xnu-6153.121.1.tar.gz

[apple/xnu.git] / security / mac_vfs_subr.c

diff --git a/security/mac_vfs_subr.c b/security/mac_vfs_subr.c
index f8b2263b90ebb662cb1aaab739f0e5b132d7b283..3fb5132d588b7b0b2f1c027756caaab01fa20411 100644 (file)
--- a/security/mac_vfs_subr.c
+++ b/security/mac_vfs_subr.c
@@ -2,7 +2,7 @@
  * Copyright (c) 2007 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * Copyright (c) 2007 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 #include <sys/param.h>
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 #include <sys/param.h>


@@ -43,24 +43,31 @@
  */
 int
 vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
  */
 int
 vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,

-           struct componentname *cnp, int flags, vfs_context_t ctx)
+    struct componentname *cnp, int flags, vfs_context_t ctx)

 {
        int error = 0;
 {
        int error = 0;

-
+       bool exit_fast;

 
        /* fast path checks... */
 
        /* are we labeling vnodes? If not still notify of create */
 
        /* fast path checks... */
 
        /* are we labeling vnodes? If not still notify of create */

-       if (mac_label_vnodes == 0) {
-               if (flags & VNODE_LABEL_CREATE)
+#if CONFIG_MACF_LAZY_VNODE_LABELS
+       exit_fast = true;
+#else
+       exit_fast = (mac_label_vnodes == 0);
+#endif
+       if (exit_fast) {
+               if (flags & VNODE_LABEL_CREATE) {

                        error = mac_vnode_notify_create(ctx,
                            mp, dvp, vp, cnp);
                        error = mac_vnode_notify_create(ctx,
                            mp, dvp, vp, cnp);

+               }

                return 0;
        }
 
        /* if already VL_LABELED */
                return 0;
        }
 
        /* if already VL_LABELED */

-       if (vp->v_lflag & VL_LABELED)
-               return (0);
+       if (vp->v_lflag & VL_LABELED) {
+               return 0;
+       }

 
        vnode_lock_spin(vp);
 
 
        vnode_lock_spin(vp);
 


@@ -71,7 +78,7 @@ vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
         */
        if (vp->v_lflag & VL_LABELED) {
                vnode_unlock(vp);
         */
        if (vp->v_lflag & VL_LABELED) {
                vnode_unlock(vp);

-               return (0);
+               return 0;

        }
 
        if ((vp->v_lflag & VL_LABEL) == 0) {
        }
 
        if ((vp->v_lflag & VL_LABEL) == 0) {


@@ -80,19 +87,22 @@ vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
                /* Could sleep on disk I/O, drop lock. */
                vnode_unlock(vp);
 
                /* Could sleep on disk I/O, drop lock. */
                vnode_unlock(vp);
 

-               if (vp->v_label == NULL)
+               if (vp->v_label == NULL) {

                        vp->v_label = mac_vnode_label_alloc();
                        vp->v_label = mac_vnode_label_alloc();

+               }

 
 

-               if (flags & VNODE_LABEL_CREATE)
+               if (flags & VNODE_LABEL_CREATE) {

                        error = mac_vnode_notify_create(ctx,
                            mp, dvp, vp, cnp);
                        error = mac_vnode_notify_create(ctx,
                            mp, dvp, vp, cnp);

-               else
+               } else {

                        error = mac_vnode_label_associate(mp, vp, ctx);
                        error = mac_vnode_label_associate(mp, vp, ctx);

+               }

 
                vnode_lock_spin(vp);
 
 
                vnode_lock_spin(vp);
 

-               if ((error == 0) && (vp->v_flag & VNCACHEABLE))
+               if ((error == 0) && (vp->v_flag & VNCACHEABLE)) {

                        vp->v_lflag |= VL_LABELED;
                        vp->v_lflag |= VL_LABELED;

+               }

                vp->v_lflag &= ~VL_LABEL;
 
                if (vp->v_lflag & VL_LABELWAIT) {
                vp->v_lflag &= ~VL_LABEL;
 
                if (vp->v_lflag & VL_LABELWAIT) {


@@ -108,8 +118,8 @@ vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
                while (vp->v_lflag & VL_LABEL) {
                        vp->v_lflag |= VL_LABELWAIT;
 
                while (vp->v_lflag & VL_LABEL) {
                        vp->v_lflag |= VL_LABELWAIT;
 

-                       error = msleep(&vp->v_label, &vp->v_lock, PVFS|PDROP,
-                                      "vnode_label", &ts);
+                       error = msleep(&vp->v_label, &vp->v_lock, PVFS | PDROP,
+                           "vnode_label", &ts);

                        vnode_lock_spin(vp);
 
                        if (error == EWOULDBLOCK) {
                        vnode_lock_spin(vp);
 
                        if (error == EWOULDBLOCK) {


@@ -121,7 +131,7 @@ vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
        }
        vnode_unlock(vp);
 
        }
        vnode_unlock(vp);
 

-       return (error);
+       return error;

 }
 
 
 }
 
 


@@ -136,7 +146,6 @@ vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
 void
 vnode_relabel(struct vnode *vp)
 {
 void
 vnode_relabel(struct vnode *vp)
 {

-

        /* Wait for any other labeling to complete. */
        while (vp->v_lflag & VL_LABEL) {
                vp->v_lflag |= VL_LABELWAIT;
        /* Wait for any other labeling to complete. */
        while (vp->v_lflag & VL_LABEL) {
                vp->v_lflag |= VL_LABELWAIT;


@@ -154,20 +163,21 @@ vnode_relabel(struct vnode *vp)
  */
 
 int
  */
 
 int

-mac_vnop_setxattr (struct vnode *vp, const char *name, char *buf, size_t len)
+mac_vnop_setxattr(struct vnode *vp, const char *name, char *buf, size_t len)

 {
        vfs_context_t ctx;
        int options = XATTR_NOSECURITY;
 {
        vfs_context_t ctx;
        int options = XATTR_NOSECURITY;

-       char uio_buf[ UIO_SIZEOF(1) ];
-        uio_t auio;
+       char uio_buf[UIO_SIZEOF(1)];
+       uio_t auio;

        int error;
 
        int error;
 

-       if (vfs_isrdonly(vp->v_mount))
-               return (EROFS);
+       if (vfs_isrdonly(vp->v_mount)) {
+               return EROFS;
+       }

 
        ctx = vfs_context_current();
        auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_WRITE,
 
        ctx = vfs_context_current();
        auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_WRITE,

-                                   &uio_buf[0], sizeof(uio_buf));
+           &uio_buf[0], sizeof(uio_buf));

        uio_addiov(auio, CAST_USER_ADDR_T(buf), len);
 
        error = vn_setxattr(vp, name, auio, options, ctx);
        uio_addiov(auio, CAST_USER_ADDR_T(buf), len);
 
        error = vn_setxattr(vp, name, auio, options, ctx);


@@ -179,38 +189,39 @@ mac_vnop_setxattr (struct vnode *vp, const char *name, char *buf, size_t len)
        }
 #endif
 
        }
 #endif
 

-       return (error);
+       return error;

 }
 
 int
 }
 
 int

-mac_vnop_getxattr (struct vnode *vp, const char *name, char *buf, size_t len,
-                  size_t *attrlen)
+mac_vnop_getxattr(struct vnode *vp, const char *name, char *buf, size_t len,
+    size_t *attrlen)

 {
        vfs_context_t ctx = vfs_context_current();
        int options = XATTR_NOSECURITY;
 {
        vfs_context_t ctx = vfs_context_current();
        int options = XATTR_NOSECURITY;

-       char uio_buf[ UIO_SIZEOF(1) ];
-        uio_t auio;
+       char uio_buf[UIO_SIZEOF(1)];
+       uio_t auio;

        int error;
 
        auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ,
        int error;
 
        auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ,

-                                   &uio_buf[0], sizeof(uio_buf));
+           &uio_buf[0], sizeof(uio_buf));

        uio_addiov(auio, CAST_USER_ADDR_T(buf), len);
 
        error = vn_getxattr(vp, name, auio, attrlen, options, ctx);
        *attrlen = len - uio_resid(auio);
 
        uio_addiov(auio, CAST_USER_ADDR_T(buf), len);
 
        error = vn_getxattr(vp, name, auio, attrlen, options, ctx);
        *attrlen = len - uio_resid(auio);
 

-       return (error);
+       return error;

 }
 
 int
 }
 
 int

-mac_vnop_removexattr (struct vnode *vp, const char *name)
+mac_vnop_removexattr(struct vnode *vp, const char *name)

 {
        vfs_context_t ctx = vfs_context_current();
        int options = XATTR_NOSECURITY;
        int error;
 
 {
        vfs_context_t ctx = vfs_context_current();
        int options = XATTR_NOSECURITY;
        int error;
 

-       if (vfs_isrdonly(vp->v_mount))
-               return (EROFS);
+       if (vfs_isrdonly(vp->v_mount)) {
+               return EROFS;
+       }

 
        error = vn_removexattr(vp, name, options, ctx);
 #if CONFIG_FSE
 
        error = vn_removexattr(vp, name, options, ctx);
 #if CONFIG_FSE


@@ -221,5 +232,5 @@ mac_vnop_removexattr (struct vnode *vp, const char *name)
        }
 #endif
 
        }
 #endif
 

-       return (error);
+       return error;

 }
 }