[patch] selinux: restore optimization to selinux_file_permission

[patch] selinux: restore optimization to selinux_file_permission

[Stephen Smalley]

Restore the optimization to skip revalidation in selinux_file_permission
if nothing has changed since the dentry_open checks, accidentally removed by
389fb800.  Also remove redundant test from selinux_revalidate_file_permission.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

---

 security/selinux/hooks.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 15c2a08..d6f6478 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2938,11 +2938,6 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
 	const struct cred *cred = current_cred();
 	struct inode *inode = file->f_path.dentry->d_inode;
 
-	if (!mask) {
-		/* No permission to check.  Existence test. */
-		return 0;
-	}
-
 	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
 	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
 		mask |= MAY_APPEND;
@@ -2953,10 +2948,20 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
 
 static int selinux_file_permission(struct file *file, int mask)
 {
+	struct inode *inode = file->f_path.dentry->d_inode;
+	struct file_security_struct *fsec = file->f_security;
+	struct inode_security_struct *isec = inode->i_security;
+	u32 sid = current_sid();
+
 	if (!mask)
 		/* No permission to check.  Existence test. */
 		return 0;
 
+	if (sid == fsec->sid && fsec->isid == isec->sid &&
+	    fsec->pseqno == avc_policy_seqno())
+		/* No change since dentry_open check. */
+		return 0;
+
 	return selinux_revalidate_file_permission(file, mask);
 }
 

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] selinux: restore optimization to selinux_file_permission

[Paul Moore]

On Monday 22 June 2009 02:54:53 pm Stephen Smalley wrote:
> Restore the optimization to skip revalidation in selinux_file_permission
> if nothing has changed since the dentry_open checks, accidentally removed
> by 389fb800.  Also remove redundant test from
> selinux_revalidate_file_permission.
>
> Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

Sorry, my mistake - thanks for fixing this.

Reviewed-by: Paul Moore <paul.moore@hp.com>

> ---
>
>  security/selinux/hooks.c |   15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 15c2a08..d6f6478 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2938,11 +2938,6 @@ static int selinux_revalidate_file_permission(struct
> file *file, int mask) const struct cred *cred = current_cred();
>  	struct inode *inode = file->f_path.dentry->d_inode;
>
> -	if (!mask) {
> -		/* No permission to check.  Existence test. */
> -		return 0;
> -	}
> -
>  	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
>  	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
>  		mask |= MAY_APPEND;
> @@ -2953,10 +2948,20 @@ static int
> selinux_revalidate_file_permission(struct file *file, int mask)
>
>  static int selinux_file_permission(struct file *file, int mask)
>  {
> +	struct inode *inode = file->f_path.dentry->d_inode;
> +	struct file_security_struct *fsec = file->f_security;
> +	struct inode_security_struct *isec = inode->i_security;
> +	u32 sid = current_sid();
> +
>  	if (!mask)
>  		/* No permission to check.  Existence test. */
>  		return 0;
>
> +	if (sid == fsec->sid && fsec->isid == isec->sid &&
> +	    fsec->pseqno == avc_policy_seqno())
> +		/* No change since dentry_open check. */
> +		return 0;
> +
>  	return selinux_revalidate_file_permission(file, mask);
>  }

-- 
paul moore
linux @ hp


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] selinux: restore optimization to selinux_file_permission

[Eric Paris]

On Mon, 2009-06-22 at 14:54 -0400, Stephen Smalley wrote:
> Restore the optimization to skip revalidation in selinux_file_permission
> if nothing has changed since the dentry_open checks, accidentally removed by
> 389fb800.  Also remove redundant test from selinux_revalidate_file_permission.
> 
> Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

Acked-by: Eric Paris <eparis@redhat.com>


> 
> ---
> 
>  security/selinux/hooks.c |   15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 15c2a08..d6f6478 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2938,11 +2938,6 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
>  	const struct cred *cred = current_cred();
>  	struct inode *inode = file->f_path.dentry->d_inode;
>  
> -	if (!mask) {
> -		/* No permission to check.  Existence test. */
> -		return 0;
> -	}
> -
>  	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
>  	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
>  		mask |= MAY_APPEND;
> @@ -2953,10 +2948,20 @@ static int selinux_revalidate_file_permission(struct file *file, int mask)
>  
>  static int selinux_file_permission(struct file *file, int mask)
>  {
> +	struct inode *inode = file->f_path.dentry->d_inode;
> +	struct file_security_struct *fsec = file->f_security;
> +	struct inode_security_struct *isec = inode->i_security;
> +	u32 sid = current_sid();
> +
>  	if (!mask)
>  		/* No permission to check.  Existence test. */
>  		return 0;
>  
> +	if (sid == fsec->sid && fsec->isid == isec->sid &&
> +	    fsec->pseqno == avc_policy_seqno())
> +		/* No change since dentry_open check. */
> +		return 0;
> +
>  	return selinux_revalidate_file_permission(file, mask);
>  }
>  
> 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] selinux: restore optimization to selinux_file_permission

[James Morris]

On Mon, 22 Jun 2009, Stephen Smalley wrote:

> Restore the optimization to skip revalidation in selinux_file_permission
> if nothing has changed since the dentry_open checks, accidentally removed by
> 389fb800.  Also remove redundant test from selinux_revalidate_file_permission.
> 
> Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next


-- 
James Morris
<jmorris@namei.org>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.