d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mac: cheaper check for mac_vnode_check_readlink

Browse Source
This commit is contained in:
Mateusz Guzik 2021-01-08 03:52:35 +01:00
parent f8f5b459d2
commit 77589de8aa
3 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/security/mac/mac_framework.c
View File

@ -142,6 +142,7 @@ FPFLAG(vnode_check_mmap);
FPFLAG_RARE(vnode_check_poll);
FPFLAG_RARE(vnode_check_rename_from);
FPFLAG_RARE(vnode_check_access);
FPFLAG_RARE(vnode_check_readlink);
FPFLAG_RARE(pipe_check_stat);
FPFLAG_RARE(pipe_check_poll);
@ -422,6 +423,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_array[] = {
{ .offset = FPO(priv_grant), .flag = &mac_priv_grant_fp_flag },
{ .offset = FPO(vnode_check_lookup),
.flag = &mac_vnode_check_lookup_fp_flag },
{ .offset = FPO(vnode_check_readlink),
.flag = &mac_vnode_check_readlink_fp_flag },
{ .offset = FPO(vnode_check_open),
.flag = &mac_vnode_check_open_fp_flag },
{ .offset = FPO(vnode_check_stat),

17
sys/security/mac/mac_framework.h
View File

@ -538,7 +538,22 @@ mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
}
#endif
int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp);
int mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp);
int mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *dvp);
#ifdef MAC
extern bool mac_vnode_check_readlink_fp_flag;
#else
#define mac_vnode_check_readlink_fp_flag 0
#endif
#define mac_vnode_check_readlink_enabled() __predict_false(mac_vnode_check_readlink_fp_flag)
static inline int
mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
{
mac_vnode_assert_locked(vp, "mac_vnode_check_readlink");
if (mac_vnode_check_readlink_enabled())
return (mac_vnode_check_readlink_impl(cred, vp));
return (0);
}
#define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag)
#ifdef MAC
extern bool mac_vnode_check_rename_from_fp_flag;

2
sys/security/mac/mac_vfs.c
View File

@ -701,7 +701,7 @@ MAC_CHECK_PROBE_DEFINE2(vnode_check_readlink, "struct ucred *",
"struct vnode *");
int
mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *vp)
{
int error;