svn commit: r363886 - head/sys/security/mac

[Mateusz Guzik]

Author: mjg
Date: Wed Aug  5 07:34:45 2020
New Revision: 363886
URL: https://svnweb.freebsd.org/changeset/base/363886

Log:
  vfs: add a cheaper entry for mac_vnode_check_access

Modified:
  head/sys/security/mac/mac_framework.c
  head/sys/security/mac/mac_framework.h
  head/sys/security/mac/mac_vfs.c

Modified: head/sys/security/mac/mac_framework.c
==============================================================================
--- head/sys/security/mac/mac_framework.c	Wed Aug  5 07:33:39 2020	(r363885)
+++ head/sys/security/mac/mac_framework.c	Wed Aug  5 07:34:45 2020	(r363886)
@@ -140,6 +140,7 @@ FPFLAG(vnode_check_write);
 FPFLAG(vnode_check_mmap);
 FPFLAG_RARE(vnode_check_poll);
 FPFLAG_RARE(vnode_check_rename_from);
+FPFLAG_RARE(vnode_check_access);
 
 #undef FPFLAG
 #undef FPFLAG_RARE
@@ -430,6 +431,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_ar
 		.flag = &mac_vnode_check_poll_fp_flag },
 	{ .offset = FPO(vnode_check_rename_from),
 		.flag = &mac_vnode_check_rename_from_fp_flag },
+	{ .offset = FPO(vnode_check_access),
+		.flag = &mac_vnode_check_access_fp_flag },
 };
 
 static void

Modified: head/sys/security/mac/mac_framework.h
==============================================================================
--- head/sys/security/mac/mac_framework.h	Wed Aug  5 07:33:39 2020	(r363885)
+++ head/sys/security/mac/mac_framework.h	Wed Aug  5 07:34:45 2020	(r363886)
@@ -406,8 +406,20 @@ void	mac_vnode_assert_locked(struct vnode *vp, const c
 
 int	mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp);
 void	mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp);
-int	mac_vnode_check_access(struct ucred *cred, struct vnode *vp,
+int	mac_vnode_check_access_impl(struct ucred *cred, struct vnode *dvp,
 	    accmode_t accmode);
+extern bool mac_vnode_check_access_fp_flag;
+#define mac_vnode_check_access_enabled() __predict_false(mac_vnode_check_access_fp_flag)
+static inline int
+mac_vnode_check_access(struct ucred *cred, struct vnode *dvp,
+    accmode_t accmode)
+{
+
+	mac_vnode_assert_locked(dvp, "mac_vnode_check_access");
+	if (mac_vnode_check_access_enabled())
+                return (mac_vnode_check_access_impl(cred, dvp, accmode));
+	return (0);
+}
 int	mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp);
 int	mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp);
 int	mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,

Modified: head/sys/security/mac/mac_vfs.c
==============================================================================
--- head/sys/security/mac/mac_vfs.c	Wed Aug  5 07:33:39 2020	(r363885)
+++ head/sys/security/mac/mac_vfs.c	Wed Aug  5 07:34:45 2020	(r363886)
@@ -372,7 +372,7 @@ MAC_CHECK_PROBE_DEFINE3(vnode_check_access, "struct uc
     "struct vnode *", "accmode_t");
 
 int
-mac_vnode_check_access(struct ucred *cred, struct vnode *vp, accmode_t accmode)
+mac_vnode_check_access_impl(struct ucred *cred, struct vnode *vp, accmode_t accmode)
 {
 	int error;