dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

IMA: drop refcnt from ima_iint_cache since it isn't needed 

Since finding a struct ima_iint_cache requires a valid struct inode, and
the struct ima_iint_cache is supposed to have the same lifetime as a
struct inode (technically they die together but don't need to be created
at the same time) we don't have to worry about the ima_iint_cache
outliving or dieing before the inode.  So the refcnt isn't useful.  Just
get rid of it and free the structure when the inode is freed.

Signed-off-by: Eric Paris <eapris@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Eric Paris 2010-10-25 14:42:12 -04:00 committed by Linus Torvalds
parent bc7d2a3e66
commit 64c62f06be
3 changed files with 19 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
security/integrity/ima/ima.h
View File

@ -107,7 +107,6 @@ struct ima_iint_cache {
unsigned char flags;
u8 digest[IMA_DIGEST_SIZE];
struct mutex mutex; /* protects: version, flags, digest */
struct kref refcount; /* ima_iint_cache reference count */
};
/* LIM API function definitions */
@ -125,8 +124,7 @@ void ima_template_show(struct seq_file *m, void *e,
* integrity data associated with an inode.
*/
struct ima_iint_cache *ima_iint_insert(struct inode *inode);
struct ima_iint_cache *ima_iint_find_get(struct inode *inode);
void iint_free(struct kref *kref);
struct ima_iint_cache *ima_iint_find(struct inode *inode);
/* IMA policy related functions */
enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK };

38
security/integrity/ima/ima_iint.c
View File

@ -53,24 +53,26 @@ static struct ima_iint_cache *__ima_iint_find(struct inode *inode)
}
/*
* ima_iint_find_get - return the iint associated with an inode
*
* ima_iint_find_get gets a reference to the iint. Caller must
* remember to put the iint reference.
* ima_iint_find - return the iint associated with an inode
*/
struct ima_iint_cache *ima_iint_find_get(struct inode *inode)
struct ima_iint_cache *ima_iint_find(struct inode *inode)
{
struct ima_iint_cache *iint;
spin_lock(&ima_iint_lock);
iint = __ima_iint_find(inode);
if (iint)
kref_get(&iint->refcount);
spin_unlock(&ima_iint_lock);
return iint;
}
static void iint_free(struct ima_iint_cache *iint)
{
iint->version = 0;
iint->flags = 0UL;
kmem_cache_free(iint_cache, iint);
}
/**
* ima_inode_alloc - allocate an iint associated with an inode
* @inode: pointer to the inode
@ -113,19 +115,9 @@ int ima_inode_alloc(struct inode *inode)
return 0;
out_err:
spin_unlock(&ima_iint_lock);
kref_put(&new_iint->refcount, iint_free);
return rc;
}
iint_free(new_iint);
/* iint_free - called when the iint refcount goes to zero */
void iint_free(struct kref *kref)
{
struct ima_iint_cache *iint = container_of(kref, struct ima_iint_cache,
refcount);
iint->version = 0;
iint->flags = 0UL;
kref_init(&iint->refcount);
kmem_cache_free(iint_cache, iint);
return rc;
}
/**
@ -148,8 +140,11 @@ void ima_inode_free(struct inode *inode)
if (iint)
rb_erase(&iint->rb_node, &ima_iint_tree);
spin_unlock(&ima_iint_lock);
if (iint)
kref_put(&iint->refcount, iint_free);
if (!iint)
return;
iint_free(iint);
}
static void init_once(void *foo)
@ -160,7 +155,6 @@ static void init_once(void *foo)
iint->version = 0;
iint->flags = 0UL;
mutex_init(&iint->mutex);
kref_init(&iint->refcount);
}
static int __init ima_iintcache_init(void)

7
security/integrity/ima/ima_main.c
View File

@ -186,8 +186,6 @@ static void ima_file_free_iint(struct ima_iint_cache *iint, struct inode *inode,
spin_unlock(&inode->i_lock);
mutex_unlock(&iint->mutex);
kref_put(&iint->refcount, iint_free);
}
static void ima_file_free_noiint(struct inode *inode, struct file *file)
@ -213,7 +211,7 @@ void ima_file_free(struct file *file)
if (!iint_initialized || !S_ISREG(inode->i_mode))
return;
iint = ima_iint_find_get(inode);
iint = ima_iint_find(inode);
if (iint)
ima_file_free_iint(iint, inode, file);
@ -236,7 +234,7 @@ static int process_measurement(struct file *file, const unsigned char *filename,
if (rc != 0)
return rc;
retry:
iint = ima_iint_find_get(inode);
iint = ima_iint_find(inode);
if (!iint) {
rc = ima_inode_alloc(inode);
if (!rc || rc == -EEXIST)
@ -255,7 +253,6 @@ retry:
ima_store_measurement(iint, file, filename);
out:
mutex_unlock(&iint->mutex);
kref_put(&iint->refcount, iint_free);
return rc;
}