Re: [RFC PATCH 2/2] selinux: implement support for dynamic net hook [de-]registration

2016-04-06 Thread Casey Schaufler
On 4/6/2016 2:51 AM, Paolo Abeni wrote: > This patch leverage the netlbl_changed() hook to perform on demand > registration and deregistration of the netfilter hooks and the > socket_sock_rcv_skb hook. > > With default policy and empty netfilter/netlabel configuration, the > above hooks are not reg

[RFC PATCH 2/2] selinux: implement support for dynamic net hook [de-]registration

2016-04-06 Thread Paolo Abeni
This patch leverage the netlbl_changed() hook to perform on demand registration and deregistration of the netfilter hooks and the socket_sock_rcv_skb hook. With default policy and empty netfilter/netlabel configuration, the above hooks are not registered and this allows avoiding nf_hook_slow in th