GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-27 17:11:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

SELinux: Improve read/write performance

Browse source 
It reduces the selinux overhead on read/write by only revalidating
permissions in selinux_file_permission if the task or inode labels have
changed or the policy has changed since the open-time check.  A new LSM
hook, security_dentry_open, is added to capture the necessary state at open
time to allow this optimization.

(see http://marc.info/?l=selinux&m=118972995207740&w=2)

Signed-off-by: Yuichi Nakamura<ynakam@hitachisoft.jp>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Yuichi Nakamura 2007-09-14 09:27:07 +09:00 • committed by James Morris
parent 3232c110b5
commit 788e7dd4c2
7 changed files with 89 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
include/linux/security.h
View file

@ -504,6 +504,13 @@ struct request_sock;
* @file contains the file structure being received.
* Return 0 if permission is granted.
*
* Security hook for dentry
*
* @dentry_open
* Save open-time permission checking state for later use upon
* file_permission, and recheck access if anything has changed
* since inode_permission.
*
* Security hooks for task operations.
*
* @task_create:
@ -1256,6 +1263,7 @@ struct security_operations {
int (*file_send_sigiotask) (struct task_struct * tsk,
struct fown_struct * fown, int sig);
int (*file_receive) (struct file * file);
int (*dentry_open) (struct file *file);
int (*task_create) (unsigned long clone_flags);
int (*task_alloc_security) (struct task_struct * p);
@ -1864,6 +1872,11 @@ static inline int security_file_receive (struct file *file)
return security_ops->file_receive (file);
}
static inline int security_dentry_open (struct file *file)
{
return security_ops->dentry_open (file);
}
static inline int security_task_create (unsigned long clone_flags)
{
return security_ops->task_create (clone_flags);
@ -2546,6 +2559,11 @@ static inline int security_file_receive (struct file *file)
return 0;
}
static inline int security_dentry_open (struct file *file)
{
return 0;
}
static inline int security_task_create (unsigned long clone_flags)
{
return 0;