Slightly change the semantics of vnode labels for MAC: rather than

"refreshing" the label on the vnode before use, just get the label
right from inception.  For single-label file systems, set the label
in the generic VFS getnewvnode() code; for multi-label file systems,
leave the labeling up to the file system.  With UFS1/2, this means
reading the extended attribute during vfs_vget() as the inode is
pulled off disk, rather than hitting the extended attributes
frequently during operations later, improving performance.  This
also corrects sematics for shared vnode locks, which were not
previously present in the system.  This chances the cache
coherrency properties WRT out-of-band access to label data, but in
an acceptable form.  With UFS1, there is a small race condition
during automatic extended attribute start -- this is not present
with UFS2, and occurs because EAs aren't available at vnode
inception.  We'll introduce a work around for this shortly.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

3 files changed, 0 insertions, 72 deletions

diff --git a/sys/fs/procfs/procfs.c b/sys/fs/procfs/procfs.c
index e99653a..f6cab6a 100644
--- a/sys/fs/procfs/procfs.c
+++ b/sys/fs/procfs/procfs.c
@@ -153,7 +153,6 @@ procfs_init(PFS_INIT_ARGS)
 	
 	dir = pfs_create_dir(root, "pid",
 	    procfs_attr, NULL, PFS_PROCDEP);
-	dir->pn_refreshlabel = procfs_piddir_refreshlabel;
 	pfs_create_file(dir, "cmdline", procfs_doproccmdline,
 	    NULL, NULL, PFS_RD);
 	pfs_create_file(dir, "ctl", procfs_doprocctl,
diff --git a/sys/fs/procfs/procfs.h b/sys/fs/procfs/procfs.h
index 61f6e954..4baaf50 100644
--- a/sys/fs/procfs/procfs.h
+++ b/sys/fs/procfs/procfs.h
@@ -61,9 +61,6 @@ int	 procfs_close(PFS_CLOSE_ARGS);
 /* Attributes */
 int	 procfs_attr(PFS_ATTR_ARGS);
 
-/* MAC */
-int	procfs_piddir_refreshlabel(PFS_REFRESHLABEL_ARGS);
-
 /* Visibility */
 int	 procfs_notsystem(PFS_VIS_ARGS);
 int	 procfs_candebug(PFS_VIS_ARGS);
diff --git a/sys/fs/procfs/procfs_mac.c b/sys/fs/procfs/procfs_mac.c
deleted file mode 100644
index ea5c9f5..0000000
--- a/sys/fs/procfs/procfs_mac.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/*-
- * Copyright (c) 2002 Network Associates Technology, Inc.
- * All rights reserved.
- *
- * This software was developed in part by NAI Labs, the Security Research
- * Division of Network Associates, Inc. under DARPA/SPAWAR contract
- * N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The names of the authors may not be used to endorse or promote
- *    products derived from this software without specific prior written
- *    permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $FreeBSD$
- */
-
-#include "opt_mac.h"
-
-#include <sys/param.h>
-#include <sys/lock.h>
-#include <sys/mac.h>
-#include <sys/mount.h>
-#include <sys/mutex.h>
-#include <sys/proc.h>
-#include <sys/systm.h>
-#include <sys/ucred.h>
-#include <sys/vnode.h>
-
-#include <fs/pseudofs/pseudofs.h>
-#include <fs/procfs/procfs.h>
-
-int
-procfs_piddir_refreshlabel(PFS_REFRESHLABEL_ARGS)
-{
-#ifdef MAC
-
-	if (p == NULL)
-		mac_update_vnode_from_mount(vp, vp->v_mount);
-	else {
-		PROC_LOCK(p);
-		mac_update_procfsvnode(vp, p->p_ucred);
-		PROC_UNLOCK(p);
-	}
-
-	return (0);
-#else
-	return (EOPNOTSUPP);
-#endif
-}