selinux: cache the SID -> context string translation

Translating a context struct to string can be quite slow, especially if
the context has a lot of category bits set. This can cause quite
noticeable performance impact in situations where the translation needs
to be done repeatedly. A common example is a UNIX datagram socket with
the SO_PASSSEC option enabled, which is used e.g. by systemd-journald
when receiving log messages via datagram socket. This scenario can be
reproduced with:

    cat /dev/urandom | base64 | logger &
    timeout 30s perf record -p $(pidof systemd-journald) -a -g
    kill %1
    perf report -g none --pretty raw | grep security_secid_to_secctx

Before the caching introduced by this patch, computing the context
string (security_secid_to_secctx() function) takes up ~65% of
systemd-journald's CPU time (assuming a context with 1024 categories
set and Fedora x86_64 release kernel configs). After this patch
(assuming near-perfect cache hit ratio) this overhead is reduced to just
~2%.

This patch addresses the issue by caching a certain number (compile-time
configurable) of recently used context strings to speed up repeated
translations of the same context, while using only a small amount of
memory.

The cache is integrated into the existing sidtab table by adding a field
to each entry, which when not NULL contains an RCU-protected pointer to
a cache entry containing the cached string. The cache entries are kept
in a linked list sorted according to how recently they were used. On a
cache miss when the cache is full, the least recently used entry is
removed to make space for the new entry.

The patch migrates security_sid_to_context_core() to use the cache (also
a few other functions where it was possible without too much fuss, but
these mostly use the translation for logging in case of error, which is
rare).

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1733259
Cc: Michal Sekletar <msekleta@redhat.com>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
Tested-by: Stephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
[PM: lots of merge fixups due to collisions with other sidtab patches]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
index c9e576c..996d35d 100644 (file)
--- a/security/selinux/Kconfig
+++ b/security/selinux/Kconfig
@@ -97,3 +97,14 @@ config SECURITY_SELINUX_SIDTAB_HASH_BITS
          collisions may be viewed at /sys/fs/selinux/ss/sidtab_hash_stats. If
          chain lengths are high (e.g. > 20) then selecting a higher value here
          will ensure that lookups times are short and stable.
+
+config SECURITY_SELINUX_SID2STR_CACHE_SIZE
+       int "NSA SELinux SID to context string translation cache size"
+       depends on SECURITY_SELINUX
+       default 256
+       help
+         This option defines the size of the internal SID -> context string
+         cache, which improves the performance of context to string
+         conversion.  Setting this option to 0 disables the cache completely.
+
+         If unsure, keep the default value.

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 38fb6fd..743b85e 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -91,6 +91,12 @@ static int context_struct_to_string(struct policydb *policydb,
                                    char **scontext,
                                    u32 *scontext_len);
 
+static int sidtab_entry_to_string(struct policydb *policydb,
+                                 struct sidtab *sidtab,
+                                 struct sidtab_entry *entry,
+                                 char **scontext,
+                                 u32 *scontext_len);
+
 static void context_struct_compute_av(struct policydb *policydb,
                                      struct context *scontext,
                                      struct context *tcontext,
@@ -716,20 +722,21 @@ static void context_struct_compute_av(struct policydb *policydb,
 }
 
 static int security_validtrans_handle_fail(struct selinux_state *state,
-                                          struct context *ocontext,
-                                          struct context *ncontext,
-                                          struct context *tcontext,
+                                          struct sidtab_entry *oentry,
+                                          struct sidtab_entry *nentry,
+                                          struct sidtab_entry *tentry,
                                           u16 tclass)
 {
        struct policydb *p = &state->ss->policydb;
+       struct sidtab *sidtab = state->ss->sidtab;
        char *o = NULL, *n = NULL, *t = NULL;
        u32 olen, nlen, tlen;
 
-       if (context_struct_to_string(p, ocontext, &o, &olen))
+       if (sidtab_entry_to_string(p, sidtab, oentry, &o, &olen))
                goto out;
-       if (context_struct_to_string(p, ncontext, &n, &nlen))
+       if (sidtab_entry_to_string(p, sidtab, nentry, &n, &nlen))
                goto out;
-       if (context_struct_to_string(p, tcontext, &t, &tlen))
+       if (sidtab_entry_to_string(p, sidtab, tentry, &t, &tlen))
                goto out;
        audit_log(audit_context(), GFP_ATOMIC, AUDIT_SELINUX_ERR,
                  "op=security_validate_transition seresult=denied"
@@ -751,9 +758,9 @@ static int security_compute_validatetrans(struct selinux_state *state,
 {
        struct policydb *policydb;
        struct sidtab *sidtab;
-       struct context *ocontext;
-       struct context *ncontext;
-       struct context *tcontext;
+       struct sidtab_entry *oentry;
+       struct sidtab_entry *nentry;
+       struct sidtab_entry *tentry;
        struct class_datum *tclass_datum;
        struct constraint_node *constraint;
        u16 tclass;
@@ -779,24 +786,24 @@ static int security_compute_validatetrans(struct selinux_state *state,
        }
        tclass_datum = policydb->class_val_to_struct[tclass - 1];
 
-       ocontext = sidtab_search(sidtab, oldsid);
-       if (!ocontext) {
+       oentry = sidtab_search_entry(sidtab, oldsid);
+       if (!oentry) {
                pr_err("SELinux: %s:  unrecognized SID %d\n",
                        __func__, oldsid);
                rc = -EINVAL;
                goto out;
        }
 
-       ncontext = sidtab_search(sidtab, newsid);
-       if (!ncontext) {
+       nentry = sidtab_search_entry(sidtab, newsid);
+       if (!nentry) {
                pr_err("SELinux: %s:  unrecognized SID %d\n",
                        __func__, newsid);
                rc = -EINVAL;
                goto out;
        }
 
-       tcontext = sidtab_search(sidtab, tasksid);
-       if (!tcontext) {
+       tentry = sidtab_search_entry(sidtab, tasksid);
+       if (!tentry) {
                pr_err("SELinux: %s:  unrecognized SID %d\n",
                        __func__, tasksid);
                rc = -EINVAL;
@@ -805,15 +812,16 @@ static int security_compute_validatetrans(struct selinux_state *state,
 
        constraint = tclass_datum->validatetrans;
        while (constraint) {
-               if (!constraint_expr_eval(policydb, ocontext, ncontext,
-                                         tcontext, constraint->expr)) {
+               if (!constraint_expr_eval(policydb, &oentry->context,
+                                         &nentry->context, &tentry->context,
+                                         constraint->expr)) {
                        if (user)
                                rc = -EPERM;
                        else
                                rc = security_validtrans_handle_fail(state,
-                                                                    ocontext,
-                                                                    ncontext,
-                                                                    tcontext,
+                                                                    oentry,
+                                                                    nentry,
+                                                                    tentry,
                                                                     tclass);
                        goto out;
                }
@@ -855,7 +863,7 @@ int security_bounded_transition(struct selinux_state *state,
 {
        struct policydb *policydb;
        struct sidtab *sidtab;
-       struct context *old_context, *new_context;
+       struct sidtab_entry *old_entry, *new_entry;
        struct type_datum *type;
        int index;
        int rc;
@@ -869,16 +877,16 @@ int security_bounded_transition(struct selinux_state *state,
        sidtab = state->ss->sidtab;
 
        rc = -EINVAL;
-       old_context = sidtab_search(sidtab, old_sid);
-       if (!old_context) {
+       old_entry = sidtab_search_entry(sidtab, old_sid);
+       if (!old_entry) {
                pr_err("SELinux: %s: unrecognized SID %u\n",
                       __func__, old_sid);
                goto out;
        }
 
        rc = -EINVAL;
-       new_context = sidtab_search(sidtab, new_sid);
-       if (!new_context) {
+       new_entry = sidtab_search_entry(sidtab, new_sid);
+       if (!new_entry) {
                pr_err("SELinux: %s: unrecognized SID %u\n",
                       __func__, new_sid);
                goto out;
@@ -886,10 +894,10 @@ int security_bounded_transition(struct selinux_state *state,
 
        rc = 0;
        /* type/domain unchanged */
-       if (old_context->type == new_context->type)
+       if (old_entry->context.type == new_entry->context.type)
                goto out;
 
-       index = new_context->type;
+       index = new_entry->context.type;
        while (true) {
                type = policydb->type_val_to_struct[index - 1];
                BUG_ON(!type);
@@ -901,7 +909,7 @@ int security_bounded_transition(struct selinux_state *state,
 
                /* @newsid is bounded by @oldsid */
                rc = 0;
-               if (type->bounds == old_context->type)
+               if (type->bounds == old_entry->context.type)
                        break;
 
                index = type->bounds;
@@ -912,10 +920,10 @@ int security_bounded_transition(struct selinux_state *state,
                char *new_name = NULL;
                u32 length;
 
-               if (!context_struct_to_string(policydb, old_context,
-                                             &old_name, &length) &&
-                   !context_struct_to_string(policydb, new_context,
-                                             &new_name, &length)) {
+               if (!sidtab_entry_to_string(policydb, sidtab, old_entry,
+                                           &old_name, &length) &&
+                   !sidtab_entry_to_string(policydb, sidtab, new_entry,
+                                           &new_name, &length)) {
                        audit_log(audit_context(),
                                  GFP_ATOMIC, AUDIT_SELINUX_ERR,
                                  "op=security_bounded_transition "
@@ -1255,6 +1263,23 @@ static int context_struct_to_string(struct policydb *p,
        return 0;
 }
 
+static int sidtab_entry_to_string(struct policydb *p,
+                                 struct sidtab *sidtab,
+                                 struct sidtab_entry *entry,
+                                 char **scontext, u32 *scontext_len)
+{
+       int rc = sidtab_sid2str_get(sidtab, entry, scontext, scontext_len);
+
+       if (rc != -ENOENT)
+               return rc;
+
+       rc = context_struct_to_string(p, &entry->context, scontext,
+                                     scontext_len);
+       if (!rc && scontext)
+               sidtab_sid2str_put(sidtab, entry, *scontext, *scontext_len);
+       return rc;
+}
+
 #include "initial_sid_to_string.h"
 
 int security_sidtab_hash_stats(struct selinux_state *state, char *page)
@@ -1282,7 +1307,7 @@ static int security_sid_to_context_core(struct selinux_state *state,
 {
        struct policydb *policydb;
        struct sidtab *sidtab;
-       struct context *context;
+       struct sidtab_entry *entry;
        int rc = 0;
 
        if (scontext)
@@ -1313,21 +1338,23 @@ static int security_sid_to_context_core(struct selinux_state *state,
        read_lock(&state->ss->policy_rwlock);
        policydb = &state->ss->policydb;
        sidtab = state->ss->sidtab;
+
        if (force)
-               context = sidtab_search_force(sidtab, sid);
+               entry = sidtab_search_entry_force(sidtab, sid);
        else
-               context = sidtab_search(sidtab, sid);
-       if (!context) {
+               entry = sidtab_search_entry(sidtab, sid);
+       if (!entry) {
                pr_err("SELinux: %s:  unrecognized SID %d\n",
                        __func__, sid);
                rc = -EINVAL;
                goto out_unlock;
        }
-       if (only_invalid && !context->len)
-               rc = 0;
-       else
-               rc = context_struct_to_string(policydb, context, scontext,
-                                             scontext_len);
+       if (only_invalid && !entry->context.len)
+               goto out_unlock;
+
+       rc = sidtab_entry_to_string(policydb, sidtab, entry, scontext,
+                                   scontext_len);
+
 out_unlock:
        read_unlock(&state->ss->policy_rwlock);
 out:
@@ -1621,19 +1648,20 @@ int security_context_to_sid_force(struct selinux_state *state,
 
 static int compute_sid_handle_invalid_context(
        struct selinux_state *state,
-       struct context *scontext,
-       struct context *tcontext,
+       struct sidtab_entry *sentry,
+       struct sidtab_entry *tentry,
        u16 tclass,
        struct context *newcontext)
 {
        struct policydb *policydb = &state->ss->policydb;
+       struct sidtab *sidtab = state->ss->sidtab;
        char *s = NULL, *t = NULL, *n = NULL;
        u32 slen, tlen, nlen;
        struct audit_buffer *ab;
 
-       if (context_struct_to_string(policydb, scontext, &s, &slen))
+       if (sidtab_entry_to_string(policydb, sidtab, sentry, &s, &slen))
                goto out;
-       if (context_struct_to_string(policydb, tcontext, &t, &tlen))
+       if (sidtab_entry_to_string(policydb, sidtab, tentry, &t, &tlen))
                goto out;
        if (context_struct_to_string(policydb, newcontext, &n, &nlen))
                goto out;
@@ -1692,7 +1720,8 @@ static int security_compute_sid(struct selinux_state *state,
        struct policydb *policydb;
        struct sidtab *sidtab;
        struct class_datum *cladatum = NULL;
-       struct context *scontext = NULL, *tcontext = NULL, newcontext;
+       struct context *scontext, *tcontext, newcontext;
+       struct sidtab_entry *sentry, *tentry;
        struct role_trans *roletr = NULL;
        struct avtab_key avkey;
        struct avtab_datum *avdatum;
@@ -1729,21 +1758,24 @@ static int security_compute_sid(struct selinux_state *state,
        policydb = &state->ss->policydb;
        sidtab = state->ss->sidtab;
 
-       scontext = sidtab_search(sidtab, ssid);
-       if (!scontext) {
+       sentry = sidtab_search_entry(sidtab, ssid);
+       if (!sentry) {
                pr_err("SELinux: %s:  unrecognized SID %d\n",
                       __func__, ssid);
                rc = -EINVAL;
                goto out_unlock;
        }
-       tcontext = sidtab_search(sidtab, tsid);
-       if (!tcontext) {
+       tentry = sidtab_search_entry(sidtab, tsid);
+       if (!tentry) {
                pr_err("SELinux: %s:  unrecognized SID %d\n",
                       __func__, tsid);
                rc = -EINVAL;
                goto out_unlock;
        }
 
+       scontext = &sentry->context;
+       tcontext = &tentry->context;
+
        if (tclass && tclass <= policydb->p_classes.nprim)
                cladatum = policydb->class_val_to_struct[tclass - 1];
 
@@ -1844,10 +1876,8 @@ static int security_compute_sid(struct selinux_state *state,
 
        /* Check the validity of the context. */
        if (!policydb_context_isvalid(policydb, &newcontext)) {
-               rc = compute_sid_handle_invalid_context(state, scontext,
-                                                       tcontext,
-                                                       tclass,
-                                                       &newcontext);
+               rc = compute_sid_handle_invalid_context(state, sentry, tentry,
+                                                       tclass, &newcontext);
                if (rc)
                        goto out_unlock;
        }

diff --git a/security/selinux/ss/sidtab.c b/security/selinux/ss/sidtab.c
index d9d8599..a308ce1 100644 (file)
--- a/security/selinux/ss/sidtab.c
+++ b/security/selinux/ss/sidtab.c
@@ -9,6 +9,8 @@
  */
 #include <linux/errno.h>
 #include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/rcupdate.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
@@ -17,6 +19,14 @@
 #include "security.h"
 #include "sidtab.h"
 
+struct sidtab_str_cache {
+       struct rcu_head rcu_member;
+       struct list_head lru_member;
+       struct sidtab_entry *parent;
+       u32 len;
+       char str[];
+};
+
 #define index_to_sid(index) (index + SECINITSID_NUM + 1)
 #define sid_to_index(sid) (sid - (SECINITSID_NUM + 1))
 
@@ -34,12 +44,19 @@ int sidtab_init(struct sidtab *s)
        hash_init(s->context_to_sid);
 
        spin_lock_init(&s->lock);
+
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+       s->cache_free_slots = CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE;
+       INIT_LIST_HEAD(&s->cache_lru_list);
+       spin_lock_init(&s->cache_lock);
+#endif
+
        return 0;
 }
 
 static u32 context_to_sid(struct sidtab *s, struct context *context)
 {
-       struct sidtab_entry_leaf *entry;
+       struct sidtab_entry *entry;
        u32 sid = 0;
 
        rcu_read_lock();
@@ -56,19 +73,22 @@ static u32 context_to_sid(struct sidtab *s, struct context *context)
 
 int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context)
 {
-       struct sidtab_isid_entry *entry;
+       struct sidtab_isid_entry *isid;
        int rc;
 
        if (sid == 0 || sid > SECINITSID_NUM)
                return -EINVAL;
 
-       entry = &s->isids[sid - 1];
+       isid = &s->isids[sid - 1];
 
-       rc = context_cpy(&entry->leaf.context, context);
+       rc = context_cpy(&isid->entry.context, context);
        if (rc)
                return rc;
 
-       entry->set = 1;
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+       isid->entry.cache = NULL;
+#endif
+       isid->set = 1;
 
        /*
         * Multiple initial sids may map to the same context. Check that this
@@ -77,8 +97,8 @@ int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context)
         * collision.
         */
        if (!context_to_sid(s, context)) {
-               entry->leaf.sid = sid;
-               hash_add(s->context_to_sid, &entry->leaf.list, context->hash);
+               isid->entry.sid = sid;
+               hash_add(s->context_to_sid, &isid->entry.list, context->hash);
        }
 
        return 0;
@@ -92,7 +112,7 @@ int sidtab_hash_stats(struct sidtab *sidtab, char *page)
        int entries = 0;
        int max_chain_len = 0;
        int cur_bucket = 0;
-       struct sidtab_entry_leaf *entry;
+       struct sidtab_entry *entry;
 
        rcu_read_lock();
        hash_for_each_rcu(sidtab->context_to_sid, i, entry, list) {
@@ -151,8 +171,8 @@ static int sidtab_alloc_roots(struct sidtab *s, u32 level)
        return 0;
 }
 
-static struct sidtab_entry_leaf *sidtab_do_lookup(struct sidtab *s, u32 index,
-                                                 int alloc)
+static struct sidtab_entry *sidtab_do_lookup(struct sidtab *s, u32 index,
+                                            int alloc)
 {
        union sidtab_entry_inner *entry;
        u32 level, capacity_shift, leaf_index = index / SIDTAB_LEAF_ENTRIES;
@@ -192,7 +212,7 @@ static struct sidtab_entry_leaf *sidtab_do_lookup(struct sidtab *s, u32 index,
        return &entry->ptr_leaf->entries[index % SIDTAB_LEAF_ENTRIES];
 }
 
-static struct context *sidtab_lookup(struct sidtab *s, u32 index)
+static struct sidtab_entry *sidtab_lookup(struct sidtab *s, u32 index)
 {
        /* read entries only after reading count */
        u32 count = smp_load_acquire(&s->count);
@@ -200,36 +220,37 @@ static struct context *sidtab_lookup(struct sidtab *s, u32 index)
        if (index >= count)
                return NULL;
 
-       return &sidtab_do_lookup(s, index, 0)->context;
+       return sidtab_do_lookup(s, index, 0);
 }
 
-static struct context *sidtab_lookup_initial(struct sidtab *s, u32 sid)
+static struct sidtab_entry *sidtab_lookup_initial(struct sidtab *s, u32 sid)
 {
-       return s->isids[sid - 1].set ? &s->isids[sid - 1].leaf.context : NULL;
+       return s->isids[sid - 1].set ? &s->isids[sid - 1].entry : NULL;
 }
 
-static struct context *sidtab_search_core(struct sidtab *s, u32 sid, int force)
+static struct sidtab_entry *sidtab_search_core(struct sidtab *s, u32 sid,
+                                              int force)
 {
-       struct context *context;
-
        if (sid != 0) {
+               struct sidtab_entry *entry;
+
                if (sid > SECINITSID_NUM)
-                       context = sidtab_lookup(s, sid_to_index(sid));
+                       entry = sidtab_lookup(s, sid_to_index(sid));
                else
-                       context = sidtab_lookup_initial(s, sid);
-               if (context && (!context->len || force))
-                       return context;
+                       entry = sidtab_lookup_initial(s, sid);
+               if (entry && (!entry->context.len || force))
+                       return entry;
        }
 
        return sidtab_lookup_initial(s, SECINITSID_UNLABELED);
 }
 
-struct context *sidtab_search(struct sidtab *s, u32 sid)
+struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid)
 {
        return sidtab_search_core(s, sid, 0);
 }
 
-struct context *sidtab_search_force(struct sidtab *s, u32 sid)
+struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid)
 {
        return sidtab_search_core(s, sid, 1);
 }
@@ -240,7 +261,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context,
        unsigned long flags;
        u32 count;
        struct sidtab_convert_params *convert;
-       struct sidtab_entry_leaf *dst, *dst_convert;
+       struct sidtab_entry *dst, *dst_convert;
        int rc;
 
        *sid = context_to_sid(s, context);
@@ -289,7 +310,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context,
                }
 
                rc = convert->func(context, &dst_convert->context,
-                               convert->args);
+                                  convert->args);
                if (rc) {
                        context_destroy(&dst->context);
                        goto out_unlock;
@@ -298,7 +319,7 @@ int sidtab_context_to_sid(struct sidtab *s, struct context *context,
                convert->target->count = count + 1;
 
                hash_add_rcu(convert->target->context_to_sid,
-                               &dst_convert->list, dst_convert->context.hash);
+                            &dst_convert->list, dst_convert->context.hash);
        }
 
        if (context->len)
@@ -319,7 +340,7 @@ out_unlock:
 
 static void sidtab_convert_hashtable(struct sidtab *s, u32 count)
 {
-       struct sidtab_entry_leaf *entry;
+       struct sidtab_entry *entry;
        u32 i;
 
        for (i = 0; i < count; i++) {
@@ -327,7 +348,7 @@ static void sidtab_convert_hashtable(struct sidtab *s, u32 count)
                entry->sid = index_to_sid(i);
 
                hash_add_rcu(s->context_to_sid, &entry->list,
-                               entry->context.hash);
+                            entry->context.hash);
 
        }
 }
@@ -376,7 +397,6 @@ static int sidtab_convert_tree(union sidtab_entry_inner *edst,
                }
                cond_resched();
        }
-
        return 0;
 }
 
@@ -439,6 +459,14 @@ int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params)
        return 0;
 }
 
+static void sidtab_destroy_entry(struct sidtab_entry *entry)
+{
+       context_destroy(&entry->context);
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+       kfree(rcu_dereference_raw(entry->cache));
+#endif
+}
+
 static void sidtab_destroy_tree(union sidtab_entry_inner entry, u32 level)
 {
        u32 i;
@@ -459,7 +487,7 @@ static void sidtab_destroy_tree(union sidtab_entry_inner entry, u32 level)
                        return;
 
                for (i = 0; i < SIDTAB_LEAF_ENTRIES; i++)
-                       context_destroy(&node->entries[i].context);
+                       sidtab_destroy_entry(&node->entries[i]);
                kfree(node);
        }
 }
@@ -470,7 +498,7 @@ void sidtab_destroy(struct sidtab *s)
 
        for (i = 0; i < SECINITSID_NUM; i++)
                if (s->isids[i].set)
-                       context_destroy(&s->isids[i].leaf.context);
+                       sidtab_destroy_entry(&s->isids[i].entry);
 
        level = SIDTAB_MAX_LEVEL;
        while (level && !s->roots[level].ptr_inner)
@@ -483,3 +511,88 @@ void sidtab_destroy(struct sidtab *s)
         * to be cleaned up here.
         */
 }
+
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+
+void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry,
+                       const char *str, u32 str_len)
+{
+       struct sidtab_str_cache *cache, *victim = NULL;
+
+       /* do not cache invalid contexts */
+       if (entry->context.len)
+               return;
+
+       /*
+        * Skip the put operation when in non-task context to avoid the need
+        * to disable interrupts while holding s->cache_lock.
+        */
+       if (!in_task())
+               return;
+
+       spin_lock(&s->cache_lock);
+
+       cache = rcu_dereference_protected(entry->cache,
+                                         lockdep_is_held(&s->cache_lock));
+       if (cache) {
+               /* entry in cache - just bump to the head of LRU list */
+               list_move(&cache->lru_member, &s->cache_lru_list);
+               goto out_unlock;
+       }
+
+       cache = kmalloc(sizeof(struct sidtab_str_cache) + str_len, GFP_ATOMIC);
+       if (!cache)
+               goto out_unlock;
+
+       if (s->cache_free_slots == 0) {
+               /* pop a cache entry from the tail and free it */
+               victim = container_of(s->cache_lru_list.prev,
+                                     struct sidtab_str_cache, lru_member);
+               list_del(&victim->lru_member);
+               rcu_assign_pointer(victim->parent->cache, NULL);
+       } else {
+               s->cache_free_slots--;
+       }
+       cache->parent = entry;
+       cache->len = str_len;
+       memcpy(cache->str, str, str_len);
+       list_add(&cache->lru_member, &s->cache_lru_list);
+
+       rcu_assign_pointer(entry->cache, cache);
+
+out_unlock:
+       spin_unlock(&s->cache_lock);
+       kfree_rcu(victim, rcu_member);
+}
+
+int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry,
+                      char **out, u32 *out_len)
+{
+       struct sidtab_str_cache *cache;
+       int rc = 0;
+
+       if (entry->context.len)
+               return -ENOENT; /* do not cache invalid contexts */
+
+       rcu_read_lock();
+
+       cache = rcu_dereference(entry->cache);
+       if (!cache) {
+               rc = -ENOENT;
+       } else {
+               *out_len = cache->len;
+               if (out) {
+                       *out = kmemdup(cache->str, cache->len, GFP_ATOMIC);
+                       if (!*out)
+                               rc = -ENOMEM;
+               }
+       }
+
+       rcu_read_unlock();
+
+       if (!rc && out)
+               sidtab_sid2str_put(s, entry, *out, *out_len);
+       return rc;
+}
+
+#endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */

diff --git a/security/selinux/ss/sidtab.h b/security/selinux/ss/sidtab.h
index e280940..3311d9f 100644 (file)
--- a/security/selinux/ss/sidtab.h
+++ b/security/selinux/ss/sidtab.h
@@ -17,15 +17,15 @@
 
 #include "context.h"
 
-struct sidtab_entry_leaf {
+struct sidtab_entry {
        u32 sid;
        struct context context;
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+       struct sidtab_str_cache __rcu *cache;
+#endif
        struct hlist_node list;
 };
 
-struct sidtab_node_inner;
-struct sidtab_node_leaf;
-
 union sidtab_entry_inner {
        struct sidtab_node_inner *ptr_inner;
        struct sidtab_node_leaf  *ptr_leaf;
@@ -41,7 +41,7 @@ union sidtab_entry_inner {
        (SIDTAB_NODE_ALLOC_SHIFT - size_to_shift(sizeof(union sidtab_entry_inner)))
 #define SIDTAB_INNER_ENTRIES ((size_t)1 << SIDTAB_INNER_SHIFT)
 #define SIDTAB_LEAF_ENTRIES \
-       (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry_leaf))
+       (SIDTAB_NODE_ALLOC_SIZE / sizeof(struct sidtab_entry))
 
 #define SIDTAB_MAX_BITS 32
 #define SIDTAB_MAX U32_MAX
@@ -51,7 +51,7 @@ union sidtab_entry_inner {
                     SIDTAB_INNER_SHIFT)
 
 struct sidtab_node_leaf {
-       struct sidtab_entry_leaf entries[SIDTAB_LEAF_ENTRIES];
+       struct sidtab_entry entries[SIDTAB_LEAF_ENTRIES];
 };
 
 struct sidtab_node_inner {
@@ -60,7 +60,7 @@ struct sidtab_node_inner {
 
 struct sidtab_isid_entry {
        int set;
-       struct sidtab_entry_leaf leaf;
+       struct sidtab_entry entry;
 };
 
 struct sidtab_convert_params {
@@ -87,6 +87,13 @@ struct sidtab {
        struct sidtab_convert_params *convert;
        spinlock_t lock;
 
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+       /* SID -> context string cache */
+       u32 cache_free_slots;
+       struct list_head cache_lru_list;
+       spinlock_t cache_lock;
+#endif
+
        /* index == SID - 1 (no entry for SECSID_NULL) */
        struct sidtab_isid_entry isids[SECINITSID_NUM];
 
@@ -96,8 +103,22 @@ struct sidtab {
 
 int sidtab_init(struct sidtab *s);
 int sidtab_set_initial(struct sidtab *s, u32 sid, struct context *context);
-struct context *sidtab_search(struct sidtab *s, u32 sid);
-struct context *sidtab_search_force(struct sidtab *s, u32 sid);
+struct sidtab_entry *sidtab_search_entry(struct sidtab *s, u32 sid);
+struct sidtab_entry *sidtab_search_entry_force(struct sidtab *s, u32 sid);
+
+static inline struct context *sidtab_search(struct sidtab *s, u32 sid)
+{
+       struct sidtab_entry *entry = sidtab_search_entry(s, sid);
+
+       return entry ? &entry->context : NULL;
+}
+
+static inline struct context *sidtab_search_force(struct sidtab *s, u32 sid)
+{
+       struct sidtab_entry *entry = sidtab_search_entry_force(s, sid);
+
+       return entry ? &entry->context : NULL;
+}
 
 int sidtab_convert(struct sidtab *s, struct sidtab_convert_params *params);
 
@@ -107,6 +128,25 @@ void sidtab_destroy(struct sidtab *s);
 
 int sidtab_hash_stats(struct sidtab *sidtab, char *page);
 
+#if CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0
+void sidtab_sid2str_put(struct sidtab *s, struct sidtab_entry *entry,
+                       const char *str, u32 str_len);
+int sidtab_sid2str_get(struct sidtab *s, struct sidtab_entry *entry,
+                      char **out, u32 *out_len);
+#else
+static inline void sidtab_sid2str_put(struct sidtab *s,
+                                     struct sidtab_entry *entry,
+                                     const char *str, u32 str_len)
+{
+}
+static inline int sidtab_sid2str_get(struct sidtab *s,
+                                    struct sidtab_entry *entry,
+                                    char **out, u32 *out_len)
+{
+       return -ENOENT;
+}
+#endif /* CONFIG_SECURITY_SELINUX_SID2STR_CACHE_SIZE > 0 */
+
 #endif /* _SS_SIDTAB_H_ */