• R/O
  • HTTP
  • SSH
  • HTTPS

tomoyo-test1: Commit

This is a test repository.


Commit MetaInfo

Revision04e57a2d952bbd34bc45744e72be3eecdc344294 (tree)
Time2021-12-15 20:11:07
AuthorDmitry Vyukov <dvyukov@goog...>
CommiterTetsuo Handa

Log Message

tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok().

If tomoyo is used in a testing/fuzzing environment in learning mode,
for lots of domains the quota will be exceeded and stay exceeded
for prolonged periods of time. In such cases it's pointless (and slow)
to walk the whole acl list again and again just to rediscover that
the quota is exceeded. We already have the TOMOYO_DIF_QUOTA_WARNED flag
that notes the overflow condition. Check it early to avoid the slowdown.

[penguin-kernel]
This patch causes a user visible change that the learning mode will not be
automatically resumed after the quota is increased. To resume the learning
mode, administrator will need to explicitly clear TOMOYO_DIF_QUOTA_WARNED
flag after increasing the quota. But I think that this change is generally
preferable, for administrator likely wants to optimize the acl list for
that domain before increasing the quota, or that domain likely hits the
quota again. Therefore, don't try to care to clear TOMOYO_DIF_QUOTA_WARNED
flag automatically when the quota for that domain changed.

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

Change Summary

Incremental Difference

--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -1051,6 +1051,8 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)
10511051 return false;
10521052 if (!domain)
10531053 return true;
1054+ if (READ_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED]))
1055+ return false;
10541056 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list,
10551057 srcu_read_lock_held(&tomoyo_ss)) {
10561058 u16 perm;
@@ -1096,14 +1098,12 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)
10961098 if (count < tomoyo_profile(domain->ns, domain->profile)->
10971099 pref[TOMOYO_PREF_MAX_LEARNING_ENTRY])
10981100 return true;
1099- if (!domain->flags[TOMOYO_DIF_QUOTA_WARNED]) {
1100- domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true;
1101- /* r->granted = false; */
1102- tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]);
1101+ WRITE_ONCE(domain->flags[TOMOYO_DIF_QUOTA_WARNED], true);
1102+ /* r->granted = false; */
1103+ tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]);
11031104 #ifndef CONFIG_SECURITY_TOMOYO_INSECURE_BUILTIN_SETTING
1104- pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n",
1105- domain->domainname->name);
1105+ pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n",
1106+ domain->domainname->name);
11061107 #endif
1107- }
11081108 return false;
11091109 }
Show on old repository browser