diff options
author | rwatson <rwatson@FreeBSD.org> | 2009-06-03 18:46:28 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2009-06-03 18:46:28 +0000 |
commit | 849a8ce20b26266bfcee925d683db20bee2a0ccd (patch) | |
tree | c959f41a3828e52e4d9970ee9fff5c64a88ca36e /sys/security/mac/mac_socket.c | |
parent | 673e1d1fc9eb778be5e4ca28de814387aca23ab8 (diff) | |
download | FreeBSD-src-849a8ce20b26266bfcee925d683db20bee2a0ccd.zip FreeBSD-src-849a8ce20b26266bfcee925d683db20bee2a0ccd.tar.gz |
Continue work to optimize performance of "options MAC" when no MAC policy
modules are loaded by avoiding mbuf label lookups when policies aren't
loaded, pushing further socket locking into MAC policy modules, and
avoiding locking MAC ifnet locks when no policies are loaded:
- Check mac_policies_count before looking for mbuf MAC label m_tags in MAC
Framework entry points. We will still pay label lookup costs if MAC
policies are present but don't require labels (typically a single mbuf
header field read, but perhaps further indirection if IPSEC or other
m_tag consumers are in use).
- Further push socket locking for socket-related access control checks and
events into MAC policies from the MAC Framework, so that sockets are
only locked if a policy specifically requires a lock to protect a label.
This resolves lock order issues during sonewconn() and also in local
domain socket cross-connect where multiple socket locks could not be
held at once for the purposes of propagatig MAC labels across multiple
sockets. Eliminate mac_policy_count check in some entry points where it
no longer avoids locking.
- Add mac_policy_count checking in some entry points relating to network
interfaces that otherwise lock a global MAC ifnet lock used to protect
ifnet labels.
Obtained from: TrustedBSD Project
Diffstat (limited to 'sys/security/mac/mac_socket.c')
-rw-r--r-- | sys/security/mac/mac_socket.c | 76 |
1 files changed, 13 insertions, 63 deletions
diff --git a/sys/security/mac/mac_socket.c b/sys/security/mac/mac_socket.c index 704c60b..11d5e05 100644 --- a/sys/security/mac/mac_socket.c +++ b/sys/security/mac/mac_socket.c @@ -88,6 +88,16 @@ __FBSDID("$FreeBSD$"); * remote socket for UNIX domain sockets rather than keeping a local copy on * this endpoint, but be cached and updated based on packets received for * TCP/IP. + * + * Unlike with many other object types, the lock protecting MAC labels on + * sockets (the socket lock) is not frequently held at the points in code + * where socket-related checks are called. The MAC Framework acquires the + * lock over some entry points in order to enforce atomicity (such as label + * copies) but in other cases the policy modules will have to acquire the + * lock themselves if they use labels. This approach (a) avoids lock + * acquisitions when policies don't require labels and (b) solves a number of + * potential lock order issues when multiple sockets are used in the same + * entry point. */ struct label * @@ -234,13 +244,8 @@ void mac_socket_newconn(struct socket *oldso, struct socket *newso) { - if (mac_policy_count == 0) - return; - - SOCK_LOCK(oldso); MAC_POLICY_PERFORM_NOSLEEP(socket_newconn, oldso, oldso->so_label, newso, newso->so_label); - SOCK_UNLOCK(oldso); } static void @@ -259,12 +264,13 @@ mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so) { struct label *label; + if (mac_policy_count == 0) + return; + label = mac_mbuf_to_label(m); - SOCK_LOCK(so); MAC_POLICY_PERFORM_NOSLEEP(socketpeer_set_from_mbuf, m, label, so, so->so_peerlabel); - SOCK_UNLOCK(so); } void @@ -274,15 +280,8 @@ mac_socketpeer_set_from_socket(struct socket *oldso, struct socket *newso) if (mac_policy_count == 0) return; - /* - * XXXRW: We want to hold locks on both sockets, but can't currently - * due to lock order -- opt to lock the socket where we're accessing - * so_label as it's more likely to change. - */ - SOCK_LOCK(oldso); MAC_POLICY_PERFORM_NOSLEEP(socketpeer_set_from_socket, oldso, oldso->so_label, newso, newso->so_peerlabel); - SOCK_UNLOCK(oldso); } void @@ -295,10 +294,8 @@ mac_socket_create_mbuf(struct socket *so, struct mbuf *m) label = mac_mbuf_to_label(m); - SOCK_LOCK(so); MAC_POLICY_PERFORM_NOSLEEP(socket_create_mbuf, so, so->so_label, m, label); - SOCK_UNLOCK(so); } MAC_CHECK_PROBE_DEFINE2(socket_check_accept, "struct ucred *", @@ -309,14 +306,9 @@ mac_socket_check_accept(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_accept, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_accept, error, cred, so); - SOCK_UNLOCK(so); return (error); } @@ -330,14 +322,9 @@ mac_socket_check_bind(struct ucred *cred, struct socket *so, { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_bind, cred, so, so->so_label, sa); MAC_CHECK_PROBE3(socket_check_bind, error, cred, so, sa); - SOCK_UNLOCK(so); return (error); } @@ -351,14 +338,9 @@ mac_socket_check_connect(struct ucred *cred, struct socket *so, { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_connect, cred, so, so->so_label, sa); MAC_CHECK_PROBE3(socket_check_connect, error, cred, so, sa); - SOCK_UNLOCK(so); return (error); } @@ -393,11 +375,9 @@ mac_socket_check_deliver(struct socket *so, struct mbuf *m) label = mac_mbuf_to_label(m); - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_deliver, so, so->so_label, m, label); MAC_CHECK_PROBE2(socket_check_deliver, error, so, m); - SOCK_UNLOCK(so); return (error); } @@ -410,14 +390,9 @@ mac_socket_check_listen(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_listen, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_listen, error, cred, so); - SOCK_UNLOCK(so); return (error); } @@ -430,13 +405,8 @@ mac_socket_check_poll(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_poll, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_poll, error, cred, so); - SOCK_UNLOCK(so); return (error); } @@ -449,14 +419,9 @@ mac_socket_check_receive(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_receive, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_receive, error, cred, so); - SOCK_UNLOCK(so); return (error); } @@ -487,13 +452,8 @@ mac_socket_check_send(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_send, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_send, error, cred, so); - SOCK_UNLOCK(so); return (error); } @@ -506,13 +466,8 @@ mac_socket_check_stat(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_stat, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_stat, error, cred, so); - SOCK_UNLOCK(so); return (error); } @@ -525,14 +480,9 @@ mac_socket_check_visible(struct ucred *cred, struct socket *so) { int error; - if (mac_policy_count == 0) - return (0); - - SOCK_LOCK(so); MAC_POLICY_CHECK_NOSLEEP(socket_check_visible, cred, so, so->so_label); MAC_CHECK_PROBE2(socket_check_visible, error, cred, so); - SOCK_UNLOCK(so); return (error); } |