Date: Mon, 4 Dec 2006 18:34:22 GMT From: Todd Miller <millert@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 111046 for review Message-ID: <200612041834.kB4IYM7k089535@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=111046 Change 111046 by millert@millert_g5tower on 2006/12/04 18:34:01 Remove rate limiting, it was removed in selinux long ago. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/avc/avc.c#12 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/avc/avc.c#12 (text+ko) ==== @@ -148,14 +148,9 @@ #define NOTIF_LOCK lck_mtx_lock(notif_lock) #define NOTIF_UNLOCK lck_mtx_unlock(notif_lock) -static lck_mtx_t *ratelimit_lock; -#define RATELIM_LOCK lck_mtx_lock(ratelimit_lock) -#define RATELIM_UNLOCK lck_mtx_unlock(ratelimit_lock) - static struct avc_cache avc_cache; static struct avc_callback_node *avc_callbacks; static zone_t avc_node_cachep; -static uint64_t avc_msg_cost, avc_msg_burst; static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass) { @@ -277,7 +272,6 @@ /* allocate avc mutexes */ avc_log_lock = lck_mtx_alloc_init(avc_lck_grp, avc_lck_attr); notif_lock = lck_mtx_alloc_init(avc_lck_grp, avc_lck_attr); - ratelimit_lock = lck_mtx_alloc_init(avc_lck_grp, avc_lck_attr); for (i = 0; i < AVC_CACHE_SLOTS; i++) { LIST_INIT(&avc_cache.slots[i]); @@ -291,10 +285,6 @@ lck_attr_free(avc_lck_attr); lck_grp_attr_free(avc_lck_grp_attr); - /* For avc_ratelimit() */ - nanoseconds_to_absolutetime(5000000000ULL, &avc_msg_cost); - avc_msg_burst = 10 * avc_msg_cost; - avc_node_cachep = mac_zinit(sizeof(struct avc_node), AVC_CACHE_MAXNODES * sizeof(struct avc_node), AVC_CACHE_RECLAIM * sizeof(struct avc_node), "avc node"); @@ -575,63 +565,6 @@ } #endif /* __linux__ */ - -#define AVC_MSG_COST avc_msg_cost -#define AVC_MSG_BURST avc_msg_burst - -/* - * This enforces a rate limit: not more than one kernel message - * every 5secs to make a denial-of-service attack impossible. - */ -static int avc_ratelimit(void) -{ - static uint64_t toks; - static uint64_t last_msg; - static int missed, rc; - uint64_t now; - - now = mach_absolute_time(); - - RATELIM_LOCK; - toks += now - last_msg; - last_msg = now; - if (toks > AVC_MSG_BURST) - toks = AVC_MSG_BURST; - if (toks >= AVC_MSG_COST) { - int lost = missed; - missed = 0; - toks -= AVC_MSG_COST; - RATELIM_UNLOCK; - if (lost) - printk(KERN_WARNING "AVC: %d messages suppressed.\n", - lost); - rc = 1; - goto out; - } - missed++; - RATELIM_UNLOCK; -out: - return rc; -} - -static inline int check_avc_ratelimit(void) -{ - - /* - * If auditing is not enabled, suppress all messages. - */ - if (!selinux_auditing) - return 0; - - /* - * If in permissive mode, display all messages. - */ - if (!selinux_enforcing) - return 1; - - return avc_ratelimit(); -} - /** * avc_audit - Audit the granting or denial of permissions. * @ssid: source security identifier @@ -672,9 +605,6 @@ return; } - if (!check_avc_ratelimit()) - return; - ab = audit_log_start(); if (!ab) return; /* audit_panic has been called */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200612041834.kB4IYM7k089535>