From owner-svn-src-head@freebsd.org Wed Aug 5 07:34:46 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 38BF23AD2C2; Wed, 5 Aug 2020 07:34:46 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4BM3Ky0qpVz4SpM; Wed, 5 Aug 2020 07:34:46 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id F3E9912D07; Wed, 5 Aug 2020 07:34:45 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0757YjfR043439; Wed, 5 Aug 2020 07:34:45 GMT (envelope-from mjg@FreeBSD.org) Received: (from mjg@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0757Yjl9043437; Wed, 5 Aug 2020 07:34:45 GMT (envelope-from mjg@FreeBSD.org) Message-Id: <202008050734.0757Yjl9043437@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mjg set sender to mjg@FreeBSD.org using -f From: Mateusz Guzik Date: Wed, 5 Aug 2020 07:34:45 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r363886 - head/sys/security/mac X-SVN-Group: head X-SVN-Commit-Author: mjg X-SVN-Commit-Paths: head/sys/security/mac X-SVN-Commit-Revision: 363886 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Aug 2020 07:34:46 -0000 Author: mjg Date: Wed Aug 5 07:34:45 2020 New Revision: 363886 URL: https://svnweb.freebsd.org/changeset/base/363886 Log: vfs: add a cheaper entry for mac_vnode_check_access Modified: head/sys/security/mac/mac_framework.c head/sys/security/mac/mac_framework.h head/sys/security/mac/mac_vfs.c Modified: head/sys/security/mac/mac_framework.c ============================================================================== --- head/sys/security/mac/mac_framework.c Wed Aug 5 07:33:39 2020 (r363885) +++ head/sys/security/mac/mac_framework.c Wed Aug 5 07:34:45 2020 (r363886) @@ -140,6 +140,7 @@ FPFLAG(vnode_check_write); FPFLAG(vnode_check_mmap); FPFLAG_RARE(vnode_check_poll); FPFLAG_RARE(vnode_check_rename_from); +FPFLAG_RARE(vnode_check_access); #undef FPFLAG #undef FPFLAG_RARE @@ -430,6 +431,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_ar .flag = &mac_vnode_check_poll_fp_flag }, { .offset = FPO(vnode_check_rename_from), .flag = &mac_vnode_check_rename_from_fp_flag }, + { .offset = FPO(vnode_check_access), + .flag = &mac_vnode_check_access_fp_flag }, }; static void Modified: head/sys/security/mac/mac_framework.h ============================================================================== --- head/sys/security/mac/mac_framework.h Wed Aug 5 07:33:39 2020 (r363885) +++ head/sys/security/mac/mac_framework.h Wed Aug 5 07:34:45 2020 (r363886) @@ -406,8 +406,20 @@ void mac_vnode_assert_locked(struct vnode *vp, const c int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp); void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp); -int mac_vnode_check_access(struct ucred *cred, struct vnode *vp, +int mac_vnode_check_access_impl(struct ucred *cred, struct vnode *dvp, accmode_t accmode); +extern bool mac_vnode_check_access_fp_flag; +#define mac_vnode_check_access_enabled() __predict_false(mac_vnode_check_access_fp_flag) +static inline int +mac_vnode_check_access(struct ucred *cred, struct vnode *dvp, + accmode_t accmode) +{ + + mac_vnode_assert_locked(dvp, "mac_vnode_check_access"); + if (mac_vnode_check_access_enabled()) + return (mac_vnode_check_access_impl(cred, dvp, accmode)); + return (0); +} int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp); int mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp); int mac_vnode_check_create(struct ucred *cred, struct vnode *dvp, Modified: head/sys/security/mac/mac_vfs.c ============================================================================== --- head/sys/security/mac/mac_vfs.c Wed Aug 5 07:33:39 2020 (r363885) +++ head/sys/security/mac/mac_vfs.c Wed Aug 5 07:34:45 2020 (r363886) @@ -372,7 +372,7 @@ MAC_CHECK_PROBE_DEFINE3(vnode_check_access, "struct uc "struct vnode *", "accmode_t"); int -mac_vnode_check_access(struct ucred *cred, struct vnode *vp, accmode_t accmode) +mac_vnode_check_access_impl(struct ucred *cred, struct vnode *vp, accmode_t accmode) { int error;