diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2019-12-17 09:15:10 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2019-12-18 21:22:46 -0500 |
| commit | 6c5a682e6497cb1f7a67303ce098462a36bed362 (patch) | |
| tree | 2164f187397e93da543e872b363b7347bf8f56ba /security/selinux/include/security.h | |
| parent | 210a292874517782bed2e2220c7beb1608d3b05d (diff) | |
selinux: clean up selinux_enabled/disabled/enforcing_boot
Rename selinux_enabled to selinux_enabled_boot to make it clear that
it only reflects whether SELinux was enabled at boot. Replace the
references to it in the MAC_STATUS audit log in sel_write_enforce()
with hardcoded "1" values because this code is only reachable if SELinux
is enabled and does not change its value, and update the corresponding
MAC_STATUS audit log in sel_write_disable(). Stop clearing
selinux_enabled in selinux_disable() since it is not used outside of
initialization code that runs before selinux_disable() can be reached.
Mark both selinux_enabled_boot and selinux_enforcing_boot as __initdata
since they are only used in initialization code.
Wrap the disabled field in the struct selinux_state with
CONFIG_SECURITY_SELINUX_DISABLE since it is only used for
runtime disable.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/include/security.h')
| -rw-r--r-- | security/selinux/include/security.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 8c0dbbd076c6..af623f03922c 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -69,7 +69,7 @@ struct netlbl_lsm_secattr; -extern int selinux_enabled; +extern int selinux_enabled_boot; /* Policy capabilities */ enum { @@ -99,7 +99,9 @@ struct selinux_avc; struct selinux_ss; struct selinux_state { +#ifdef CONFIG_SECURITY_SELINUX_DISABLE bool disabled; +#endif #ifdef CONFIG_SECURITY_SELINUX_DEVELOP bool enforcing; #endif |