cr: lsm: actually cache entries
PATCH 1/1 cr: lsm: actually cache entries
Somewhere along the way, the lsm c/r patchset seems to have dropped the code caching whether a particular void*security had already been checkpointed. Note that checkpoint a void* security means allocing a struct containing the secref and the string representation of the context. That leaves us with no way to tell, given only the void*security, whether that context has been checkpointed before (as part of checkpointing a different object of the same object type and security context).
This patch re-introduces a moronic unsorted per-checkpoint list of checkpointed contexts, used only at checkpoint time, so that we can re-use secrefs. Converting this to an rblist or hash will be trivial, but isn't done here to try and make clear why we actually need this.
(applies on top of existing LSM c/r patches atgit://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-cr.git)
--- checkpoint/sys.c | 15 +++++++++++++ include/linux/checkpoint_types.h | 4 +++ security/security.c | 43 ++++++++++++++++++++++++++++++++----- 3 files changed, 56 insertions(+), 6 deletions(-)
checkpoint/sys.c +15 -0
@@ -210,6 +210,18 @@ static void task_arr_free(struct ckpt_ctx *ctx)kfree (ctx->tasks_arr); } +static void seclist_free (struct ckpt_ctx *ctx) +{ +struct hlist_node *p, *q; +struct ckpt_stored_lsm *l; + +hlist_for_each_entry_safe (l, p, q, &ctx->seclist, hash) { +hlist_del (&l->hash); +kfree (l->string); +kfree (l); + } +} +static void ckpt_ctx_free (struct ckpt_ctx *ctx) {BUG_ON (atomic_read (&ctx->refcount));
@@ -231,6 +243,8 @@ static void ckpt_ctx_free(struct ckpt_ctx *ctx)path_put (&ctx->fs_mnt);ckpt_pgarr_free (ctx); +seclist_free (ctx); +if (ctx->tasks_arr)task_arr_free (ctx);
@@ -263,6 +277,7 @@ static struct ckpt_ctx *ckpt_ctx_alloc(int fd, unsigned long uflags,atomic_set (&ctx->refcount,0 );INIT_LIST_HEAD (&ctx->pgarr_list);INIT_LIST_HEAD (&ctx->pgarr_pool); +INIT_HLIST_HEAD (&ctx->seclist);init_waitqueue_head (&ctx->waitq);init_waitqueue_head (&ctx->ghostq);
include/linux/checkpoint_types.h +4 -0
@@ -66,6 +66,7 @@ struct ckpt_ctx {struct list_head pgarr_list;/* page array to dump VMA contents */ struct list_head pgarr_pool;/* pool of empty page arrays chain */ +struct hlist_head seclist;/* to become a hash list of LSM contexts */ /* [multi-process checkpoint] */ struct task_struct **tasks_arr;/* array of all tasks [checkpoint] */
@@ -94,6 +95,9 @@ struct ckpt_stored_lsm {struct kref kref;int sectype;char *string; +int secref; +void *security; + struct hlist_node hash; };#endif /* __KERNEL__ */
security/security.c +37 -6
80 lines not on this page · raw message
Signature · 1 line
1.5.4.3
A message that is not in the archive (sent off-list or not yet received): 20091008194720.GA648-r/[email protected]
Quoted 15 lines · Serge E. Hallyn
Somewhere along the way, the lsm c/r patchset seems to have dropped the code caching whether a particular void*security had already been checkpointed. Note that checkpoint a void* security means allocing a struct containing the secref and the string representation of the context. That leaves us with no way to tell, given only the void*security, whether that context has been checkpointed before (as part of checkpointing a different object of the same object type and security context).
This patch re-introduces a moronic unsorted per-checkpoint list of checkpointed contexts, used only at checkpoint time, so that we can re-use secrefs. Converting this to an rblist or hash will be trivial, but isn't done here to try and make clear why we actually need this.
Quoted 4 lines
(applies on top of existing LSM c/r patches at
git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-cr.git)Signed-off-by Serge E. Hallyn <serue-r/[email protected]>
Matt called me on this over irc, and as a result I think I've found a trivial way to do this much better... pls ignore for now.
thanks,
-serge