SELinux: Improve read/write performance

It reduces the selinux overhead on read/write by only revalidating
permissions in selinux_file_permission if the task or inode labels have
changed or the policy has changed since the open-time check.  A new LSM
hook, security_dentry_open, is added to capture the necessary state at open
time to allow this optimization.

(see http://marc.info/?l=selinux&m=118972995207740&w=2)

Signed-off-by: Yuichi Nakamura<ynakam@hitachisoft.jp>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 18 insertions, 0 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index 1a15526e9f67..928d4793c6f4 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -504,6 +504,13 @@ struct request_sock;
  *      @file contains the file structure being received.
  *      Return 0 if permission is granted.
  *
+ * Security hook for dentry
+ *
+ * @dentry_open
+ *      Save open-time permission checking state for later use upon
+ *      file_permission, and recheck access if anything has changed
+ *      since inode_permission.
+ *
  * Security hooks for task operations.
  *
  * @task_create:
@@ -1256,6 +1263,7 @@ struct security_operations {
         int (*file_send_sigiotask) (struct task_struct * tsk,
                                     struct fown_struct * fown, int sig);
         int (*file_receive) (struct file * file);
+        int (*dentry_open)  (struct file *file);
 
         int (*task_create) (unsigned long clone_flags);
         int (*task_alloc_security) (struct task_struct * p);
@@ -1864,6 +1872,11 @@ static inline int security_file_receive (struct file *file)
         return security_ops->file_receive (file);
 }
 
+static inline int security_dentry_open (struct file *file)
+{
+        return security_ops->dentry_open (file);
+}
+
 static inline int security_task_create (unsigned long clone_flags)
 {
         return security_ops->task_create (clone_flags);
@@ -2546,6 +2559,11 @@ static inline int security_file_receive (struct file *file)
         return 0;
 }
 
+static inline int security_dentry_open (struct file *file)
+{
+        return 0;
+}
+
 static inline int security_task_create (unsigned long clone_flags)
 {
         return 0;