summaryrefslogtreecommitdiffstats
path: root/sys/security/mac_mls
diff options
context:
space:
mode:
authorrwatson <rwatson@FreeBSD.org>2009-06-03 18:46:28 +0000
committerrwatson <rwatson@FreeBSD.org>2009-06-03 18:46:28 +0000
commit849a8ce20b26266bfcee925d683db20bee2a0ccd (patch)
treec959f41a3828e52e4d9970ee9fff5c64a88ca36e /sys/security/mac_mls
parent673e1d1fc9eb778be5e4ca28de814387aca23ab8 (diff)
downloadFreeBSD-src-849a8ce20b26266bfcee925d683db20bee2a0ccd.zip
FreeBSD-src-849a8ce20b26266bfcee925d683db20bee2a0ccd.tar.gz
Continue work to optimize performance of "options MAC" when no MAC policy
modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project
Diffstat (limited to 'sys/security/mac_mls')
-rw-r--r--sys/security/mac_mls/mac_mls.c47
1 files changed, 38 insertions, 9 deletions
diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c
index 6d13505..a0669c7 100644
--- a/sys/security/mac_mls/mac_mls.c
+++ b/sys/security/mac_mls/mac_mls.c
@@ -1,5 +1,5 @@
/*-
- * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2007-2009 Robert N. M. Watson
* Copyright (c) 2001-2005 McAfee, Inc.
* Copyright (c) 2006 SPARTA, Inc.
* All rights reserved.
@@ -1116,6 +1116,8 @@ mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
{
struct mac_mls *source, *dest;
+ SOCK_LOCK_ASSERT(so);
+
source = SLOT(solabel);
dest = SLOT(inplabel);
@@ -1623,6 +1625,7 @@ mls_socket_check_deliver(struct socket *so, struct label *solabel,
struct mbuf *m, struct label *mlabel)
{
struct mac_mls *p, *s;
+ int error;
if (!mls_enabled)
return (0);
@@ -1630,7 +1633,11 @@ mls_socket_check_deliver(struct socket *so, struct label *solabel,
p = SLOT(mlabel);
s = SLOT(solabel);
- return (mls_equal_effective(p, s) ? 0 : EACCES);
+ SOCK_LOCK(so);
+ error = mls_equal_effective(p, s) ? 0 : EACCES;
+ SOCK_UNLOCK(so);
+
+ return (error);
}
static int
@@ -1640,6 +1647,8 @@ mls_socket_check_relabel(struct ucred *cred, struct socket *so,
struct mac_mls *subj, *obj, *new;
int error;
+ SOCK_LOCK_ASSERT(so);
+
new = SLOT(newlabel);
subj = SLOT(cred->cr_label);
obj = SLOT(solabel);
@@ -1696,8 +1705,12 @@ mls_socket_check_visible(struct ucred *cred, struct socket *so,
subj = SLOT(cred->cr_label);
obj = SLOT(solabel);
- if (!mls_dominate_effective(subj, obj))
+ SOCK_LOCK(so);
+ if (!mls_dominate_effective(subj, obj)) {
+ SOCK_UNLOCK(so);
return (ENOENT);
+ }
+ SOCK_UNLOCK(so);
return (0);
}
@@ -1723,19 +1736,26 @@ mls_socket_create_mbuf(struct socket *so, struct label *solabel,
source = SLOT(solabel);
dest = SLOT(mlabel);
+ SOCK_LOCK(so);
mls_copy_effective(source, dest);
+ SOCK_UNLOCK(so);
}
static void
mls_socket_newconn(struct socket *oldso, struct label *oldsolabel,
struct socket *newso, struct label *newsolabel)
{
- struct mac_mls *source, *dest;
+ struct mac_mls source, *dest;
+
+ SOCK_LOCK(oldso);
+ source = *SLOT(oldsolabel);
+ SOCK_UNLOCK(oldso);
- source = SLOT(oldsolabel);
dest = SLOT(newsolabel);
- mls_copy_effective(source, dest);
+ SOCK_LOCK(newso);
+ mls_copy_effective(&source, dest);
+ SOCK_UNLOCK(newso);
}
static void
@@ -1744,6 +1764,8 @@ mls_socket_relabel(struct ucred *cred, struct socket *so,
{
struct mac_mls *source, *dest;
+ SOCK_LOCK_ASSERT(so);
+
source = SLOT(newlabel);
dest = SLOT(solabel);
@@ -1759,7 +1781,9 @@ mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
source = SLOT(mlabel);
dest = SLOT(sopeerlabel);
+ SOCK_LOCK(so);
mls_copy_effective(source, dest);
+ SOCK_UNLOCK(so);
}
static void
@@ -1767,12 +1791,17 @@ mls_socketpeer_set_from_socket(struct socket *oldso,
struct label *oldsolabel, struct socket *newso,
struct label *newsopeerlabel)
{
- struct mac_mls *source, *dest;
+ struct mac_mls source, *dest;
+
+ SOCK_LOCK(oldso);
+ source = *SLOT(oldsolabel);
+ SOCK_UNLOCK(oldso);
- source = SLOT(oldsolabel);
dest = SLOT(newsopeerlabel);
- mls_copy_effective(source, dest);
+ SOCK_LOCK(newso);
+ mls_copy_effective(&source, dest);
+ SOCK_UNLOCK(newso);
}
static void
OpenPOWER on IntegriCloud