diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2009-07-01 13:45:40 -0400 |
|---|---|---|
| committer | Stephen Smalley <sds@tycho.nsa.gov> | 2009-07-14 10:55:34 -0400 |
| commit | 8c372f665db44cf753bb299e2ee7dcf6143b9e9e (patch) | |
| tree | e952589afb3633a7a216dd0adaf0eaf4278ac712 /libselinux/src/setrans_client.c | |
| parent | 1ac1ff6382505fa1e245fdc9c91b2448a7843101 (diff) | |
| download | android_external_selinux-8c372f665db44cf753bb299e2ee7dcf6143b9e9e.tar.gz android_external_selinux-8c372f665db44cf753bb299e2ee7dcf6143b9e9e.tar.bz2 android_external_selinux-8c372f665db44cf753bb299e2ee7dcf6143b9e9e.zip | |
libselinux: lazy init
Revive Steve Grubb's patch for libselinux lazy init and extend it to
address not only the reading of /etc/selinux/config but also probing
for /selinux/class and reading of /selinux/mls. This should reduce the
need for dontaudit rules for programs that link with libselinux and it
should reduce unnecessary overhead.
I did not convert init_selinuxmnt over to lazy init since the functions
that use selinux_mnt are not localized, and it only requires stat'ing
of /selinux in the common case.
I couldn't see a valid reason why we needed fini_obj_class_compat(), as
the existence of /selinux/class will only change across a reboot with
different kernel versions. fini_context_translations() already had a
comment saying that it was unnecessary as well.
Before:
$ strace ls 2> err
$ grep selinux err
open("/lib/libselinux.so.1", O_RDONLY) = 3
open("/etc/selinux/config", O_RDONLY|O_LARGEFILE) = 3
statfs64("/selinux", 84, {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
stat64("/selinux/class", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/selinux/mls", O_RDONLY|O_LARGEFILE) = 3
After:
$ strace ls 2> err
$ grep selinux err
open("/lib/libselinux.so.1", O_RDONLY) = 3
statfs64("/selinux", 84, {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
Original-patch-by: Steve Grubb <linux_4ever@yahoo.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'libselinux/src/setrans_client.c')
| -rw-r--r-- | libselinux/src/setrans_client.c | 28 |
1 files changed, 7 insertions, 21 deletions
diff --git a/libselinux/src/setrans_client.c b/libselinux/src/setrans_client.c index 500225e7..2bbcbde1 100644 --- a/libselinux/src/setrans_client.c +++ b/libselinux/src/setrans_client.c @@ -33,6 +33,8 @@ static __thread security_context_t prev_r2t_raw = NULL; static __thread char *prev_r2c_trans = NULL; static __thread security_context_t prev_r2c_raw = NULL; +static pthread_once_t once = PTHREAD_ONCE_INIT; + /* * setransd_open * @@ -238,20 +240,9 @@ out: return ret; } -hidden void fini_context_translations(void) -{ - free(prev_r2t_trans); - free(prev_r2t_raw); - free(prev_t2r_trans); - free(prev_t2r_raw); - free(prev_r2c_trans); - free(prev_r2c_raw); -} - -hidden int init_context_translations(void) +static void init_context_translations(void) { mls_enabled = is_selinux_mls_enabled(); - return 0; } int selinux_trans_to_raw_context(security_context_t trans, @@ -262,6 +253,8 @@ int selinux_trans_to_raw_context(security_context_t trans, return 0; } + __selinux_once(once, init_context_translations); + if (!mls_enabled) { *rawp = strdup(trans); goto out; @@ -301,6 +294,8 @@ int selinux_raw_to_trans_context(security_context_t raw, return 0; } + __selinux_once(once, init_context_translations); + if (!mls_enabled) { *transp = strdup(raw); goto out; @@ -366,15 +361,6 @@ int selinux_raw_context_to_color(security_context_t raw, char **transp) hidden_def(selinux_raw_context_to_color) #else /*DISABLE_SETRANS*/ -hidden void fini_context_translations(void) -{ -} - -hidden int init_context_translations(void) -{ - return 0; -} - int selinux_trans_to_raw_context(security_context_t trans, security_context_t * rawp) { |