d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mac: cheaper check for mac_vnode_check_readlink

Browse Source
This commit is contained in:
Mateusz Guzik 2021-01-08 03:52:35 +01:00
parent f8f5b459d2
commit 77589de8aa
3 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/security/mac/mac_framework.c
View File

@ -142,6 +142,7 @@ FPFLAG(vnode_check_mmap);
FPFLAG_RARE(vnode_check_poll); FPFLAG_RARE(vnode_check_poll);
FPFLAG_RARE(vnode_check_rename_from); FPFLAG_RARE(vnode_check_rename_from);
FPFLAG_RARE(vnode_check_access); FPFLAG_RARE(vnode_check_access);
FPFLAG_RARE(vnode_check_readlink);
FPFLAG_RARE(pipe_check_stat); FPFLAG_RARE(pipe_check_stat);
FPFLAG_RARE(pipe_check_poll); FPFLAG_RARE(pipe_check_poll);
@ -422,6 +423,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_array[] = {
{ .offset = FPO(priv_grant), .flag = &mac_priv_grant_fp_flag }, { .offset = FPO(priv_grant), .flag = &mac_priv_grant_fp_flag },
{ .offset = FPO(vnode_check_lookup), { .offset = FPO(vnode_check_lookup),
.flag = &mac_vnode_check_lookup_fp_flag }, .flag = &mac_vnode_check_lookup_fp_flag },
{ .offset = FPO(vnode_check_readlink),
.flag = &mac_vnode_check_readlink_fp_flag },
{ .offset = FPO(vnode_check_open), { .offset = FPO(vnode_check_open),
.flag = &mac_vnode_check_open_fp_flag }, .flag = &mac_vnode_check_open_fp_flag },
{ .offset = FPO(vnode_check_stat), { .offset = FPO(vnode_check_stat),

17
sys/security/mac/mac_framework.h
View File

@ -538,7 +538,22 @@ mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
} }
#endif #endif
int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp); int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp);
int mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp); int mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *dvp);
#ifdef MAC
extern bool mac_vnode_check_readlink_fp_flag;
#else
#define mac_vnode_check_readlink_fp_flag 0
#endif
#define mac_vnode_check_readlink_enabled() __predict_false(mac_vnode_check_readlink_fp_flag)
static inline int
mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
{
mac_vnode_assert_locked(vp, "mac_vnode_check_readlink");
if (mac_vnode_check_readlink_enabled())
return (mac_vnode_check_readlink_impl(cred, vp));
return (0);
}
#define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag) #define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag)
#ifdef MAC #ifdef MAC
extern bool mac_vnode_check_rename_from_fp_flag; extern bool mac_vnode_check_rename_from_fp_flag;

2
sys/security/mac/mac_vfs.c
View File

@ -701,7 +701,7 @@ MAC_CHECK_PROBE_DEFINE2(vnode_check_readlink, "struct ucred *",
"struct vnode *"); "struct vnode *");
int int
mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp) mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *vp)
{ {
int error; int error;