From owner-dev-commits-src-main@freebsd.org Fri Jan 8 13:57:20 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id A7E5A4CAC8E; Fri, 8 Jan 2021 13:57:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4DC4RN4RDrz3vWC; Fri, 8 Jan 2021 13:57:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 7FF67244C6; Fri, 8 Jan 2021 13:57:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 108DvK0M094984; Fri, 8 Jan 2021 13:57:20 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 108DvK0W094983; Fri, 8 Jan 2021 13:57:20 GMT (envelope-from git) Date: Fri, 8 Jan 2021 13:57:20 GMT Message-Id: <202101081357.108DvK0W094983@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mateusz Guzik Subject: git: 77589de8aa67 - main - mac: cheaper check for mac_vnode_check_readlink MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mjg X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 77589de8aa67f6a06ce01dd951a91f5a2f216560 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jan 2021 13:57:20 -0000 The branch main has been updated by mjg: URL: https://cgit.FreeBSD.org/src/commit/?id=77589de8aa67f6a06ce01dd951a91f5a2f216560 commit 77589de8aa67f6a06ce01dd951a91f5a2f216560 Author: Mateusz Guzik AuthorDate: 2021-01-08 02:52:35 +0000 Commit: Mateusz Guzik CommitDate: 2021-01-08 13:57:10 +0000 mac: cheaper check for mac_vnode_check_readlink --- sys/security/mac/mac_framework.c | 3 +++ sys/security/mac/mac_framework.h | 17 ++++++++++++++++- sys/security/mac/mac_vfs.c | 2 +- 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index c1d52eff383e..f0b4f89db7ca 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -142,6 +142,7 @@ FPFLAG(vnode_check_mmap); FPFLAG_RARE(vnode_check_poll); FPFLAG_RARE(vnode_check_rename_from); FPFLAG_RARE(vnode_check_access); +FPFLAG_RARE(vnode_check_readlink); FPFLAG_RARE(pipe_check_stat); FPFLAG_RARE(pipe_check_poll); @@ -422,6 +423,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_array[] = { { .offset = FPO(priv_grant), .flag = &mac_priv_grant_fp_flag }, { .offset = FPO(vnode_check_lookup), .flag = &mac_vnode_check_lookup_fp_flag }, + { .offset = FPO(vnode_check_readlink), + .flag = &mac_vnode_check_readlink_fp_flag }, { .offset = FPO(vnode_check_open), .flag = &mac_vnode_check_open_fp_flag }, { .offset = FPO(vnode_check_stat), diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index ea061d6258ff..481f90a04801 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -538,7 +538,22 @@ mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, } #endif int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp); -int mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp); +int mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *dvp); +#ifdef MAC +extern bool mac_vnode_check_readlink_fp_flag; +#else +#define mac_vnode_check_readlink_fp_flag 0 +#endif +#define mac_vnode_check_readlink_enabled() __predict_false(mac_vnode_check_readlink_fp_flag) +static inline int +mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp) +{ + + mac_vnode_assert_locked(vp, "mac_vnode_check_readlink"); + if (mac_vnode_check_readlink_enabled()) + return (mac_vnode_check_readlink_impl(cred, vp)); + return (0); +} #define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag) #ifdef MAC extern bool mac_vnode_check_rename_from_fp_flag; diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index ec492ba243e6..323d693387bb 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -701,7 +701,7 @@ MAC_CHECK_PROBE_DEFINE2(vnode_check_readlink, "struct ucred *", "struct vnode *"); int -mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp) +mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *vp) { int error;