From 788e7dd4c22e6f41b3a118fd8c291f831f6fddbb Mon Sep 17 00:00:00 2001 From: Yuichi Nakamura Date: Fri, 14 Sep 2007 09:27:07 +0900 Subject: SELinux: Improve read/write performance It reduces the selinux overhead on read/write by only revalidating permissions in selinux_file_permission if the task or inode labels have changed or the policy has changed since the open-time check. A new LSM hook, security_dentry_open, is added to capture the necessary state at open time to allow this optimization. (see http://marc.info/?l=selinux&m=118972995207740&w=2) Signed-off-by: Yuichi Nakamura Acked-by: Stephen Smalley Signed-off-by: James Morris --- fs/open.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'fs/open.c') diff --git a/fs/open.c b/fs/open.c index 1d9e5e98bf4..044bfa891c9 100644 --- a/fs/open.c +++ b/fs/open.c @@ -757,6 +757,10 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt, f->f_op = fops_get(inode->i_fop); file_move(f, &inode->i_sb->s_files); + error = security_dentry_open(f); + if (error) + goto cleanup_all; + if (!open && f->f_op) open = f->f_op->open; if (open) { -- cgit v1.2.3