git: 77589de8aa67 - main - mac: cheaper check for mac_vnode_check_readlink

[Mateusz Guzik]

The branch main has been updated by mjg:

URL: https://cgit.FreeBSD.org/src/commit/?id=77589de8aa67f6a06ce01dd951a91f5a2f216560

commit 77589de8aa67f6a06ce01dd951a91f5a2f216560
Author:     Mateusz Guzik <mjg at FreeBSD.org>
AuthorDate: 2021-01-08 02:52:35 +0000
Commit:     Mateusz Guzik <mjg at FreeBSD.org>
CommitDate: 2021-01-08 13:57:10 +0000

    mac: cheaper check for mac_vnode_check_readlink
---
 sys/security/mac/mac_framework.c |  3 +++
 sys/security/mac/mac_framework.h | 17 ++++++++++++++++-
 sys/security/mac/mac_vfs.c       |  2 +-
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index c1d52eff383e..f0b4f89db7ca 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -142,6 +142,7 @@ FPFLAG(vnode_check_mmap);
 FPFLAG_RARE(vnode_check_poll);
 FPFLAG_RARE(vnode_check_rename_from);
 FPFLAG_RARE(vnode_check_access);
+FPFLAG_RARE(vnode_check_readlink);
 FPFLAG_RARE(pipe_check_stat);
 FPFLAG_RARE(pipe_check_poll);
 
@@ -422,6 +423,8 @@ struct mac_policy_fastpath_elem mac_policy_fastpath_array[] = {
 	{ .offset = FPO(priv_grant), .flag = &mac_priv_grant_fp_flag },
 	{ .offset = FPO(vnode_check_lookup),
 		.flag = &mac_vnode_check_lookup_fp_flag },
+	{ .offset = FPO(vnode_check_readlink),
+		.flag = &mac_vnode_check_readlink_fp_flag },
 	{ .offset = FPO(vnode_check_open),
 		.flag = &mac_vnode_check_open_fp_flag },
 	{ .offset = FPO(vnode_check_stat),
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index ea061d6258ff..481f90a04801 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -538,7 +538,22 @@ mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
 }
 #endif
 int	mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp);
-int	mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp);
+int	mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *dvp);
+#ifdef MAC
+extern bool mac_vnode_check_readlink_fp_flag;
+#else
+#define mac_vnode_check_readlink_fp_flag 0
+#endif
+#define mac_vnode_check_readlink_enabled() __predict_false(mac_vnode_check_readlink_fp_flag)
+static inline int
+mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
+{
+
+	mac_vnode_assert_locked(vp, "mac_vnode_check_readlink");
+	if (mac_vnode_check_readlink_enabled())
+		return (mac_vnode_check_readlink_impl(cred, vp));
+	return (0);
+}
 #define mac_vnode_check_rename_from_enabled() __predict_false(mac_vnode_check_rename_from_fp_flag)
 #ifdef MAC
 extern bool mac_vnode_check_rename_from_fp_flag;
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index ec492ba243e6..323d693387bb 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -701,7 +701,7 @@ MAC_CHECK_PROBE_DEFINE2(vnode_check_readlink, "struct ucred *",
     "struct vnode *");
 
 int
-mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
+mac_vnode_check_readlink_impl(struct ucred *cred, struct vnode *vp)
 {
 	int error;