Skip to content

Commit 225621c

Browse files
WOnder93pcmoore
WOnder93
authored and
pcmoore
committed
selinux: move context hashing under sidtab
Now that context hash computation no longer depends on policydb, we can simplify things by moving the context hashing completely under sidtab. The hash is still cached in sidtab entries, but not for the in-flight context structures. Signed-off-by: Ondrej Mosnacek <[email protected]> Signed-off-by: Paul Moore <[email protected]>
1 parent 5007728 commit 225621c

File tree

5 files changed

+47
-58
lines changed

5 files changed

+47
-58
lines changed

‎security/selinux/ss/context.h

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@ struct context {
3131
u32 len; /* length of string in bytes */
3232
struct mls_range range;
3333
char *str; /* string representation if context cannot be mapped. */
34-
u32 hash; /* a hash of the string representation */
3534
};
3635

3736
static inline void mls_context_init(struct context *c)
@@ -169,13 +168,12 @@ static inline int context_cpy(struct context *dst, struct context *src)
169168
kfree(dst->str);
170169
return rc;
171170
}
172-
dst->hash = src->hash;
173171
return 0;
174172
}
175173

176174
static inline void context_destroy(struct context *c)
177175
{
178-
c->user = c->role = c->type = c->hash = 0;
176+
c->user = c->role = c->type = 0;
179177
kfree(c->str);
180178
c->str = NULL;
181179
c->len = 0;
@@ -184,8 +182,6 @@ static inline void context_destroy(struct context *c)
184182

185183
static inline int context_cmp(struct context *c1, struct context *c2)
186184
{
187-
if (c1->hash && c2->hash && (c1->hash != c2->hash))
188-
return 0;
189185
if (c1->len && c2->len)
190186
return (c1->len == c2->len && !strcmp(c1->str, c2->str));
191187
if (c1->len || c2->len)
@@ -198,10 +194,5 @@ static inline int context_cmp(struct context *c1, struct context *c2)
198194

199195
u32 context_compute_hash(const struct context *c);
200196

201-
static inline void context_add_hash(struct context *context)
202-
{
203-
context->hash = context_compute_hash(context);
204-
}
205-
206197
#endif /* _SS_CONTEXT_H_ */
207198

‎security/selinux/ss/policydb.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -862,8 +862,6 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s)
862862
if (!name)
863863
continue;
864864

865-
context_add_hash(&c->context[0]);
866-
867865
rc = sidtab_set_initial(s, sid, &c->context[0]);
868866
if (rc) {
869867
pr_err("SELinux: unable to load initial SID %s.\n",

‎security/selinux/ss/services.c

Lines changed: 26 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1490,17 +1490,6 @@ static int string_to_context_struct(struct policydb *pol,
14901490
return rc;
14911491
}
14921492

1493-
static int context_struct_to_sid(struct selinux_state *state,
1494-
struct context *context, u32 *sid)
1495-
{
1496-
struct sidtab *sidtab = state->ss->sidtab;
1497-
1498-
if (!context->hash)
1499-
context_add_hash(context);
1500-
1501-
return sidtab_context_to_sid(sidtab, context, sid);
1502-
}
1503-
15041493
static int security_context_to_sid_core(struct selinux_state *state,
15051494
const char *scontext, u32 scontext_len,
15061495
u32 *sid, u32 def_sid, gfp_t gfp_flags,
@@ -1555,7 +1544,7 @@ static int security_context_to_sid_core(struct selinux_state *state,
15551544
str = NULL;
15561545
} else if (rc)
15571546
goto out_unlock;
1558-
rc = context_struct_to_sid(state, &context, sid);
1547+
rc = sidtab_context_to_sid(sidtab, &context, sid);
15591548
context_destroy(&context);
15601549
out_unlock:
15611550
read_unlock(&state->ss->policy_rwlock);
@@ -1865,7 +1854,7 @@ static int security_compute_sid(struct selinux_state *state,
18651854
goto out_unlock;
18661855
}
18671856
/* Obtain the sid for the context. */
1868-
rc = context_struct_to_sid(state, &newcontext, out_sid);
1857+
rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid);
18691858
out_unlock:
18701859
read_unlock(&state->ss->policy_rwlock);
18711860
context_destroy(&newcontext);
@@ -2017,7 +2006,6 @@ static int convert_context(struct context *oldc, struct context *newc, void *p)
20172006
context_init(newc);
20182007
newc->str = s;
20192008
newc->len = oldc->len;
2020-
newc->hash = oldc->hash;
20212009
return 0;
20222010
}
20232011
kfree(s);
@@ -2094,8 +2082,6 @@ static int convert_context(struct context *oldc, struct context *newc, void *p)
20942082
goto bad;
20952083
}
20962084

2097-
context_add_hash(newc);
2098-
20992085
return 0;
21002086
bad:
21012087
/* Map old representation to string and save it. */
@@ -2105,7 +2091,6 @@ static int convert_context(struct context *oldc, struct context *newc, void *p)
21052091
context_destroy(newc);
21062092
newc->str = s;
21072093
newc->len = len;
2108-
context_add_hash(newc);
21092094
pr_info("SELinux: Context %s became invalid (unmapped).\n",
21102095
newc->str);
21112096
return 0;
@@ -2322,12 +2307,14 @@ int security_port_sid(struct selinux_state *state,
23222307
u8 protocol, u16 port, u32 *out_sid)
23232308
{
23242309
struct policydb *policydb;
2310+
struct sidtab *sidtab;
23252311
struct ocontext *c;
23262312
int rc = 0;
23272313

23282314
read_lock(&state->ss->policy_rwlock);
23292315

23302316
policydb = &state->ss->policydb;
2317+
sidtab = state->ss->sidtab;
23312318

23322319
c = policydb->ocontexts[OCON_PORT];
23332320
while (c) {
@@ -2340,7 +2327,7 @@ int security_port_sid(struct selinux_state *state,
23402327

23412328
if (c) {
23422329
if (!c->sid[0]) {
2343-
rc = context_struct_to_sid(state, &c->context[0],
2330+
rc = sidtab_context_to_sid(sidtab, &c->context[0],
23442331
&c->sid[0]);
23452332
if (rc)
23462333
goto out;
@@ -2365,12 +2352,14 @@ int security_ib_pkey_sid(struct selinux_state *state,
23652352
u64 subnet_prefix, u16 pkey_num, u32 *out_sid)
23662353
{
23672354
struct policydb *policydb;
2355+
struct sidtab *sidtab;
23682356
struct ocontext *c;
23692357
int rc = 0;
23702358

23712359
read_lock(&state->ss->policy_rwlock);
23722360

23732361
policydb = &state->ss->policydb;
2362+
sidtab = state->ss->sidtab;
23742363

23752364
c = policydb->ocontexts[OCON_IBPKEY];
23762365
while (c) {
@@ -2384,7 +2373,7 @@ int security_ib_pkey_sid(struct selinux_state *state,
23842373

23852374
if (c) {
23862375
if (!c->sid[0]) {
2387-
rc = context_struct_to_sid(state,
2376+
rc = sidtab_context_to_sid(sidtab,
23882377
&c->context[0],
23892378
&c->sid[0]);
23902379
if (rc)
@@ -2409,12 +2398,14 @@ int security_ib_endport_sid(struct selinux_state *state,
24092398
const char *dev_name, u8 port_num, u32 *out_sid)
24102399
{
24112400
struct policydb *policydb;
2401+
struct sidtab *sidtab;
24122402
struct ocontext *c;
24132403
int rc = 0;
24142404

24152405
read_lock(&state->ss->policy_rwlock);
24162406

24172407
policydb = &state->ss->policydb;
2408+
sidtab = state->ss->sidtab;
24182409

24192410
c = policydb->ocontexts[OCON_IBENDPORT];
24202411
while (c) {
@@ -2429,7 +2420,7 @@ int security_ib_endport_sid(struct selinux_state *state,
24292420

24302421
if (c) {
24312422
if (!c->sid[0]) {
2432-
rc = context_struct_to_sid(state, &c->context[0],
2423+
rc = sidtab_context_to_sid(sidtab, &c->context[0],
24332424
&c->sid[0]);
24342425
if (rc)
24352426
goto out;
@@ -2452,12 +2443,14 @@ int security_netif_sid(struct selinux_state *state,
24522443
char *name, u32 *if_sid)
24532444
{
24542445
struct policydb *policydb;
2446+
struct sidtab *sidtab;
24552447
int rc = 0;
24562448
struct ocontext *c;
24572449

24582450
read_lock(&state->ss->policy_rwlock);
24592451

24602452
policydb = &state->ss->policydb;
2453+
sidtab = state->ss->sidtab;
24612454

24622455
c = policydb->ocontexts[OCON_NETIF];
24632456
while (c) {
@@ -2468,11 +2461,11 @@ int security_netif_sid(struct selinux_state *state,
24682461

24692462
if (c) {
24702463
if (!c->sid[0] || !c->sid[1]) {
2471-
rc = context_struct_to_sid(state, &c->context[0],
2464+
rc = sidtab_context_to_sid(sidtab, &c->context[0],
24722465
&c->sid[0]);
24732466
if (rc)
24742467
goto out;
2475-
rc = context_struct_to_sid(state, &c->context[1],
2468+
rc = sidtab_context_to_sid(sidtab, &c->context[1],
24762469
&c->sid[1]);
24772470
if (rc)
24782471
goto out;
@@ -2513,12 +2506,14 @@ int security_node_sid(struct selinux_state *state,
25132506
u32 *out_sid)
25142507
{
25152508
struct policydb *policydb;
2509+
struct sidtab *sidtab;
25162510
int rc;
25172511
struct ocontext *c;
25182512

25192513
read_lock(&state->ss->policy_rwlock);
25202514

25212515
policydb = &state->ss->policydb;
2516+
sidtab = state->ss->sidtab;
25222517

25232518
switch (domain) {
25242519
case AF_INET: {
@@ -2560,7 +2555,7 @@ int security_node_sid(struct selinux_state *state,
25602555

25612556
if (c) {
25622557
if (!c->sid[0]) {
2563-
rc = context_struct_to_sid(state,
2558+
rc = sidtab_context_to_sid(sidtab,
25642559
&c->context[0],
25652560
&c->sid[0]);
25662561
if (rc)
@@ -2644,17 +2639,12 @@ int security_get_user_sids(struct selinux_state *state,
26442639
usercon.role = i + 1;
26452640
ebitmap_for_each_positive_bit(&role->types, tnode, j) {
26462641
usercon.type = j + 1;
2647-
/*
2648-
* The same context struct is reused here so the hash
2649-
* must be reset.
2650-
*/
2651-
usercon.hash = 0;
26522642

26532643
if (mls_setup_user_range(policydb, fromcon, user,
26542644
&usercon))
26552645
continue;
26562646

2657-
rc = context_struct_to_sid(state, &usercon, &sid);
2647+
rc = sidtab_context_to_sid(sidtab, &usercon, &sid);
26582648
if (rc)
26592649
goto out_unlock;
26602650
if (mynel < maxnel) {
@@ -2725,6 +2715,7 @@ static inline int __security_genfs_sid(struct selinux_state *state,
27252715
u32 *sid)
27262716
{
27272717
struct policydb *policydb = &state->ss->policydb;
2718+
struct sidtab *sidtab = state->ss->sidtab;
27282719
int len;
27292720
u16 sclass;
27302721
struct genfs *genfs;
@@ -2759,7 +2750,7 @@ static inline int __security_genfs_sid(struct selinux_state *state,
27592750
goto out;
27602751

27612752
if (!c->sid[0]) {
2762-
rc = context_struct_to_sid(state, &c->context[0], &c->sid[0]);
2753+
rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]);
27632754
if (rc)
27642755
goto out;
27652756
}
@@ -2801,6 +2792,7 @@ int security_genfs_sid(struct selinux_state *state,
28012792
int security_fs_use(struct selinux_state *state, struct super_block *sb)
28022793
{
28032794
struct policydb *policydb;
2795+
struct sidtab *sidtab;
28042796
int rc = 0;
28052797
struct ocontext *c;
28062798
struct superblock_security_struct *sbsec = sb->s_security;
@@ -2809,6 +2801,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
28092801
read_lock(&state->ss->policy_rwlock);
28102802

28112803
policydb = &state->ss->policydb;
2804+
sidtab = state->ss->sidtab;
28122805

28132806
c = policydb->ocontexts[OCON_FSUSE];
28142807
while (c) {
@@ -2820,7 +2813,7 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
28202813
if (c) {
28212814
sbsec->behavior = c->v.behavior;
28222815
if (!c->sid[0]) {
2823-
rc = context_struct_to_sid(state, &c->context[0],
2816+
rc = sidtab_context_to_sid(sidtab, &c->context[0],
28242817
&c->sid[0]);
28252818
if (rc)
28262819
goto out;
@@ -3068,7 +3061,7 @@ int security_sid_mls_copy(struct selinux_state *state,
30683061
goto out_unlock;
30693062
}
30703063
}
3071-
rc = context_struct_to_sid(state, &newcon, new_sid);
3064+
rc = sidtab_context_to_sid(sidtab, &newcon, new_sid);
30723065
out_unlock:
30733066
read_unlock(&state->ss->policy_rwlock);
30743067
context_destroy(&newcon);
@@ -3661,7 +3654,7 @@ int security_netlbl_secattr_to_sid(struct selinux_state *state,
36613654
if (!mls_context_isvalid(policydb, &ctx_new))
36623655
goto out_free;
36633656

3664-
rc = context_struct_to_sid(state, &ctx_new, sid);
3657+
rc = sidtab_context_to_sid(sidtab, &ctx_new, sid);
36653658
if (rc)
36663659
goto out_free;
36673660

0 commit comments

Comments
 (0)