LSM: shrink sizeof LSM specific portion of common_audit_data

Linus found that the gigantic size of the common audit data caused a big
perf hit on something as simple as running stat() in a loop.  This patch
requires LSMs to declare the LSM specific portion separately rather than
doing it in a union.  Thus each LSM can be responsible for shrinking their
portion and don't have to pay a penalty just because other LSMs have a
bigger space requirement.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 11 insertions, 9 deletions

diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 25fd51edc8da..deab7c7e8dc0 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -70,13 +70,13 @@ struct aa_ext {
 static void audit_cb(struct audit_buffer *ab, void *va)
 {
         struct common_audit_data *sa = va;
-        if (sa->aad.iface.target) {
-                struct aa_profile *name = sa->aad.iface.target;
+        if (sa->aad->iface.target) {
+                struct aa_profile *name = sa->aad->iface.target;
                 audit_log_format(ab, " name=");
                 audit_log_untrustedstring(ab, name->base.hname);
         }
-        if (sa->aad.iface.pos)
-                audit_log_format(ab, " offset=%ld", sa->aad.iface.pos);
+        if (sa->aad->iface.pos)
+                audit_log_format(ab, " offset=%ld", sa->aad->iface.pos);
 }
 
 /**
@@ -94,13 +94,15 @@ static int audit_iface(struct aa_profile *new, const char *name,
 {
         struct aa_profile *profile = __aa_current_profile();
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
         COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.aad = &aad;
         if (e)
-                sa.aad.iface.pos = e->pos - e->start;
-        sa.aad.iface.target = new;
-        sa.aad.name = name;
-        sa.aad.info = info;
-        sa.aad.error = error;
+                aad.iface.pos = e->pos - e->start;
+        aad.iface.target = new;
+        aad.name = name;
+        aad.info = info;
+        aad.error = error;
 
         return aa_audit(AUDIT_APPARMOR_STATUS, profile, GFP_KERNEL, &sa,
                         audit_cb);