On Thu, Apr 9, 2020 at 4:12 AM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote:
>
> Always hashing the string representation is inefficient. Just hash the
> contents of the structure directly (using jhash). If the context is
> invalid (str & len are set), then hash the string as before, otherwise
> hash the structured data. Any context that is valid under the given
> policy should always be structured, and also any context that is invalid
> should be never structured, so the hashes should always match for the
> same context. The fact that context_cmp() also follows this logic
> further reinforces this assumption.
>
> Since the context hashing function is now faster (about 10 times), this
> patch decreases the overhead of security_transition_sid(), which is
> called from many hooks.
>
> The jhash function seemed as a good choice, since it is used as the
> default hashing algorithm in rhashtable.
>
> Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
> ---
> security/selinux/Makefile | 2 +-
> security/selinux/ss/context.c | 28 ++++++++++++
> security/selinux/ss/context.h | 6 ++-
> security/selinux/ss/ebitmap.c | 14 ++++++
> security/selinux/ss/ebitmap.h | 1 +
> security/selinux/ss/policydb.c | 7 +--
> security/selinux/ss/services.c | 80 ++++++++++++++--------------------
> security/selinux/ss/services.h | 3 --
> 8 files changed, 82 insertions(+), 59 deletions(-)
> create mode 100644 security/selinux/ss/context.c
...
> diff --git a/security/selinux/ss/context.c b/security/selinux/ss/context.c
> new file mode 100644
> index 000000000000..7ca32683056d
> --- /dev/null
> +++ b/security/selinux/ss/context.c
> @@ -0,0 +1,28 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Implementations of the security context functions.
> + *
> + * Author: Ondrej Mosnacek <omosnacek@xxxxxxxxx>
> + * Copyright (C) 2018 Red Hat, Inc.
I think your clock is a bit off ... ;)
Joking aside, copyright dates are important so please fix this (also
because it is a copyright related issue, it isn't something I want to
fix during the merge).
> + */
> +
> +#include <linux/jhash.h>
> +
> +#include "context.h"
> +#include "mls.h"
> +
> +u32 context_compute_hash(const struct context *c)
> +{
> + u32 hash = 0;
> +
> + if (c->len)
> + return full_name_hash(NULL, c->str, c->len);
> +
> + hash = jhash_3words(c->user, c->role, c->type, hash);
> + hash = jhash_2words(c->range.level[0].sens,
> + c->range.level[1].sens, hash);
> + hash = ebitmap_hash(&c->range.level[0].cat, hash);
> + hash = ebitmap_hash(&c->range.level[1].cat, hash);
Most other places we try to abstract away the mls_range details by
having an associated mls_XXX(...) function, it seems like that would
be a good idea here too. How about adding a mls_context_hash(), or
similarly named function and calling it here.
> + return hash;
> +}
> diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
> index 3ba044fe02ed..e7ae7e21449b 100644
> --- a/security/selinux/ss/context.h
> +++ b/security/selinux/ss/context.h
> @@ -196,9 +196,11 @@ static inline int context_cmp(struct context *c1, struct context *c2)
> mls_context_cmp(c1, c2));
> }
>
> -static inline unsigned int context_compute_hash(const char *s)
> +u32 context_compute_hash(const struct context *c);
> +
> +static inline void context_add_hash(struct context *context)
> {
> - return full_name_hash(NULL, s, strlen(s));
> + context->hash = context_compute_hash(context);
> }
>
> #endif /* _SS_CONTEXT_H_ */
> diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
> index c8c3663111e2..14bedc95c6dc 100644
> --- a/security/selinux/ss/ebitmap.c
> +++ b/security/selinux/ss/ebitmap.c
> @@ -19,6 +19,7 @@
> #include <linux/kernel.h>
> #include <linux/slab.h>
> #include <linux/errno.h>
> +#include <linux/jhash.h>
> #include <net/netlabel.h>
> #include "ebitmap.h"
> #include "policydb.h"
> @@ -542,6 +543,19 @@ int ebitmap_write(struct ebitmap *e, void *fp)
> return 0;
> }
>
> +u32 ebitmap_hash(const struct ebitmap *e, u32 hash)
> +{
> + struct ebitmap_node *node;
> +
> + /* need to change hash even if ebitmap is empty */
> + hash = jhash_1word(e->highbit, hash);
> + for (node = e->node; node; node = node->next) {
> + hash = jhash_1word(node->startbit, hash);
> + hash = jhash(node->maps, sizeof(node->maps), hash);
> + }
> + return hash;
> +}
> +
> void __init ebitmap_cache_init(void)
> {
> ebitmap_node_cachep = kmem_cache_create("ebitmap_node",
> diff --git a/security/selinux/ss/ebitmap.h b/security/selinux/ss/ebitmap.h
> index 9a23b81b8832..9eb2d0af2805 100644
> --- a/security/selinux/ss/ebitmap.h
> +++ b/security/selinux/ss/ebitmap.h
> @@ -131,6 +131,7 @@ int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);
> void ebitmap_destroy(struct ebitmap *e);
> int ebitmap_read(struct ebitmap *e, void *fp);
> int ebitmap_write(struct ebitmap *e, void *fp);
> +u32 ebitmap_hash(const struct ebitmap *e, u32 hash);
>
> #ifdef CONFIG_NETLABEL
> int ebitmap_netlbl_export(struct ebitmap *ebmap,
> diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
> index 70ecdc78efbd..ac6c0a214fc5 100644
> --- a/security/selinux/ss/policydb.c
> +++ b/security/selinux/ss/policydb.c
> @@ -836,11 +836,8 @@ int policydb_load_isids(struct policydb *p, struct sidtab *s)
> if (!name)
> continue;
>
> - rc = context_add_hash(p, &c->context[0]);
> - if (rc) {
> - sidtab_destroy(s);
> - goto out;
> - }
> + context_add_hash(&c->context[0]);
> +
> rc = sidtab_set_initial(s, sid, &c->context[0]);
> if (rc) {
> pr_err("SELinux: unable to load initial SID %s.\n",
> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> index 8ad34fd031d1..2099355e9a7d 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -1490,38 +1490,11 @@ out:
> return rc;
> }
>
> -int context_add_hash(struct policydb *policydb,
> - struct context *context)
> +static int context_struct_to_sid(struct sidtab *sidtab, struct context *context,
> + u32 *sid)
Since you need to respin this patchset anyway, and patch 2/2 deals
with the move to sidtab, I think it might be better to keep the
context_struct_to_sid() arguments the same and not swap the first
argument for the sidtab. If you keep the first argument as the state
it makes this patch much more focused on the change at hand and leaves
patch 2/2 dedicated to just the sidtab move.
> {
> - int rc;
> - char *str;
> - int len;
> -
> - if (context->str) {
> - context->hash = context_compute_hash(context->str);
> - } else {
> - rc = context_struct_to_string(policydb, context,
> - &str, &len);
> - if (rc)
> - return rc;
> - context->hash = context_compute_hash(str);
> - kfree(str);
> - }
> - return 0;
> -}
> -
> -static int context_struct_to_sid(struct selinux_state *state,
> - struct context *context, u32 *sid)
> -{
> - int rc;
> - struct sidtab *sidtab = state->ss->sidtab;
> - struct policydb *policydb = &state->ss->policydb;
> -
> - if (!context->hash) {
> - rc = context_add_hash(policydb, context);
> - if (rc)
> - return rc;
> - }
> + if (!context->hash)
> + context_add_hash(context);
>
> return sidtab_context_to_sid(sidtab, context, sid);
> }
--
paul moore
www.paul-moore.com
