diff options
Diffstat (limited to 'sys/security')
-rw-r--r-- | sys/security/audit/audit_arg.c | 11 | ||||
-rw-r--r-- | sys/security/audit/audit_syscalls.c | 8 | ||||
-rw-r--r-- | sys/security/audit/audit_worker.c | 8 | ||||
-rw-r--r-- | sys/security/mac/mac_process.c | 8 | ||||
-rw-r--r-- | sys/security/mac/mac_syscalls.c | 33 |
5 files changed, 15 insertions, 53 deletions
diff --git a/sys/security/audit/audit_arg.c b/sys/security/audit/audit_arg.c index e4409f2..f19375d 100644 --- a/sys/security/audit/audit_arg.c +++ b/sys/security/audit/audit_arg.c @@ -651,7 +651,6 @@ audit_arg_file(struct proc *p, struct file *fp) struct socket *so; struct inpcb *pcb; struct vnode *vp; - int vfslocked; ar = currecord(); if (ar == NULL) @@ -664,11 +663,9 @@ audit_arg_file(struct proc *p, struct file *fp) * XXXAUDIT: Only possibly to record as first vnode? */ vp = fp->f_vnode; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); vn_lock(vp, LK_SHARED | LK_RETRY); audit_arg_vnode1(vp); VOP_UNLOCK(vp, 0); - VFS_UNLOCK_GIANT(vfslocked); break; case DTYPE_SOCKET: @@ -768,11 +765,6 @@ audit_arg_vnode(struct vnode *vp, struct vnode_au_info *vnp) struct vattr vattr; int error; - /* - * Assume that if the caller is calling audit_arg_vnode() on a - * non-MPSAFE vnode, then it will have acquired Giant. - */ - VFS_ASSERT_GIANT(vp->v_mount); ASSERT_VOP_LOCKED(vp, "audit_arg_vnode"); error = VOP_GETATTR(vp, &vattr, curthread->td_ucred); @@ -889,7 +881,6 @@ audit_sysclose(struct thread *td, int fd) struct kaudit_record *ar; struct vnode *vp; struct file *fp; - int vfslocked; KASSERT(td != NULL, ("audit_sysclose: td == NULL")); @@ -903,10 +894,8 @@ audit_sysclose(struct thread *td, int fd) return; vp = fp->f_vnode; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); vn_lock(vp, LK_SHARED | LK_RETRY); audit_arg_vnode1(vp); VOP_UNLOCK(vp, 0); - VFS_UNLOCK_GIANT(vfslocked); fdrop(fp, td); } diff --git a/sys/security/audit/audit_syscalls.c b/sys/security/audit/audit_syscalls.c index bf60874..acf005e 100644 --- a/sys/security/audit/audit_syscalls.c +++ b/sys/security/audit/audit_syscalls.c @@ -749,7 +749,7 @@ sys_auditctl(struct thread *td, struct auditctl_args *uap) struct ucred *cred; struct vnode *vp; int error = 0; - int flags, vfslocked; + int flags; if (jailed(td->td_ucred)) return (ENOSYS); @@ -770,20 +770,18 @@ sys_auditctl(struct thread *td, struct auditctl_args *uap) if (uap->path == NULL) return (EINVAL); - NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | MPSAFE | AUDITVNODE1, + NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, UIO_USERSPACE, uap->path, td); flags = AUDIT_OPEN_FLAGS; error = vn_open(&nd, &flags, 0, NULL); if (error) return (error); - vfslocked = NDHASGIANT(&nd); vp = nd.ni_vp; #ifdef MAC error = mac_system_check_auditctl(td->td_ucred, vp); VOP_UNLOCK(vp, 0); if (error) { vn_close(vp, AUDIT_CLOSE_FLAGS, td->td_ucred, td); - VFS_UNLOCK_GIANT(vfslocked); return (error); } #else @@ -792,10 +790,8 @@ sys_auditctl(struct thread *td, struct auditctl_args *uap) NDFREE(&nd, NDF_ONLY_PNBUF); if (vp->v_type != VREG) { vn_close(vp, AUDIT_CLOSE_FLAGS, td->td_ucred, td); - VFS_UNLOCK_GIANT(vfslocked); return (EINVAL); } - VFS_UNLOCK_GIANT(vfslocked); cred = td->td_ucred; crhold(cred); diff --git a/sys/security/audit/audit_worker.c b/sys/security/audit/audit_worker.c index 631b29f..d21ae18 100644 --- a/sys/security/audit/audit_worker.c +++ b/sys/security/audit/audit_worker.c @@ -113,7 +113,7 @@ audit_record_write(struct vnode *vp, struct ucred *cred, void *data, static struct timeval last_fail; static int cur_lowspace_trigger; struct statfs *mnt_stat; - int error, vfslocked; + int error; static int cur_fail; struct vattr vattr; long temp; @@ -124,7 +124,6 @@ audit_record_write(struct vnode *vp, struct ucred *cred, void *data, return; mnt_stat = &vp->v_mount->mnt_stat; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); /* * First, gather statistics on the audit log file and file system so @@ -258,7 +257,6 @@ audit_record_write(struct vnode *vp, struct ucred *cred, void *data, } } - VFS_UNLOCK_GIANT(vfslocked); return; fail_enospc: @@ -289,7 +287,6 @@ fail: panic("audit_worker: write error %d\n", error); } else if (ppsratecheck(&last_fail, &cur_fail, 1)) printf("audit_worker: write error %d\n", error); - VFS_UNLOCK_GIANT(vfslocked); } /* @@ -451,7 +448,6 @@ audit_rotate_vnode(struct ucred *cred, struct vnode *vp) { struct ucred *old_audit_cred; struct vnode *old_audit_vp; - int vfslocked; KASSERT((cred != NULL && vp != NULL) || (cred == NULL && vp == NULL), ("audit_rotate_vnode: cred %p vp %p", cred, vp)); @@ -473,10 +469,8 @@ audit_rotate_vnode(struct ucred *cred, struct vnode *vp) * If there was an old vnode/credential, close and free. */ if (old_audit_vp != NULL) { - vfslocked = VFS_LOCK_GIANT(old_audit_vp->v_mount); vn_close(old_audit_vp, AUDIT_CLOSE_FLAGS, old_audit_cred, curthread); - VFS_UNLOCK_GIANT(vfslocked); crfree(old_audit_cred); } } diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index 214e748..8e5e5bc 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -254,7 +254,7 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { vm_map_entry_t vme; - int vfslocked, result; + int result; vm_prot_t revokeperms; vm_object_t backing_object, object; vm_ooffset_t offset; @@ -300,7 +300,6 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); result = vme->max_protection; mac_vnode_check_mmap_downgrade(cred, vp, &result); @@ -310,10 +309,8 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, * but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; - if (!revokeperms) { - VFS_UNLOCK_GIANT(vfslocked); + if (!revokeperms) continue; - } printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, @@ -369,7 +366,6 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } - VFS_UNLOCK_GIANT(vfslocked); } vm_map_unlock(map); } diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index a20938c..ff55ec9 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -230,7 +230,7 @@ sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) struct pipe *pipe; struct socket *so; short label_type; - int vfslocked, error; + int error; error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) @@ -262,11 +262,9 @@ sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) } vp = fp->f_vnode; intlabel = mac_vnode_label_alloc(); - vfslocked = VFS_LOCK_GIANT(vp->v_mount); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); mac_vnode_copy_label(vp->v_label, intlabel); VOP_UNLOCK(vp, 0); - VFS_UNLOCK_GIANT(vfslocked); error = mac_vnode_externalize_label(intlabel, elements, buffer, mac.m_buflen); mac_vnode_label_free(intlabel); @@ -322,7 +320,7 @@ sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap) struct nameidata nd; struct label *intlabel; struct mac mac; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -343,20 +341,18 @@ sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap) } buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | FOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); if (error) goto out; intlabel = mac_vnode_label_alloc(); - vfslocked = NDHASGIANT(&nd); mac_vnode_copy_label(nd.ni_vp->v_label, intlabel); error = mac_vnode_externalize_label(intlabel, elements, buffer, mac.m_buflen); NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); if (error == 0) error = copyout(buffer, mac.m_string, strlen(buffer)+1); @@ -375,7 +371,7 @@ sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap) struct nameidata nd; struct label *intlabel; struct mac mac; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -396,19 +392,17 @@ sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap) } buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | NOFOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); if (error) goto out; intlabel = mac_vnode_label_alloc(); - vfslocked = NDHASGIANT(&nd); mac_vnode_copy_label(nd.ni_vp->v_label, intlabel); error = mac_vnode_externalize_label(intlabel, elements, buffer, mac.m_buflen); NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); if (error == 0) @@ -432,7 +426,7 @@ sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) struct vnode *vp; struct mac mac; char *buffer; - int error, vfslocked; + int error; error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) @@ -467,10 +461,8 @@ sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) break; } vp = fp->f_vnode; - vfslocked = VFS_LOCK_GIANT(vp->v_mount); error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) { - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); break; } @@ -478,7 +470,6 @@ sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) error = vn_setlabel(vp, intlabel, td->td_ucred); VOP_UNLOCK(vp, 0); vn_finished_write(mp); - VFS_UNLOCK_GIANT(vfslocked); mac_vnode_label_free(intlabel); break; @@ -532,7 +523,7 @@ sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) struct mount *mp; struct mac mac; char *buffer; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -558,10 +549,9 @@ sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) if (error) goto out; - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | FOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); - vfslocked = NDHASGIANT(&nd); if (error == 0) { error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error == 0) { @@ -572,7 +562,6 @@ sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) } NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); out: mac_vnode_label_free(intlabel); return (error); @@ -586,7 +575,7 @@ sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) struct mount *mp; struct mac mac; char *buffer; - int vfslocked, error; + int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); @@ -612,10 +601,9 @@ sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) if (error) goto out; - NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | NOFOLLOW, UIO_USERSPACE, + NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p, td); error = namei(&nd); - vfslocked = NDHASGIANT(&nd); if (error == 0) { error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error == 0) { @@ -626,7 +614,6 @@ sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) } NDFREE(&nd, 0); - VFS_UNLOCK_GIANT(vfslocked); out: mac_vnode_label_free(intlabel); return (error); |