Commit a178d202 authored by Eric Paris's avatar Eric Paris Committed by Linus Torvalds
Browse files

IMA: move read counter into struct inode 



IMA currently allocated an inode integrity structure for every inode in
core.  This stucture is about 120 bytes long.  Most files however
(especially on a system which doesn't make use of IMA) will never need
any of this space.  The problem is that if IMA is enabled we need to
know information about the number of readers and the number of writers
for every inode on the box.  At the moment we collect that information
in the per inode iint structure and waste the rest of the space.  This
patch moves those counters into the struct inode so we can eventually
stop allocating an IMA integrity structure except when absolutely
needed.

This patch does the minimum needed to move the location of the data.
Further cleanups, especially the location of counter updates, may still
be possible.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Acked-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b9593d30

fs/inode.c

+1 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include <linux/mount.h>

#include <linux/async.h>

#include <linux/posix_acl.h>

#include <linux/ima.h>



/*

 * This is needed for the following functions:

include/linux/fs.h

+4 −0
Original line number Diff line number Diff line
@@ -776,6 +776,10 @@ struct inode { 


	unsigned int		i_flags;



#ifdef CONFIG_IMA

	/* protected by i_lock */

	unsigned int		i_readcount; /* struct files open RO */

#endif

	atomic_t		i_writecount;

#ifdef CONFIG_SECURITY

	void			*i_security;

security/integrity/ima/ima.h

+1 −2
Original line number Diff line number Diff line
@@ -70,6 +70,7 @@ int ima_init(void); 
void ima_cleanup(void);

int ima_fs_init(void);

void ima_fs_cleanup(void);

int ima_inode_alloc(struct inode *inode);

int ima_add_template_entry(struct ima_template_entry *entry, int violation,

			   const char *op, struct inode *inode);

int ima_calc_hash(struct file *file, char *digest);
@@ -106,8 +107,6 @@ struct ima_iint_cache { 
	unsigned char flags;

	u8 digest[IMA_DIGEST_SIZE];

	struct mutex mutex;	/* protects: version, flags, digest */

	/* protected by inode->i_lock */

	unsigned int readcount;	/* measured files readcount */

	struct kref refcount;	/* ima_iint_cache reference count */

};

security/integrity/ima/ima_api.c

+1 −1
Original line number Diff line number Diff line
@@ -116,7 +116,7 @@ int ima_must_measure(struct ima_iint_cache *iint, struct inode *inode, 
{

	int must_measure;



	if (iint->flags & IMA_MEASURED)

	if (iint && iint->flags & IMA_MEASURED)

		return 1;



	must_measure = ima_match_policy(inode, function, mask);

security/integrity/ima/ima_iint.c

+5 −6
Original line number Diff line number Diff line
@@ -124,11 +124,6 @@ void iint_free(struct kref *kref) 
						   refcount);

	iint->version = 0;

	iint->flags = 0UL;

	if (iint->readcount != 0) {

		printk(KERN_INFO "%s: readcount: %u\n", __func__,

		       iint->readcount);

		iint->readcount = 0;

	}

	kref_init(&iint->refcount);

	kmem_cache_free(iint_cache, iint);

}
@@ -143,6 +138,11 @@ void ima_inode_free(struct inode *inode) 
{

	struct ima_iint_cache *iint;



	if (inode->i_readcount)

		printk(KERN_INFO "%s: readcount: %u\n", __func__, inode->i_readcount);



	inode->i_readcount = 0;



	spin_lock(&ima_iint_lock);

	iint = __ima_iint_find(inode);

	if (iint)
@@ -160,7 +160,6 @@ static void init_once(void *foo) 
	iint->version = 0;

	iint->flags = 0UL;

	mutex_init(&iint->mutex);

	iint->readcount = 0;

	kref_init(&iint->refcount);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE