Avoid memory allocation while opening smackfs files.

Using openat() on pre-opened smackfs directory eliminates need to construct
absolute path to a smackfs file before opening it.

diff --git a/libsmack/init.c b/libsmack/init.c
index bec59f2..6d2200d 100644 (file)
--- a/libsmack/init.c
+++ b/libsmack/init.c
@@ -47,6 +47,7 @@
 #define OLDSMACKFSMNT "/smack"
 
 char *smack_mnt = NULL;
+int smack_mnt_dirfd = -1;
 
 void set_smackmnt(const char *mnt)
 {
@@ -64,24 +65,31 @@ static int verify_smackmnt(const char *mnt)
 {
        struct statfs sfbuf;
        int rc;
+       int fd;
+
+       fd = open(mnt, O_RDONLY, 0);
+       if (fd < 0)
+               return -1;
 
        do {
-               rc = statfs(mnt, &sfbuf);
+               rc = fstatfs(fd, &sfbuf);
        } while (rc < 0 && errno == EINTR);
 
        if (rc == 0) {
                if ((uint32_t)sfbuf.f_type == (uint32_t)SMACK_MAGIC) {
                        struct statvfs vfsbuf;
-                       rc = statvfs(mnt, &vfsbuf);
+                       rc = fstatvfs(fd, &vfsbuf);
                        if (rc == 0) {
                                if (!(vfsbuf.f_flag & ST_RDONLY)) {
                                        set_smackmnt(mnt);
                                }
+                               smack_mnt_dirfd = fd;
                                return 0;
                        }
                }
        }
 
+       close(fd);
        return -1;
 }
 

diff --git a/libsmack/libsmack.c b/libsmack/libsmack.c
index 52058c3..56827cc 100644 (file)
--- a/libsmack/libsmack.c
+++ b/libsmack/libsmack.c
@@ -36,7 +36,6 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
-#include <limits.h>
 #include <sys/xattr.h>
 
 #define ACC_LEN 5
@@ -58,6 +57,7 @@
 #define SELF_LABEL_FILE "/proc/self/attr/current"
 
 extern char *smack_mnt;
+extern int smack_mnt_dirfd;
 
 struct smack_rule {
        char subject[SMACK_LABEL_LEN + 1];
@@ -291,21 +291,18 @@ int smack_have_access(const char *subject, const char *object,
        int ret;
        int fd;
        int access2 = 1;
-       char path[PATH_MAX];
 
-       if (!smack_mnt) {
+       if (smack_mnt_dirfd < 0) {
                errno = EFAULT;
-               return -1; 
+               return -1;
        }
-       
-       snprintf(path, sizeof path, "%s/access2", smack_mnt);
-       fd = open(path, O_RDWR);
+
+       fd = openat(smack_mnt_dirfd, "access2", O_RDWR);
        if (fd < 0) {
                if (errno != ENOENT)
                        return -1;
-               
-               snprintf(path, sizeof path, "%s/access", smack_mnt);
-               fd = open(path, O_RDWR);
+
+               fd = openat(smack_mnt_dirfd, "access", O_RDWR);
                if (fd < 0)
                        return -1;
                access2 = 0;
@@ -372,16 +369,14 @@ int smack_cipso_apply(struct smack_cipso *cipso)
        char buf[CIPSO_MAX_SIZE];
        int fd;
        int i;
-       char path[PATH_MAX];
        int offset=0;
 
-       if (!smack_mnt) {
+       if (smack_mnt_dirfd < 0) {
                errno = EFAULT;
                return -1;
        }
 
-       snprintf(path, sizeof path, "%s/cipso2", smack_mnt);
-       fd = open(path, O_WRONLY);
+       fd = openat(smack_mnt_dirfd, "cipso2", O_WRONLY);
        if (fd < 0)
                return -1;
 
@@ -606,14 +601,17 @@ int smack_revoke_subject(const char *subject)
        int ret;
        int fd;
        int len;
-       char path[PATH_MAX];
+
+       if (smack_mnt_dirfd < 0) {
+               errno = EFAULT;
+               return -1;
+       }
 
        len = strnlen(subject, SMACK_LABEL_LEN + 1);
        if (len > SMACK_LABEL_LEN)
                return -1;
 
-       snprintf(path, sizeof path, "%s/revoke-subject", smack_mnt);
-       fd = open(path, O_WRONLY);
+       fd = openat(smack_mnt_dirfd, "revoke-subject", O_WRONLY);
        if (fd < 0)
                return -1;
 
@@ -632,29 +630,25 @@ static int accesses_apply(struct smack_accesses *handle, int clear)
        int load_fd;
        int change_fd;
        int load2 = 1;
-       char path[PATH_MAX];
 
-       if (!smack_mnt) {
+       if (smack_mnt_dirfd < 0) {
                errno = EFAULT;
-               return -1; 
+               return -1;
        }
-       
-       snprintf(path, sizeof path, "%s/load2", smack_mnt);
-       load_fd = open(path, O_WRONLY);
+
+       load_fd = openat(smack_mnt_dirfd, "load2", O_WRONLY);
        if (load_fd < 0) {
                if (errno != ENOENT)
                        return -1;
                /* fallback */
-               snprintf(path, sizeof path, "%s/load", smack_mnt);
-               load_fd = open(path, O_WRONLY);
+               load_fd = openat(smack_mnt_dirfd, "load", O_WRONLY);
                /* Try to continue if the file doesn't exist, we might not need it. */
                if (load_fd < 0 && errno != ENOENT)
                        return -1;
                load2 = 0;
        }
 
-       snprintf(path, sizeof path, "%s/change-rule", smack_mnt);
-       change_fd = open(path, O_WRONLY);
+       change_fd = openat(smack_mnt_dirfd, "change-rule", O_WRONLY);
        /* Try to continue if the file doesn't exist, we might not need it. */
        if (change_fd < 0 && errno != ENOENT) {
                ret = -1;

diff --git a/utils/common.c b/utils/common.c
index 9fd84e6..15addca 100644 (file)
--- a/utils/common.c
+++ b/utils/common.c
@@ -34,7 +34,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <limits.h>
 
 #define SMACK_MAGIC 0x43415d53
 
@@ -71,10 +70,8 @@ int clear(void)
        int fd;
        int ret;
        const char * smack_mnt;
-       char path[PATH_MAX];
 
-       smack_mnt = smack_smackfs_path();
-       if (!smack_mnt) {
+       if (smack_mnt_dirfd < 0) {
                errno = EFAULT;
                return -1;
        }
@@ -82,8 +79,7 @@ int clear(void)
        if (is_smackfs_mounted() != 1)
                return -1;
 
-       snprintf(path, sizeof path, "%s/load2", smack_mnt);
-       fd = open(path, O_RDONLY);
+       fd = openat(smack_mnt_dirfd, "load2", O_RDONLY);
        if (fd < 0)
                return -1;