From patchwork Wed May 30 14:11:02 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Enderborg X-Patchwork-Id: 10439097 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B2E1E60327 for ; Wed, 30 May 2018 14:22:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E16428E5D for ; Wed, 30 May 2018 14:22:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 92DBB28E89; Wed, 30 May 2018 14:22:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 189B128E5D for ; Wed, 30 May 2018 14:22:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753167AbeE3OVj (ORCPT ); Wed, 30 May 2018 10:21:39 -0400 Received: from seldsegrel01.sonyericsson.com ([37.139.156.29]:11379 "EHLO SELDSEGREL01.sonyericsson.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752975AbeE3OVh (ORCPT ); Wed, 30 May 2018 10:21:37 -0400 From: Peter Enderborg To: , Paul Moore , Stephen Smalley , Eric Paris , James Morris , Daniel Jurgens , Doug Ledford , , , , "Serge E . Hallyn" , "Paul E . McKenney" Subject: [PATCH V3 3/5 selinux-next] selinux: sidtab_clone switch to use rwlock. Date: Wed, 30 May 2018 16:11:02 +0200 Message-ID: <20180530141104.28569-4-peter.enderborg@sony.com> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20180530141104.28569-1-peter.enderborg@sony.com> References: <20180530141104.28569-1-peter.enderborg@sony.com> MIME-Version: 1.0 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP We need a copy of sidtabs, so change the generic sidtab_clone as from a function pointer and let it use a read rwlock while do the clone. Signed-off-by: Peter Enderborg --- security/selinux/ss/services.c | 20 +------------------- security/selinux/ss/sidtab.c | 39 ++++++++++++++++++++++++++++++++------- security/selinux/ss/sidtab.h | 3 ++- 3 files changed, 35 insertions(+), 27 deletions(-) diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 4f3ce389084c..2be471d72c85 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1891,19 +1891,6 @@ int security_change_sid(struct selinux_state *state, out_sid, false); } -/* Clone the SID into the new SID table. */ -static int clone_sid(u32 sid, - struct context *context, - void *arg) -{ - struct sidtab *s = arg; - - if (sid > SECINITSID_NUM) - return sidtab_insert(s, sid, context); - else - return 0; -} - static inline int convert_context_handle_invalid_context( struct selinux_state *state, struct context *context) @@ -2199,10 +2186,7 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len) goto err; } - /* Clone the SID table. */ - sidtab_shutdown(old_set->sidtab); - - rc = sidtab_map(old_set->sidtab, clone_sid, next_set->sidtab); + rc = sidtab_clone(old_set->sidtab, next_set->sidtab); if (rc) goto err; @@ -2926,8 +2910,6 @@ int security_set_bools(struct selinux_state *state, int len, int *values) goto out; } - seqno = ++state->ss->latest_granting; - state->ss->active_set = next_set; rc = 0; out: if (!rc) { diff --git a/security/selinux/ss/sidtab.c b/security/selinux/ss/sidtab.c index 5be31b7af225..811503cd7c2b 100644 --- a/security/selinux/ss/sidtab.c +++ b/security/selinux/ss/sidtab.c @@ -27,7 +27,7 @@ int sidtab_init(struct sidtab *s) s->nel = 0; s->next_sid = 1; s->shutdown = 0; - spin_lock_init(&s->lock); + rwlock_init(&s->lock); return 0; } @@ -116,6 +116,31 @@ struct context *sidtab_search_force(struct sidtab *s, u32 sid) return sidtab_search_core(s, sid, 1); } +int sidtab_clone(struct sidtab *s, struct sidtab *d) +{ + int i, rc = 0; + struct sidtab_node *cur; + + if (!s || !d) + goto errout; + + read_lock(&s->lock); + for (i = 0; i < SIDTAB_SIZE; i++) { + cur = s->htable[i]; + while (cur) { + if (cur->sid > SECINITSID_NUM) + rc = sidtab_insert(d, cur->sid, &cur->context); + if (rc) + goto out; + cur = cur->next; + } + } +out: + read_unlock(&s->lock); +errout: + return rc; +} + int sidtab_map(struct sidtab *s, int (*apply) (u32 sid, struct context *context, @@ -202,7 +227,7 @@ int sidtab_context_to_sid(struct sidtab *s, if (!sid) sid = sidtab_search_context(s, context); if (!sid) { - spin_lock_irqsave(&s->lock, flags); + write_lock_irqsave(&s->lock, flags); /* Rescan now that we hold the lock. */ sid = sidtab_search_context(s, context); if (sid) @@ -221,7 +246,7 @@ int sidtab_context_to_sid(struct sidtab *s, if (ret) s->next_sid--; unlock_out: - spin_unlock_irqrestore(&s->lock, flags); + write_unlock_irqrestore(&s->lock, flags); } if (ret) @@ -287,21 +312,21 @@ void sidtab_set(struct sidtab *dst, struct sidtab *src) unsigned long flags; int i; - spin_lock_irqsave(&src->lock, flags); + write_lock_irqsave(&src->lock, flags); dst->htable = src->htable; dst->nel = src->nel; dst->next_sid = src->next_sid; dst->shutdown = 0; for (i = 0; i < SIDTAB_CACHE_LEN; i++) dst->cache[i] = NULL; - spin_unlock_irqrestore(&src->lock, flags); + write_unlock_irqrestore(&src->lock, flags); } void sidtab_shutdown(struct sidtab *s) { unsigned long flags; - spin_lock_irqsave(&s->lock, flags); + write_lock_irqsave(&s->lock, flags); s->shutdown = 1; - spin_unlock_irqrestore(&s->lock, flags); + write_unlock_irqrestore(&s->lock, flags); } diff --git a/security/selinux/ss/sidtab.h b/security/selinux/ss/sidtab.h index a1a1d2617b6f..6751f8bcbd66 100644 --- a/security/selinux/ss/sidtab.h +++ b/security/selinux/ss/sidtab.h @@ -29,7 +29,7 @@ struct sidtab { unsigned char shutdown; #define SIDTAB_CACHE_LEN 3 struct sidtab_node *cache[SIDTAB_CACHE_LEN]; - spinlock_t lock; + rwlock_t lock; }; int sidtab_init(struct sidtab *s); @@ -51,6 +51,7 @@ void sidtab_hash_eval(struct sidtab *h, char *tag); void sidtab_destroy(struct sidtab *s); void sidtab_set(struct sidtab *dst, struct sidtab *src); void sidtab_shutdown(struct sidtab *s); +int sidtab_clone(struct sidtab *s, struct sidtab *d); #endif /* _SS_SIDTAB_H_ */