leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

selinux: cache the SID -> context string translation

Browse Source 
Translating a context struct to string can be quite slow, especially if
the context has a lot of category bits set. This can cause quite
noticeable performance impact in situations where the translation needs
to be done repeatedly. A common example is a UNIX datagram socket with
the SO_PASSSEC option enabled, which is used e.g. by systemd-journald
when receiving log messages via datagram socket. This scenario can be
reproduced with:

    cat /dev/urandom | base64 | logger &
    timeout 30s perf record -p $(pidof systemd-journald) -a -g
    kill %1
    perf report -g none --pretty raw | grep security_secid_to_secctx

Before the caching introduced by this patch, computing the context
string (security_secid_to_secctx() function) takes up ~65% of
systemd-journald's CPU time (assuming a context with 1024 categories
set and Fedora x86_64 release kernel configs). After this patch
(assuming near-perfect cache hit ratio) this overhead is reduced to just
~2%.

This patch addresses the issue by caching a certain number (compile-time
configurable) of recently used context strings to speed up repeated
translations of the same context, while using only a small amount of
memory.

The cache is integrated into the existing sidtab table by adding a field
to each entry, which when not NULL contains an RCU-protected pointer to
a cache entry containing the cached string. The cache entries are kept
in a linked list sorted according to how recently they were used. On a
cache miss when the cache is full, the least recently used entry is
removed to make space for the new entry.

The patch migrates security_sid_to_context_core() to use the cache (also
a few other functions where it was possible without too much fuss, but
these mostly use the translation for logging in case of error, which is
rare).

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1733259
Cc: Michal Sekletar <msekleta@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
Tested-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
[PM: lots of merge fixups due to collisions with other sidtab patches]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Ondrej Mosnacek 2019-11-26 14:57:00 +01:00 committed by Paul Moore
parent 66f8e2f03c
commit d97bd23c2d
4 changed files with 288 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/selinux/Kconfig
View File

@ -97,3 +97,14 @@ config SECURITY_SELINUX_SIDTAB_HASH_BITS
collisions may be viewed at /sys/fs/selinux/ss/sidtab_hash_stats. If collisions may be viewed at /sys/fs/selinux/ss/sidtab_hash_stats. If
chain lengths are high (e.g. > 20) then selecting a higher value here chain lengths are high (e.g. > 20) then selecting a higher value here
will ensure that lookups times are short and stable. will ensure that lookups times are short and stable.
config SECURITY_SELINUX_SID2STR_CACHE_SIZE
int "NSA SELinux SID to context string translation cache size"
depends on SECURITY_SELINUX
default 256
help
This option defines the size of the internal SID -> context string
cache, which improves the performance of context to string
conversion. Setting this option to 0 disables the cache completely.
If unsure, keep the default value.

138
security/selinux/ss/services.c
View File

@ -91,6 +91,12 @@ static int context_struct_to_string(struct policydb *policydb,
char **scontext, char **scontext,
u32 *scontext_len); u32 *scontext_len);
static int sidtab_entry_to_string(struct policydb *policydb,
struct sidtab *sidtab,
struct sidtab_entry *entry,
char **scontext,
u32 *scontext_len);
static void context_struct_compute_av(struct policydb *policydb, static void context_struct_compute_av(struct policydb *policydb,
struct context *scontext, struct context *scontext,
struct context *tcontext, struct context *tcontext,
@ -716,20 +722,21 @@ static void context_struct_compute_av(struct policydb *policydb,
} }
static int security_validtrans_handle_fail(struct selinux_state *state, static int security_validtrans_handle_fail(struct selinux_state *state,
struct context *ocontext, struct sidtab_entry *oentry,
struct context *ncontext, struct sidtab_entry *nentry,
struct context *tcontext, struct sidtab_entry *tentry,
u16 tclass) u16 tclass)
{ {
struct policydb *p = &state->ss->policydb; struct policydb *p = &state->ss->policydb;
struct sidtab *sidtab = state->ss->sidtab;
char *o = NULL, *n = NULL, *t = NULL; char *o = NULL, *n = NULL, *t = NULL;
u32 olen, nlen, tlen; u32 olen, nlen, tlen;
if (context_struct_to_string(p, ocontext, &o, &olen)) if (sidtab_entry_to_string(p, sidtab, oentry, &o, &olen))
goto out; goto out;
if (context_struct_to_string(p, ncontext, &n, &nlen)) if (sidtab_entry_to_string(p, sidtab, nentry, &n, &nlen))
goto out; goto out;
if (context_struct_to_string(p, tcontext, &t, &tlen)) if (sidtab_entry_to_string(p, sidtab, tentry, &t, &tlen))
goto out; goto out;
audit_log(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR, audit_log(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR,
"op=security_validate_transition seresult=denied" "op=security_validate_transition seresult=denied"
@ -751,9 +758,9 @@ static int security_compute_validatetrans(struct selinux_state *state,
{ {
struct policydb *policydb; struct policydb *policydb;
struct sidtab *sidtab; struct sidtab *sidtab;
struct context *ocontext; struct sidtab_entry *oentry;
struct context *ncontext; struct sidtab_entry *nentry;
struct context *tcontext; struct sidtab_entry *tentry;
struct class_datum *tclass_datum; struct class_datum *tclass_datum;
struct constraint_node *constraint; struct constraint_node *constraint;
u16 tclass; u16 tclass;
@ -779,24 +786,24 @@ static int security_compute_validatetrans(struct selinux_state *state,
} }
tclass_datum = policydb->class_val_to_struct[tclass - 1]; tclass_datum = policydb->class_val_to_struct[tclass - 1];
ocontext = sidtab_search(sidtab, oldsid); oentry = sidtab_search_entry(sidtab, oldsid);
if (!ocontext) { if (!oentry) {
pr_err("SELinux: %s: unrecognized SID %d\n", pr_err("SELinux: %s: unrecognized SID %d\n",
__func__, oldsid); __func__, oldsid);
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
ncontext = sidtab_search(sidtab, newsid); nentry = sidtab_search_entry(sidtab, newsid);
if (!ncontext) { if (!nentry) {
pr_err("SELinux: %s: unrecognized SID %d\n", pr_err("SELinux: %s: unrecognized SID %d\n",
__func__, newsid); __func__, newsid);
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
tcontext = sidtab_search(sidtab, tasksid); tentry = sidtab_search_entry(sidtab, tasksid);
if (!tcontext) { if (!tentry) {
pr_err("SELinux: %s: unrecognized SID %d\n", pr_err("SELinux: %s: unrecognized SID %d\n",
__func__, tasksid); __func__, tasksid);
rc = -EINVAL; rc = -EINVAL;
@ -805,15 +812,16 @@ static int security_compute_validatetrans(struct selinux_state *state,
constraint = tclass_datum->validatetrans; constraint = tclass_datum->validatetrans;
while (constraint) { while (constraint) {
if (!constraint_expr_eval(policydb, ocontext, ncontext, if (!constraint_expr_eval(policydb, &oentry->context,
tcontext, constraint->expr)) { &nentry->context, &tentry->context,
constraint->expr)) {
if (user) if (user)
rc = -EPERM; rc = -EPERM;
else else
rc = security_validtrans_handle_fail(state, rc = security_validtrans_handle_fail(state,
ocontext, oentry,
ncontext, nentry,
tcontext, tentry,
tclass); tclass);
goto out; goto out;
} }
@ -855,7 +863,7 @@ int security_bounded_transition(struct selinux_state *state,
{ {
struct policydb *policydb; struct policydb *policydb;
struct sidtab *sidtab; struct sidtab *sidtab;
struct context *old_context, *new_context; struct sidtab_entry *old_entry, *new_entry;
struct type_datum *type; struct type_datum *type;
int index; int index;
int rc; int rc;
@ -869,16 +877,16 @@ int security_bounded_transition(struct selinux_state *state,
sidtab = state->ss->sidtab; sidtab = state->ss->sidtab;
rc = -EINVAL; rc = -EINVAL;
old_context = sidtab_search(sidtab, old_sid); old_entry = sidtab_search_entry(sidtab, old_sid);
if (!old_context) { if (!old_entry) {
pr_err("SELinux: %s: unrecognized SID %u\n", pr_err("SELinux: %s: unrecognized SID %u\n",
__func__, old_sid); __func__, old_sid);
goto out; goto out;
} }
rc = -EINVAL; rc = -EINVAL;
new_context = sidtab_search(sidtab, new_sid); new_entry = sidtab_search_entry(sidtab, new_sid);
if (!new_context) { if (!new_entry) {
pr_err("SELinux: %s: unrecognized SID %u\n", pr_err("SELinux: %s: unrecognized SID %u\n",
__func__, new_sid); __func__, new_sid);
goto out; goto out;
@ -886,10 +894,10 @@ int security_bounded_transition(struct selinux_state *state,
rc = 0; rc = 0;
/* type/domain unchanged */ /* type/domain unchanged */
if (old_context->type == new_context->type) if (old_entry->context.type == new_entry->context.type)
goto out; goto out;
index = new_context->type; index = new_entry->context.type;
while (true) { while (true) {
type = policydb->type_val_to_struct[index - 1]; type = policydb->type_val_to_struct[index - 1];
BUG_ON(!type); BUG_ON(!type);
@ -901,7 +909,7 @@ int security_bounded_transition(struct selinux_state *state,
/* @newsid is bounded by @oldsid */ /* @newsid is bounded by @oldsid */
rc = 0; rc = 0;
if (type->bounds == old_context->type) if (type->bounds == old_entry->context.type)
break; break;
index = type->bounds; index = type->bounds;
@ -912,10 +920,10 @@ int security_bounded_transition(struct selinux_state *state,
char *new_name = NULL; char *new_name = NULL;
u32 length; u32 length;
if (!context_struct_to_string(policydb, old_context, if (!sidtab_entry_to_string(policydb, sidtab, old_entry,
&old_name, &length) && &old_name, &length) &&
!context_struct_to_string(policydb, new_context, !sidtab_entry_to_string(policydb, sidtab, new_entry,
&new_name, &length)) { &new_name, &length)) {
audit_log(audit_context(), audit_log(audit_context(),
GFP_ATOMIC, AUDIT_SELINUX_ERR, GFP_ATOMIC, AUDIT_SELINUX_ERR,
"op=security_bounded_transition " "op=security_bounded_transition "
@ -1255,6 +1263,23 @@ static int context_struct_to_string(struct policydb *p,
return 0; return 0;
} }
static int sidtab_entry_to_string(struct policydb *p,
struct sidtab *sidtab,
struct sidtab_entry *entry,
char **scontext, u32 *scontext_len)
{
int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len);
if (rc != -ENOENT)
return rc;
rc = context_struct_to_string(p, &entry->context, scontext,
scontext_len);
if (!rc && scontext)
sidtab_sid2str_put(sidtab, entry, *scontext, *scontext_len);
return rc;
}
#include "initial_sid_to_string.h" #include "initial_sid_to_string.h"
int security_sidtab_hash_stats(struct selinux_state *state, char *page) int security_sidtab_hash_stats(struct selinux_state *state, char *page)
@ -1282,7 +1307,7 @@ static int security_sid_to_context_core(struct selinux_state *state,
{ {
struct policydb *policydb; struct policydb *policydb;
struct sidtab *sidtab; struct sidtab *sidtab;
struct context *context; struct sidtab_entry *entry;
int rc = 0; int rc = 0;
if (scontext) if (scontext)
@ -1313,21 +1338,23 @@ static int security_sid_to_context_core(struct selinux_state *state,
read_lock(&state->ss->policy_rwlock); read_lock(&state->ss->policy_rwlock);
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = state->ss->sidtab; sidtab = state->ss->sidtab;
if (force) if (force)
context = sidtab_search_force(sidtab, sid); entry = sidtab_search_entry_force(sidtab, sid);
else else
context = sidtab_search(sidtab, sid); entry = sidtab_search_entry(sidtab, sid);
if (!context) { if (!entry) {
pr_err("SELinux: %s: unrecognized SID %d\n", pr_err("SELinux: %s: unrecognized SID %d\n",
__func__, sid); __func__, sid);
rc = -EINVAL; rc = -EINVAL;
goto out_unlock; goto out_unlock;
} }
if (only_invalid && !context->len) if (only_invalid && !entry->context.len)
rc = 0; goto out_unlock;
else
rc = context_struct_to_string(policydb, context, scontext, rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext,
scontext_len); scontext_len);
out_unlock: out_unlock:
read_unlock(&state->ss->policy_rwlock); read_unlock(&state->ss->policy_rwlock);
out: out:
@ -1621,19 +1648,20 @@ int security_context_to_sid_force(struct selinux_state *state,
static int compute_sid_handle_invalid_context( static int compute_sid_handle_invalid_context(
struct selinux_state *state, struct selinux_state *state,
struct context *scontext, struct sidtab_entry *sentry,
struct context *tcontext, struct sidtab_entry *tentry,
u16 tclass, u16 tclass,
struct context *newcontext) struct context *newcontext)
{ {
struct policydb *policydb = &state->ss->policydb; struct policydb *policydb = &state->ss->policydb;
struct sidtab *sidtab = state->ss->sidtab;
char *s = NULL, *t = NULL, *n = NULL; char *s = NULL, *t = NULL, *n = NULL;
u32 slen, tlen, nlen; u32 slen, tlen, nlen;
struct audit_buffer *ab; struct audit_buffer *ab;
if (context_struct_to_string(policydb, scontext, &s, &slen)) if (sidtab_entry_to_string(policydb, sidtab, sentry, &s, &slen))
goto out; goto out;
if (context_struct_to_string(policydb, tcontext, &t, &tlen)) if (sidtab_entry_to_string(policydb, sidtab, tentry, &t, &tlen))
goto out; goto out;
if (context_struct_to_string(policydb, newcontext, &n, &nlen)) if (context_struct_to_string(policydb, newcontext, &n, &nlen))
goto out; goto out;
@ -1692,7 +1720,8 @@ static int security_compute_sid(struct selinux_state *state,
struct policydb *policydb; struct policydb *policydb;
struct sidtab *sidtab; struct sidtab *sidtab;
struct class_datum *cladatum = NULL; struct class_datum *cladatum = NULL;
struct context *scontext = NULL, *tcontext = NULL, newcontext; struct context *scontext, *tcontext, newcontext;
struct sidtab_entry *sentry, *tentry;
struct role_trans *roletr = NULL; struct role_trans *roletr = NULL;
struct avtab_key avkey; struct avtab_key avkey;
struct avtab_datum *avdatum; struct avtab_datum *avdatum;
@ -1729,21 +1758,24 @@ static int security_compute_sid(struct selinux_state *state,
policydb = &state->ss->policydb; policydb = &state->ss->policydb;
sidtab = state->ss->sidtab; sidtab = state->ss->sidtab;
scontext = sidtab_search(sidtab, ssid); sentry = sidtab_search_entry(sidtab, ssid);
if (!scontext) { if (!sentry) {
pr_err("SELinux: %s: unrecognized SID %d\n", pr_err("SELinux: %s: unrecognized SID %d\n",
__func__, ssid); __func__, ssid);
rc = -EINVAL; rc = -EINVAL;
goto out_unlock; goto out_unlock;
} }
tcontext = sidtab_search(sidtab, tsid); tentry = sidtab_search_entry(sidtab, tsid);
if (!tcontext) { if (!tentry) {
pr_err("SELinux: %s: unrecognized SID %d\n", pr_err("SELinux: %s: unrecognized SID %d\n",
__func__, tsid); __func__, tsid);
rc = -EINVAL; rc = -EINVAL;
goto out_unlock; goto out_unlock;
} }
scontext = &sentry->context;
tcontext = &tentry->context;
if (tclass && tclass <= policydb->p_classes.nprim) if (tclass && tclass <= policydb->p_classes.nprim)
cladatum = policydb->class_val_to_struct[tclass - 1]; cladatum = policydb->class_val_to_struct[tclass - 1];
@ -1844,10 +1876,8 @@ static int security_compute_sid(struct selinux_state *state,
/* Check the validity of the context. */ /* Check the validity of the context. */
if (!policydb_context_isvalid(policydb, &newcontext)) { if (!policydb_context_isvalid(policydb, &newcontext)) {
rc = compute_sid_handle_invalid_context(state, scontext, rc = compute_sid_handle_invalid_context(state, sentry, tentry,
tcontext, tclass, &newcontext);
tclass,
&newcontext);
if (rc) if (rc)
goto out_unlock; goto out_unlock;
} }

175
security/selinux/ss/sidtab.c
View File

@ -9,6 +9,8 @@
*/ */
#include <linux/errno.h> #include <linux/errno.h>
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/list.h>
#include <linux/rcupdate.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/sched.h> #include <linux/sched.h>
#include <linux/spinlock.h> #include <linux/spinlock.h>
@ -17,6 +19,14 @@
#include "security.h" #include "security.h"
#include "sidtab.h" #include "sidtab.h"
struct sidtab_str_cache {
struct rcu_head rcu_member;
struct list_head lru_member;
struct sidtab_entry *parent;
u32 len;
char str[];
};
#define index_to_sid(index) (index + SECINITSID_NUM + 1) #define index_to_sid(index) (index + SECINITSID_NUM + 1)
#define sid_to_index(sid) (sid - (SECINITSID_NUM + 1)) #define sid_to_index(sid) (sid - (SECINITSID_NUM + 1))
@ -34,12 +44,19 @@ int sidtab_init(struct sidtab *s)
hash_init(s->context_to_sid); hash_init(s->context_to_sid);
spin_lock_init(&s->lock); spin_lock_init(&s->lock);
#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
s->cache_free_slots = CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE;
INIT_LIST_HEAD(&s->cache_lru_list);
spin_lock_init(&s->cache_lock);
#endif
return 0; return 0;
} }
static u32 context_to_sid(struct sidtab *s, struct context *context) static u32 context_to_sid(struct sidtab *s, struct context *context)
{ {
struct sidtab_entry_leaf *entry; struct sidtab_entry *entry;
u32 sid = 0; u32 sid = 0;
rcu_read_lock(); rcu_read_lock();
@ -56,19 +73,22 @@ static u32 context_to_sid(struct sidtab *s, struct context *context)
int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context) int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context)
{ {
struct sidtab_isid_entry *entry; struct sidtab_isid_entry *isid;
int rc; int rc;
if (sid == 0 || sid > SECINITSID_NUM) if (sid == 0 || sid > SECINITSID_NUM)
return -EINVAL; return -EINVAL;
entry = &s->isids[sid - 1]; isid = &s->isids[sid - 1];
rc = context_cpy(&entry->leaf.context, context); rc = context_cpy(&isid->entry.context, context);
if (rc) if (rc)
return rc; return rc;
entry->set = 1; #if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
isid->entry.cache = NULL;
#endif
isid->set = 1;
/* /*
* Multiple initial sids may map to the same context. Check that this * Multiple initial sids may map to the same context. Check that this
@ -77,8 +97,8 @@ int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context)
* collision. * collision.
*/ */
if (!context_to_sid(s, context)) { if (!context_to_sid(s, context)) {
entry->leaf.sid = sid; isid->entry.sid = sid;
hash_add(s->context_to_sid, &entry->leaf.list, context->hash); hash_add(s->context_to_sid, &isid->entry.list, context->hash);
} }
return 0; return 0;
@ -92,7 +112,7 @@ int sidtab_hash_stats(struct sidtab *sidtab, char *page)
int entries = 0; int entries = 0;
int max_chain_len = 0; int max_chain_len = 0;
int cur_bucket = 0; int cur_bucket = 0;
struct sidtab_entry_leaf *entry; struct sidtab_entry *entry;
rcu_read_lock(); rcu_read_lock();
hash_for_each_rcu(sidtab->context_to_sid, i, entry, list) { hash_for_each_rcu(sidtab->context_to_sid, i, entry, list) {
@ -151,8 +171,8 @@ static int sidtab_alloc_roots(struct sidtab *s, u32 level)
return 0; return 0;
} }
static struct sidtab_entry_leaf *sidtab_do_lookup(struct sidtab *s, u32 index, static struct sidtab_entry *sidtab_do_lookup(struct sidtab *s, u32 index,
int alloc) int alloc)
{ {
union sidtab_entry_inner *entry; union sidtab_entry_inner *entry;
u32 level, capacity_shift, leaf_index = index / SIDTAB_LEAF_ENTRIES; u32 level, capacity_shift, leaf_index = index / SIDTAB_LEAF_ENTRIES;
@ -192,7 +212,7 @@ static struct sidtab_entry_leaf *sidtab_do_lookup(struct sidtab *s, u32 index,
return &entry->ptr_leaf->entries[index % SIDTAB_LEAF_ENTRIES]; return &entry->ptr_leaf->entries[index % SIDTAB_LEAF_ENTRIES];
} }
static struct context *sidtab_lookup(struct sidtab *s, u32 index) static struct sidtab_entry *sidtab_lookup(struct sidtab *s, u32 index)
{ {
/* read entries only after reading count */ /* read entries only after reading count */
u32 count = smp_load_acquire(&s->count); u32 count = smp_load_acquire(&s->count);
@ -200,36 +220,37 @@ static struct context *sidtab_lookup(struct sidtab *s, u32 index)
if (index >= count) if (index >= count)
return NULL; return NULL;
return &sidtab_do_lookup(s, index, 0)->context; return sidtab_do_lookup(s, index, 0);
} }
static struct context *sidtab_lookup_initial(struct sidtab *s, u32 sid) static struct sidtab_entry *sidtab_lookup_initial(struct sidtab *s, u32 sid)
{ {
return s->isids[sid - 1].set ? &s->isids[sid - 1].leaf.context : NULL; return s->isids[sid - 1].set ? &s->isids[sid - 1].entry : NULL;
} }
static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force) static struct sidtab_entry *sidtab_search_core(struct sidtab *s, u32 sid,
int force)
{ {
struct context *context;
if (sid != 0) { if (sid != 0) {
struct sidtab_entry *entry;
if (sid > SECINITSID_NUM) if (sid > SECINITSID_NUM)
context = sidtab_lookup(s, sid_to_index(sid)); entry = sidtab_lookup(s, sid_to_index(sid));
else else
context = sidtab_lookup_initial(s, sid); entry = sidtab_lookup_initial(s, sid);
if (context && (!context->len || force)) if (entry && (!entry->context.len || force))
return context; return entry;
} }
return sidtab_lookup_initial(s, SECINITSID_UNLABELED); return sidtab_lookup_initial(s, SECINITSID_UNLABELED);
} }
struct context *sidtab_search(struct sidtab *s, u32 sid) struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid)
{ {
return sidtab_search_core(s, sid, 0); return sidtab_search_core(s, sid, 0);
} }
struct context *sidtab_search_force(struct sidtab *s, u32 sid) struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid)
{ {
return sidtab_search_core(s, sid, 1); return sidtab_search_core(s, sid, 1);
} }
@ -240,7 +261,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context,
unsigned long flags; unsigned long flags;
u32 count; u32 count;
struct sidtab_convert_params *convert; struct sidtab_convert_params *convert;
struct sidtab_entry_leaf *dst, *dst_convert; struct sidtab_entry *dst, *dst_convert;
int rc; int rc;
*sid = context_to_sid(s, context); *sid = context_to_sid(s, context);
@ -289,7 +310,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context,
} }
rc = convert->func(context, &dst_convert->context, rc = convert->func(context, &dst_convert->context,
convert->args); convert->args);
if (rc) { if (rc) {
context_destroy(&dst->context); context_destroy(&dst->context);
goto out_unlock; goto out_unlock;
@ -298,7 +319,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context,
convert->target->count = count + 1; convert->target->count = count + 1;
hash_add_rcu(convert->target->context_to_sid, hash_add_rcu(convert->target->context_to_sid,
&dst_convert->list, dst_convert->context.hash); &dst_convert->list, dst_convert->context.hash);
} }
if (context->len) if (context->len)
@ -319,7 +340,7 @@ out_unlock:
static void sidtab_convert_hashtable(struct sidtab *s, u32 count) static void sidtab_convert_hashtable(struct sidtab *s, u32 count)
{ {
struct sidtab_entry_leaf *entry; struct sidtab_entry *entry;
u32 i; u32 i;
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
@ -327,7 +348,7 @@ static void sidtab_convert_hashtable(struct sidtab *s, u32 count)
entry->sid = index_to_sid(i); entry->sid = index_to_sid(i);
hash_add_rcu(s->context_to_sid, &entry->list, hash_add_rcu(s->context_to_sid, &entry->list,
entry->context.hash); entry->context.hash);
} }
} }
@ -376,7 +397,6 @@ static int sidtab_convert_tree(union sidtab_entry_inner *edst,
} }
cond_resched(); cond_resched();
} }
return 0; return 0;
} }
@ -439,6 +459,14 @@ int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params)
return 0; return 0;
} }
static void sidtab_destroy_entry(struct sidtab_entry *entry)
{
context_destroy(&entry->context);
#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
kfree(rcu_dereference_raw(entry->cache));
#endif
}
static void sidtab_destroy_tree(union sidtab_entry_inner entry, u32 level) static void sidtab_destroy_tree(union sidtab_entry_inner entry, u32 level)
{ {
u32 i; u32 i;
@ -459,7 +487,7 @@ static void sidtab_destroy_tree(union sidtab_entry_inner entry, u32 level)
return; return;
for (i = 0; i < SIDTAB_LEAF_ENTRIES; i++) for (i = 0; i < SIDTAB_LEAF_ENTRIES; i++)
context_destroy(&node->entries[i].context); sidtab_destroy_entry(&node->entries[i]);
kfree(node); kfree(node);
} }
} }
@ -470,7 +498,7 @@ void sidtab_destroy(struct sidtab *s)
for (i = 0; i < SECINITSID_NUM; i++) for (i = 0; i < SECINITSID_NUM; i++)
if (s->isids[i].set) if (s->isids[i].set)
context_destroy(&s->isids[i].leaf.context); sidtab_destroy_entry(&s->isids[i].entry);
level = SIDTAB_MAX_LEVEL; level = SIDTAB_MAX_LEVEL;
while (level && !s->roots[level].ptr_inner) while (level && !s->roots[level].ptr_inner)
@ -483,3 +511,88 @@ void sidtab_destroy(struct sidtab *s)
* to be cleaned up here. * to be cleaned up here.
*/ */
} }
#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry,
const char *str, u32 str_len)
{
struct sidtab_str_cache *cache, *victim = NULL;
/* do not cache invalid contexts */
if (entry->context.len)
return;
/*
* Skip the put operation when in non-task context to avoid the need
* to disable interrupts while holding s->cache_lock.
*/
if (!in_task())
return;
spin_lock(&s->cache_lock);
cache = rcu_dereference_protected(entry->cache,
lockdep_is_held(&s->cache_lock));
if (cache) {
/* entry in cache - just bump to the head of LRU list */
list_move(&cache->lru_member, &s->cache_lru_list);
goto out_unlock;
}
cache = kmalloc(sizeof(struct sidtab_str_cache) + str_len, GFP_ATOMIC);
if (!cache)
goto out_unlock;
if (s->cache_free_slots == 0) {
/* pop a cache entry from the tail and free it */
victim = container_of(s->cache_lru_list.prev,
struct sidtab_str_cache, lru_member);
list_del(&victim->lru_member);
rcu_assign_pointer(victim->parent->cache, NULL);
} else {
s->cache_free_slots--;
}
cache->parent = entry;
cache->len = str_len;
memcpy(cache->str, str, str_len);
list_add(&cache->lru_member, &s->cache_lru_list);
rcu_assign_pointer(entry->cache, cache);
out_unlock:
spin_unlock(&s->cache_lock);
kfree_rcu(victim, rcu_member);
}
int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry,
char **out, u32 *out_len)
{
struct sidtab_str_cache *cache;
int rc = 0;
if (entry->context.len)
return -ENOENT; /* do not cache invalid contexts */
rcu_read_lock();
cache = rcu_dereference(entry->cache);
if (!cache) {
rc = -ENOENT;
} else {
*out_len = cache->len;
if (out) {
*out = kmemdup(cache->str, cache->len, GFP_ATOMIC);
if (!*out)
rc = -ENOMEM;
}
}
rcu_read_unlock();
if (!rc && out)
sidtab_sid2str_put(s, entry, *out, *out_len);
return rc;
}
#endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */

58
security/selinux/ss/sidtab.h
View File

@ -17,15 +17,15 @@
#include "context.h" #include "context.h"
struct sidtab_entry_leaf { struct sidtab_entry {
u32 sid; u32 sid;
struct context context; struct context context;
#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
struct sidtab_str_cache __rcu *cache;
#endif
struct hlist_node list; struct hlist_node list;
}; };
struct sidtab_node_inner;
struct sidtab_node_leaf;
union sidtab_entry_inner { union sidtab_entry_inner {
struct sidtab_node_inner *ptr_inner; struct sidtab_node_inner *ptr_inner;
struct sidtab_node_leaf *ptr_leaf; struct sidtab_node_leaf *ptr_leaf;
@ -41,7 +41,7 @@ union sidtab_entry_inner {
(SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner))) (SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner)))
#define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT) #define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT)
#define SIDTAB_LEAF_ENTRIES \ #define SIDTAB_LEAF_ENTRIES \
(SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry_leaf)) (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry))
#define SIDTAB_MAX_BITS 32 #define SIDTAB_MAX_BITS 32
#define SIDTAB_MAX U32_MAX #define SIDTAB_MAX U32_MAX
@ -51,7 +51,7 @@ union sidtab_entry_inner {
SIDTAB_INNER_SHIFT) SIDTAB_INNER_SHIFT)
struct sidtab_node_leaf { struct sidtab_node_leaf {
struct sidtab_entry_leaf entries[SIDTAB_LEAF_ENTRIES]; struct sidtab_entry entries[SIDTAB_LEAF_ENTRIES];
}; };
struct sidtab_node_inner { struct sidtab_node_inner {
@ -60,7 +60,7 @@ struct sidtab_node_inner {
struct sidtab_isid_entry { struct sidtab_isid_entry {
int set; int set;
struct sidtab_entry_leaf leaf; struct sidtab_entry entry;
}; };
struct sidtab_convert_params { struct sidtab_convert_params {
@ -87,6 +87,13 @@ struct sidtab {
struct sidtab_convert_params *convert; struct sidtab_convert_params *convert;
spinlock_t lock; spinlock_t lock;
#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
/* SID -> context string cache */
u32 cache_free_slots;
struct list_head cache_lru_list;
spinlock_t cache_lock;
#endif
/* index == SID - 1 (no entry for SECSID_NULL) */ /* index == SID - 1 (no entry for SECSID_NULL) */
struct sidtab_isid_entry isids[SECINITSID_NUM]; struct sidtab_isid_entry isids[SECINITSID_NUM];
@ -96,8 +103,22 @@ struct sidtab {
int sidtab_init(struct sidtab *s); int sidtab_init(struct sidtab *s);
int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context); int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
struct context *sidtab_search(struct sidtab *s, u32 sid); struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid);
struct context *sidtab_search_force(struct sidtab *s, u32 sid); struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid);
static inline struct context *sidtab_search(struct sidtab *s, u32 sid)
{
struct sidtab_entry *entry = sidtab_search_entry(s, sid);
return entry ? &entry->context : NULL;
}
static inline struct context *sidtab_search_force(struct sidtab *s, u32 sid)
{
struct sidtab_entry *entry = sidtab_search_entry_force(s, sid);
return entry ? &entry->context : NULL;
}
int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params); int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
@ -107,6 +128,25 @@ void sidtab_destroy(struct sidtab *s);
int sidtab_hash_stats(struct sidtab *sidtab, char *page); int sidtab_hash_stats(struct sidtab *sidtab, char *page);
#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry,
const char *str, u32 str_len);
int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry,
char **out, u32 *out_len);
#else
static inline void sidtab_sid2str_put(struct sidtab *s,
struct sidtab_entry *entry,
const char *str, u32 str_len)
{
}
static inline int sidtab_sid2str_get(struct sidtab *s,
struct sidtab_entry *entry,
char **out, u32 *out_len)
{
return -ENOENT;
}
#endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */
#endif /* _SS_SIDTAB_H_ */ #endif /* _SS_SIDTAB_H_ */