@ -275,6 +275,12 @@ struct smk_audit_info { > #endif > }; > > +/* > + * Initialization > + */ > +int init_smk_fs(void); > +int smack_nf_ip_init(void); > + > /* > * These functions are in smack_access.c > */ > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index e09b33fed5f0..80b129a0c92c 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -5277,6 +5277,21 @@ static __init int smack_init(void) > return 0; > } > > +static int smack_initcall(void) > +{ > + int rc, rc_tmp; separate lines for the declarations please. > + > + rc_tmp = init_smk_fs(); > + if (rc_tmp) > + rc = rc_tmp; Replace these three lines with: + rc = init_smk_fs(); > + > + rc_tmp = smack_nf_ip_init(); > + if (!rc && rc_tmp) > + rc = rc_tmp; Change this to + rc_tmp = smack_nf_ip_init(); + return rc ? rc : rc_tmp; Also change rc_tmp to rc_nf and rc to rc_fs. > + > + return rc; > +} > + Or: static int smack_initcall(void) { int rc_fs = init_smk_fs(); int rc_nf = smack_nf_ip_init(); return rc_fs ? rc_fs : rc:nf; } > /* > * Smack requires early initialization in order to label > * all processes and objects when they are created. > @@ -5286,4 +5301,5 @@ DEFINE_LSM(smack) = { > .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, > .blobs = &smack_blob_sizes, > .init = smack_init, > + .initcall_device = smack_initcall, > }; > diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c > index 8fd747b3653a..17ba578b1308 100644 > --- a/security/smack/smack_netfilter.c > +++ b/security/smack/smack_netfilter.c > @@ -68,7 +68,7 @@ static struct pernet_operations smack_net_ops = { > .exit = smack_nf_unregister, > }; > > -static int __init smack_nf_ip_init(void) > +int __init smack_nf_ip_init(void) > { > if (smack_enabled == 0) > return 0; > @@ -76,5 +76,3 @@ static int __init smack_nf_ip_init(void) > printk(KERN_DEBUG "Smack: Registering netfilter hooks\n"); > return register_pernet_subsys(&smack_net_ops); > } > - > -__initcall(smack_nf_ip_init); > diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c > index 90a67e410808..d33dd0368807 100644 > --- a/security/smack/smackfs.c > +++ b/security/smack/smackfs.c > @@ -2980,7 +2980,7 @@ static struct vfsmount *smackfs_mount; > * Returns true if we were not chosen on boot or if > * we were chosen and filesystem registration succeeded. > */ > -static int __init init_smk_fs(void) > +int __init init_smk_fs(void) > { > int err; > int rc; > @@ -3023,5 +3023,3 @@ static int __init init_smk_fs(void) > > return err; > } > - > -__initcall(init_smk_fs);
On 4/10/2025 10:30 AM, Casey Schaufler wrote: > On 4/9/2025 11:50 AM, Paul Moore wrote: >> As the LSM framework only supports one LSM initcall callback for each >> initcall type, the init_smk_fs() and smack_nf_ip_init() functions were >> wrapped with a new function, smack_initcall() that is registered with >> the LSM framework. >> >> Signed-off-by: Paul Moore <paul@paul-moore.com> >> --- >> security/smack/smack.h | 6 ++++++ >> security/smack/smack_lsm.c | 16 ++++++++++++++++ >> security/smack/smack_netfilter.c | 4 +--- >> security/smack/smackfs.c | 4 +--- >> 4 files changed, 24 insertions(+), 6 deletions(-) >> >> diff --git a/security/smack/smack.h b/security/smack/smack.h >> index bf6a6ed3946c..709e0d6cd5e1 100644 >> --- a/security/smack/smack.h >> +++ b/security/smack/smack.h >> @@ -275,6 +275,12 @@ struct smk_audit_info { >> #endif >> }; >> >> +/* >> + * Initialization >> + */ >> +int init_smk_fs(void); >> +int smack_nf_ip_init(void); >> + >> /* >> * These functions are in smack_access.c >> */ >> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c >> index e09b33fed5f0..80b129a0c92c 100644 >> --- a/security/smack/smack_lsm.c >> +++ b/security/smack/smack_lsm.c >> @@ -5277,6 +5277,21 @@ static __init int smack_init(void) >> return 0; >> } >> >> +static int smack_initcall(void) >> +{ >> + int rc, rc_tmp; > separate lines for the declarations please. > >> + >> + rc_tmp = init_smk_fs(); >> + if (rc_tmp) >> + rc = rc_tmp; > Replace these three lines with: > > + rc = init_smk_fs(); > >> + >> + rc_tmp = smack_nf_ip_init(); >> + if (!rc && rc_tmp) >> + rc = rc_tmp; > Change this to > > + rc_tmp = smack_nf_ip_init(); > + return rc ? rc : rc_tmp; > > Also change rc_tmp to rc_nf and rc to rc_fs. > >> + >> + return rc; >> +} >> + > Or: > > static int smack_initcall(void) > { > int rc_fs = init_smk_fs(); > int rc_nf = smack_nf_ip_init(); > > return rc_fs ? rc_fs : rc:nf; Whoops - return rc_fs ? rc_fs : rc_nf; > } > >> /* >> * Smack requires early initialization in order to label >> * all processes and objects when they are created. >> @@ -5286,4 +5301,5 @@ DEFINE_LSM(smack) = { >> .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, >> .blobs = &smack_blob_sizes, >> .init = smack_init, >> + .initcall_device = smack_initcall, >> }; >> diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c >> index 8fd747b3653a..17ba578b1308 100644 >> --- a/security/smack/smack_netfilter.c >> +++ b/security/smack/smack_netfilter.c >> @@ -68,7 +68,7 @@ static struct pernet_operations smack_net_ops = { >> .exit = smack_nf_unregister, >> }; >> >> -static int __init smack_nf_ip_init(void) >> +int __init smack_nf_ip_init(void) >> { >> if (smack_enabled == 0) >> return 0; >> @@ -76,5 +76,3 @@ static int __init smack_nf_ip_init(void) >> printk(KERN_DEBUG "Smack: Registering netfilter hooks\n"); >> return register_pernet_subsys(&smack_net_ops); >> } >> - >> -__initcall(smack_nf_ip_init); >> diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c >> index 90a67e410808..d33dd0368807 100644 >> --- a/security/smack/smackfs.c >> +++ b/security/smack/smackfs.c >> @@ -2980,7 +2980,7 @@ static struct vfsmount *smackfs_mount; >> * Returns true if we were not chosen on boot or if >> * we were chosen and filesystem registration succeeded. >> */ >> -static int __init init_smk_fs(void) >> +int __init init_smk_fs(void) >> { >> int err; >> int rc; >> @@ -3023,5 +3023,3 @@ static int __init init_smk_fs(void) >> >> return err; >> } >> - >> -__initcall(init_smk_fs);
On Wed, Apr 9, 2025 at 7:42 PM Kees Cook <kees@kernel.org> wrote: > On Wed, Apr 09, 2025 at 02:50:05PM -0400, Paul Moore wrote: > > As the LSM framework only supports one LSM initcall callback for each > > initcall type, the init_smk_fs() and smack_nf_ip_init() functions were > > wrapped with a new function, smack_initcall() that is registered with > > the LSM framework. > > > > Signed-off-by: Paul Moore <paul@paul-moore.com> > > --- > > security/smack/smack.h | 6 ++++++ > > security/smack/smack_lsm.c | 16 ++++++++++++++++ > > security/smack/smack_netfilter.c | 4 +--- > > security/smack/smackfs.c | 4 +--- > > 4 files changed, 24 insertions(+), 6 deletions(-) ... > > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > > index e09b33fed5f0..80b129a0c92c 100644 > > --- a/security/smack/smack_lsm.c > > +++ b/security/smack/smack_lsm.c > > @@ -5277,6 +5277,21 @@ static __init int smack_init(void) > > return 0; > > } > > > > +static int smack_initcall(void) > > +{ > > + int rc, rc_tmp; > > + > > + rc_tmp = init_smk_fs(); > > + if (rc_tmp) > > + rc = rc_tmp; > > + > > + rc_tmp = smack_nf_ip_init(); > > + if (!rc && rc_tmp) > > + rc = rc_tmp; > > + > > + return rc; > > +} > > This retains the existing behavior, but I think it'd be better to > evaluate if the init_smk_fs() call can be tied to the fs init hook > instead, yes? Then no new helper is needed, etc. When doing this work I spotted a few LSMs where I think we could consolidate multiple initcall types into one (or two?), but there was enough in this patchset already I decided to leave that for another day.
On Thu, Apr 10, 2025 at 1:30 PM Casey Schaufler <casey@schaufler-ca.com> wrote: > On 4/9/2025 11:50 AM, Paul Moore wrote: > > As the LSM framework only supports one LSM initcall callback for each > > initcall type, the init_smk_fs() and smack_nf_ip_init() functions were > > wrapped with a new function, smack_initcall() that is registered with > > the LSM framework. > > > > Signed-off-by: Paul Moore <paul@paul-moore.com> > > --- > > security/smack/smack.h | 6 ++++++ > > security/smack/smack_lsm.c | 16 ++++++++++++++++ > > security/smack/smack_netfilter.c | 4 +--- > > security/smack/smackfs.c | 4 +--- > > 4 files changed, 24 insertions(+), 6 deletions(-) > > > > diff --git a/security/smack/smack.h b/security/smack/smack.h > > index bf6a6ed3946c..709e0d6cd5e1 100644 > > --- a/security/smack/smack.h > > +++ b/security/smack/smack.h > > @@ -275,6 +275,12 @@ struct smk_audit_info { > > #endif > > }; > > > > +/* > > + * Initialization > > + */ > > +int init_smk_fs(void); > > +int smack_nf_ip_init(void); > > + > > /* > > * These functions are in smack_access.c > > */ > > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > > index e09b33fed5f0..80b129a0c92c 100644 > > --- a/security/smack/smack_lsm.c > > +++ b/security/smack/smack_lsm.c > > @@ -5277,6 +5277,21 @@ static __init int smack_init(void) > > return 0; > > } > > > > +static int smack_initcall(void) > > +{ > > + int rc, rc_tmp; > > separate lines for the declarations please. Done. > > + rc_tmp = init_smk_fs(); > > + if (rc_tmp) > > + rc = rc_tmp; > > Replace these three lines with: > > + rc = init_smk_fs(); Done. > > + > > + rc_tmp = smack_nf_ip_init(); > > + if (!rc && rc_tmp) > > + rc = rc_tmp; > > Change this to > > + rc_tmp = smack_nf_ip_init(); > + return rc ? rc : rc_tmp; > > Also change rc_tmp to rc_nf and rc to rc_fs. Done and done. > > + > > + return rc; > > +} > > + > > Or: > > static int smack_initcall(void) > { > int rc_fs = init_smk_fs(); > int rc_nf = smack_nf_ip_init(); > > return rc_fs ? rc_fs : rc:nf; > } Done (with the typo fix you mentioned later). Thanks for taking a look. -- paul-moore.com
On Wed, Apr 9, 2025 at 11:53 AM Paul Moore <paul@paul-moore.com> wrote: > > As the LSM framework only supports one LSM initcall callback for each > initcall type, the init_smk_fs() and smack_nf_ip_init() functions were > wrapped with a new function, smack_initcall() that is registered with > the LSM framework. > > Signed-off-by: Paul Moore <paul@paul-moore.com> > --- > security/smack/smack.h | 6 ++++++ > security/smack/smack_lsm.c | 16 ++++++++++++++++ > security/smack/smack_netfilter.c | 4 +--- > security/smack/smackfs.c | 4 +--- > 4 files changed, 24 insertions(+), 6 deletions(-) > > diff --git a/security/smack/smack.h b/security/smack/smack.h > index bf6a6ed3946c..709e0d6cd5e1 100644 > --- a/security/smack/smack.h > +++ b/security/smack/smack.h > @@ -275,6 +275,12 @@ struct smk_audit_info { > #endif > }; > > +/* > + * Initialization > + */ > +int init_smk_fs(void); > +int smack_nf_ip_init(void); > + > /* > * These functions are in smack_access.c > */ > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index e09b33fed5f0..80b129a0c92c 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -5277,6 +5277,21 @@ static __init int smack_init(void) > return 0; > } > > +static int smack_initcall(void) > +{ > + int rc, rc_tmp; > + > + rc_tmp = init_smk_fs(); > + if (rc_tmp) > + rc = rc_tmp; > + > + rc_tmp = smack_nf_ip_init(); > + if (!rc && rc_tmp) > + rc = rc_tmp; > + > + return rc; > +} > + > /* > * Smack requires early initialization in order to label > * all processes and objects when they are created. > @@ -5286,4 +5301,5 @@ DEFINE_LSM(smack) = { > .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, > .blobs = &smack_blob_sizes, > .init = smack_init, > + .initcall_device = smack_initcall, > }; > diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c > index 8fd747b3653a..17ba578b1308 100644 > --- a/security/smack/smack_netfilter.c > +++ b/security/smack/smack_netfilter.c > @@ -68,7 +68,7 @@ static struct pernet_operations smack_net_ops = { > .exit = smack_nf_unregister, > }; > > -static int __init smack_nf_ip_init(void) > +int __init smack_nf_ip_init(void) > { > if (smack_enabled == 0) > return 0; > @@ -76,5 +76,3 @@ static int __init smack_nf_ip_init(void) > printk(KERN_DEBUG "Smack: Registering netfilter hooks\n"); > return register_pernet_subsys(&smack_net_ops); > } > - > -__initcall(smack_nf_ip_init); > diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c > index 90a67e410808..d33dd0368807 100644 > --- a/security/smack/smackfs.c > +++ b/security/smack/smackfs.c > @@ -2980,7 +2980,7 @@ static struct vfsmount *smackfs_mount; > * Returns true if we were not chosen on boot or if > * we were chosen and filesystem registration succeeded. > */ > -static int __init init_smk_fs(void) > +int __init init_smk_fs(void) > { > int err; > int rc; > @@ -3023,5 +3023,3 @@ static int __init init_smk_fs(void) > > return err; > } > - > -__initcall(init_smk_fs); > -- > 2.49.0 > I'm getting the following WARNING: WARNING: modpost: vmlinux: section mismatch in reference: smack_initcall+0xb (section: .text) -> init_smk_fs (section: .init.text) WARNING: modpost: vmlinux: section mismatch in reference: smack_initcall+0x16 (section: .text) -> smack_nf_ip_init (section: .init.text) WARNING: modpost: vmlinux: section mismatch in reference: smack_initcall+0x27 (section: .text) -> smack_nf_ip_init (section: .init.text) I guess "__init" is missed for smack_initcall? -Fan
On Mon, Apr 14, 2025 at 5:04 PM Fan Wu <wufan@kernel.org> wrote: > On Wed, Apr 9, 2025 at 11:53 AM Paul Moore <paul@paul-moore.com> wrote: > > > > As the LSM framework only supports one LSM initcall callback for each > > initcall type, the init_smk_fs() and smack_nf_ip_init() functions were > > wrapped with a new function, smack_initcall() that is registered with > > the LSM framework. > > > > Signed-off-by: Paul Moore <paul@paul-moore.com> > > --- > > security/smack/smack.h | 6 ++++++ > > security/smack/smack_lsm.c | 16 ++++++++++++++++ > > security/smack/smack_netfilter.c | 4 +--- > > security/smack/smackfs.c | 4 +--- > > 4 files changed, 24 insertions(+), 6 deletions(-) ... > I'm getting the following WARNING: > > WARNING: modpost: vmlinux: section mismatch in reference: > smack_initcall+0xb (section: .text) -> init_smk_fs (section: > .init.text) > WARNING: modpost: vmlinux: section mismatch in reference: > smack_initcall+0x16 (section: .text) -> smack_nf_ip_init (section: > .init.text) > WARNING: modpost: vmlinux: section mismatch in reference: > smack_initcall+0x27 (section: .text) -> smack_nf_ip_init (section: > .init.text) > > I guess "__init" is missed for smack_initcall? Yep, fixed, thanks.
diff --git a/security/smack/smack.h b/security/smack/smack.h index bf6a6ed3946c..709e0d6cd5e1 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -275,6 +275,12 @@ struct smk_audit_info { #endif }; +/* + * Initialization + */ +int init_smk_fs(void); +int smack_nf_ip_init(void); + /* * These functions are in smack_access.c */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index e09b33fed5f0..80b129a0c92c 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -5277,6 +5277,21 @@ static __init int smack_init(void) return 0; } +static int smack_initcall(void) +{ + int rc, rc_tmp; + + rc_tmp = init_smk_fs(); + if (rc_tmp) + rc = rc_tmp; + + rc_tmp = smack_nf_ip_init(); + if (!rc && rc_tmp) + rc = rc_tmp; + + return rc; +} + /* * Smack requires early initialization in order to label * all processes and objects when they are created. @@ -5286,4 +5301,5 @@ DEFINE_LSM(smack) = { .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, .blobs = &smack_blob_sizes, .init = smack_init, + .initcall_device = smack_initcall, }; diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index 8fd747b3653a..17ba578b1308 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -68,7 +68,7 @@ static struct pernet_operations smack_net_ops = { .exit = smack_nf_unregister, }; -static int __init smack_nf_ip_init(void) +int __init smack_nf_ip_init(void) { if (smack_enabled == 0) return 0; @@ -76,5 +76,3 @@ static int __init smack_nf_ip_init(void) printk(KERN_DEBUG "Smack: Registering netfilter hooks\n"); return register_pernet_subsys(&smack_net_ops); } - -__initcall(smack_nf_ip_init); diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index 90a67e410808..d33dd0368807 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -2980,7 +2980,7 @@ static struct vfsmount *smackfs_mount; * Returns true if we were not chosen on boot or if * we were chosen and filesystem registration succeeded. */ -static int __init init_smk_fs(void) +int __init init_smk_fs(void) { int err; int rc; @@ -3023,5 +3023,3 @@ static int __init init_smk_fs(void) return err; } - -__initcall(init_smk_fs);
As the LSM framework only supports one LSM initcall callback for each initcall type, the init_smk_fs() and smack_nf_ip_init() functions were wrapped with a new function, smack_initcall() that is registered with the LSM framework. Signed-off-by: Paul Moore <paul@paul-moore.com> --- security/smack/smack.h | 6 ++++++ security/smack/smack_lsm.c | 16 ++++++++++++++++ security/smack/smack_netfilter.c | 4 +--- security/smack/smackfs.c | 4 +--- 4 files changed, 24 insertions(+), 6 deletions(-)