Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 20dda18b authored by Stephen Smalley's avatar Stephen Smalley Committed by James Morris
Browse files

selinux: restore optimization to selinux_file_permission 



Restore the optimization to skip revalidation in selinux_file_permission
if nothing has changed since the dentry_open checks, accidentally removed by
389fb800.  Also remove redundant test from selinux_revalidate_file_permission.

Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Reviewed-by: default avatarPaul Moore <paul.moore@hp.com>
Acked-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 56f8c9bc

security/selinux/hooks.c

+10 −5
Original line number Diff line number Diff line
@@ -2938,11 +2938,6 @@ static int selinux_revalidate_file_permission(struct file *file, int mask) 
	const struct cred *cred = current_cred();

	struct inode *inode = file->f_path.dentry->d_inode;



	if (!mask) {

		/* No permission to check.  Existence test. */

		return 0;

	}



	/* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */

	if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))

		mask |= MAY_APPEND;
@@ -2953,10 +2948,20 @@ static int selinux_revalidate_file_permission(struct file *file, int mask) 


static int selinux_file_permission(struct file *file, int mask)

{

	struct inode *inode = file->f_path.dentry->d_inode;

	struct file_security_struct *fsec = file->f_security;

	struct inode_security_struct *isec = inode->i_security;

	u32 sid = current_sid();



	if (!mask)

		/* No permission to check.  Existence test. */

		return 0;



	if (sid == fsec->sid && fsec->isid == isec->sid &&

	    fsec->pseqno == avc_policy_seqno())

		/* No change since dentry_open check. */

		return 0;



	return selinux_revalidate_file_permission(file, mask);

}