LSM: shrink sizeof LSM specific portion of common_audit_data

Linus found that the gigantic size of the common audit data caused a big
perf hit on something as simple as running stat() in a loop.  This patch
requires LSMs to declare the LSM specific portion separately rather than
doing it in a union.  Thus each LSM can be responsible for shrinking their
portion and don't have to pay a penalty just because other LSMs have a
bigger space requirement.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

10 files changed, 116 insertions, 74 deletions

diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c
index 5ff67776a5a..23f7eb658d9 100644
--- a/security/apparmor/audit.c
+++ b/security/apparmor/audit.c
@@ -115,23 +115,23 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
 
         if (aa_g_audit_header) {
                 audit_log_format(ab, "apparmor=");
-                audit_log_string(ab, aa_audit_type[sa->aad.type]);
+                audit_log_string(ab, aa_audit_type[sa->aad->type]);
         }
 
-        if (sa->aad.op) {
+        if (sa->aad->op) {
                 audit_log_format(ab, " operation=");
-                audit_log_string(ab, op_table[sa->aad.op]);
+                audit_log_string(ab, op_table[sa->aad->op]);
         }
 
-        if (sa->aad.info) {
+        if (sa->aad->info) {
                 audit_log_format(ab, " info=");
-                audit_log_string(ab, sa->aad.info);
-                if (sa->aad.error)
-                        audit_log_format(ab, " error=%d", sa->aad.error);
+                audit_log_string(ab, sa->aad->info);
+                if (sa->aad->error)
+                        audit_log_format(ab, " error=%d", sa->aad->error);
         }
 
-        if (sa->aad.profile) {
-                struct aa_profile *profile = sa->aad.profile;
+        if (sa->aad->profile) {
+                struct aa_profile *profile = sa->aad->profile;
                 pid_t pid;
                 rcu_read_lock();
                 pid = rcu_dereference(tsk->real_parent)->pid;
@@ -145,9 +145,9 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
                 audit_log_untrustedstring(ab, profile->base.hname);
         }
 
-        if (sa->aad.name) {
+        if (sa->aad->name) {
                 audit_log_format(ab, " name=");
-                audit_log_untrustedstring(ab, sa->aad.name);
+                audit_log_untrustedstring(ab, sa->aad->name);
         }
 }
 
@@ -159,7 +159,7 @@ static void audit_pre(struct audit_buffer *ab, void *ca)
 void aa_audit_msg(int type, struct common_audit_data *sa,
                   void (*cb) (struct audit_buffer *, void *))
 {
-        sa->aad.type = type;
+        sa->aad->type = type;
         sa->lsm_pre_audit = audit_pre;
         sa->lsm_post_audit = cb;
         common_lsm_audit(sa);
@@ -184,7 +184,7 @@ int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
         BUG_ON(!profile);
 
         if (type == AUDIT_APPARMOR_AUTO) {
-                if (likely(!sa->aad.error)) {
+                if (likely(!sa->aad->error)) {
                         if (AUDIT_MODE(profile) != AUDIT_ALL)
                                 return 0;
                         type = AUDIT_APPARMOR_AUDIT;
@@ -196,21 +196,21 @@ int aa_audit(int type, struct aa_profile *profile, gfp_t gfp,
         if (AUDIT_MODE(profile) == AUDIT_QUIET ||
             (type == AUDIT_APPARMOR_DENIED &&
              AUDIT_MODE(profile) == AUDIT_QUIET))
-                return sa->aad.error;
+                return sa->aad->error;
 
         if (KILL_MODE(profile) && type == AUDIT_APPARMOR_DENIED)
                 type = AUDIT_APPARMOR_KILL;
 
         if (!unconfined(profile))
-                sa->aad.profile = profile;
+                sa->aad->profile = profile;
 
         aa_audit_msg(type, sa, cb);
 
-        if (sa->aad.type == AUDIT_APPARMOR_KILL)
+        if (sa->aad->type == AUDIT_APPARMOR_KILL)
                 (void)send_sig_info(SIGKILL, NULL, sa->tsk ? sa->tsk : current);
 
-        if (sa->aad.type == AUDIT_APPARMOR_ALLOWED)
-                return complain_error(sa->aad.error);
+        if (sa->aad->type == AUDIT_APPARMOR_ALLOWED)
+                return complain_error(sa->aad->error);
 
-        return sa->aad.error;
+        return sa->aad->error;
 }
diff --git a/security/apparmor/capability.c b/security/apparmor/capability.c
index 9982c48def4..088dba3bf7d 100644
--- a/security/apparmor/capability.c
+++ b/security/apparmor/capability.c
@@ -64,11 +64,13 @@ static int audit_caps(struct aa_profile *profile, struct task_struct *task,
         struct audit_cache *ent;
         int type = AUDIT_APPARMOR_AUTO;
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
         COMMON_AUDIT_DATA_INIT(&sa, CAP);
+        sa.aad = &aad;
         sa.tsk = task;
         sa.u.cap = cap;
-        sa.aad.op = OP_CAPABLE;
-        sa.aad.error = error;
+        sa.aad->op = OP_CAPABLE;
+        sa.aad->error = error;
 
         if (likely(!error)) {
                 /* test if auditing is being forced */
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 5d176f2530c..2f8fcba9ce4 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -67,22 +67,22 @@ static void file_audit_cb(struct audit_buffer *ab, void *va)
         struct common_audit_data *sa = va;
         uid_t fsuid = current_fsuid();
 
-        if (sa->aad.fs.request & AA_AUDIT_FILE_MASK) {
+        if (sa->aad->fs.request & AA_AUDIT_FILE_MASK) {
                 audit_log_format(ab, " requested_mask=");
-                audit_file_mask(ab, sa->aad.fs.request);
+                audit_file_mask(ab, sa->aad->fs.request);
         }
-        if (sa->aad.fs.denied & AA_AUDIT_FILE_MASK) {
+        if (sa->aad->fs.denied & AA_AUDIT_FILE_MASK) {
                 audit_log_format(ab, " denied_mask=");
-                audit_file_mask(ab, sa->aad.fs.denied);
+                audit_file_mask(ab, sa->aad->fs.denied);
         }
-        if (sa->aad.fs.request & AA_AUDIT_FILE_MASK) {
+        if (sa->aad->fs.request & AA_AUDIT_FILE_MASK) {
                 audit_log_format(ab, " fsuid=%d", fsuid);
-                audit_log_format(ab, " ouid=%d", sa->aad.fs.ouid);
+                audit_log_format(ab, " ouid=%d", sa->aad->fs.ouid);
         }
 
-        if (sa->aad.fs.target) {
+        if (sa->aad->fs.target) {
                 audit_log_format(ab, " target=");
-                audit_log_untrustedstring(ab, sa->aad.fs.target);
+                audit_log_untrustedstring(ab, sa->aad->fs.target);
         }
 }
 
@@ -107,45 +107,47 @@ int aa_audit_file(struct aa_profile *profile, struct file_perms *perms,
 {
         int type = AUDIT_APPARMOR_AUTO;
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
         COMMON_AUDIT_DATA_INIT(&sa, NONE);
-        sa.aad.op = op,
-        sa.aad.fs.request = request;
-        sa.aad.name = name;
-        sa.aad.fs.target = target;
-        sa.aad.fs.ouid = ouid;
-        sa.aad.info = info;
-        sa.aad.error = error;
-
-        if (likely(!sa.aad.error)) {
+        sa.aad = &aad;
+        aad.op = op,
+        aad.fs.request = request;
+        aad.name = name;
+        aad.fs.target = target;
+        aad.fs.ouid = ouid;
+        aad.info = info;
+        aad.error = error;
+
+        if (likely(!sa.aad->error)) {
                 u32 mask = perms->audit;
 
                 if (unlikely(AUDIT_MODE(profile) == AUDIT_ALL))
                         mask = 0xffff;
 
                 /* mask off perms that are not being force audited */
-                sa.aad.fs.request &= mask;
+                sa.aad->fs.request &= mask;
 
-                if (likely(!sa.aad.fs.request))
+                if (likely(!sa.aad->fs.request))
                         return 0;
                 type = AUDIT_APPARMOR_AUDIT;
         } else {
                 /* only report permissions that were denied */
-                sa.aad.fs.request = sa.aad.fs.request & ~perms->allow;
+                sa.aad->fs.request = sa.aad->fs.request & ~perms->allow;
 
-                if (sa.aad.fs.request & perms->kill)
+                if (sa.aad->fs.request & perms->kill)
                         type = AUDIT_APPARMOR_KILL;
 
                 /* quiet known rejects, assumes quiet and kill do not overlap */
-                if ((sa.aad.fs.request & perms->quiet) &&
+                if ((sa.aad->fs.request & perms->quiet) &&
                     AUDIT_MODE(profile) != AUDIT_NOQUIET &&
                     AUDIT_MODE(profile) != AUDIT_ALL)
-                        sa.aad.fs.request &= ~perms->quiet;
+                        sa.aad->fs.request &= ~perms->quiet;
 
-                if (!sa.aad.fs.request)
-                        return COMPLAIN_MODE(profile) ? 0 : sa.aad.error;
+                if (!sa.aad->fs.request)
+                        return COMPLAIN_MODE(profile) ? 0 : sa.aad->error;
         }
 
-        sa.aad.fs.denied = sa.aad.fs.request & ~perms->allow;
+        sa.aad->fs.denied = sa.aad->fs.request & ~perms->allow;
         return aa_audit(type, profile, gfp, &sa, file_audit_cb);
 }
 
diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h
index 4ba78c203af..3868b1e5d5b 100644
--- a/security/apparmor/include/audit.h
+++ b/security/apparmor/include/audit.h
@@ -103,7 +103,33 @@ enum aa_ops {
 };
 
 
-/* define a short hand for apparmor_audit_data portion of common_audit_data */
+struct apparmor_audit_data {
+        int error;
+        int op;
+        int type;
+        void *profile;
+        const char *name;
+        const char *info;
+        union {
+                void *target;
+                struct {
+                        long pos;
+                        void *target;
+                } iface;
+                struct {
+                        int rlim;
+                        unsigned long max;
+                } rlim;
+                struct {
+                        const char *target;
+                        u32 request;
+                        u32 denied;
+                        uid_t ouid;
+                } fs;
+        };
+};
+
+/* define a short hand for apparmor_audit_data structure */
 #define aad apparmor_audit_data
 
 void aa_audit_msg(int type, struct common_audit_data *sa,
diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c
index 7ee05c6f3c6..c3da93a5150 100644
--- a/security/apparmor/ipc.c
+++ b/security/apparmor/ipc.c
@@ -26,7 +26,7 @@ static void audit_cb(struct audit_buffer *ab, void *va)
 {
         struct common_audit_data *sa = va;
         audit_log_format(ab, " target=");
-        audit_log_untrustedstring(ab, sa->aad.target);
+        audit_log_untrustedstring(ab, sa->aad->target);
 }
 
 /**
@@ -41,10 +41,12 @@ static int aa_audit_ptrace(struct aa_profile *profile,
                            struct aa_profile *target, int error)
 {
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
         COMMON_AUDIT_DATA_INIT(&sa, NONE);
-        sa.aad.op = OP_PTRACE;
-        sa.aad.target = target;
-        sa.aad.error = error;
+        sa.aad = &aad;
+        aad.op = OP_PTRACE;
+        aad.target = target;
+        aad.error = error;
 
         return aa_audit(AUDIT_APPARMOR_AUTO, profile, GFP_ATOMIC, &sa,
                         audit_cb);
diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c
index 9516948041a..e75829ba0ff 100644
--- a/security/apparmor/lib.c
+++ b/security/apparmor/lib.c
@@ -65,8 +65,10 @@ void aa_info_message(const char *str)
 {
         if (audit_enabled) {
                 struct common_audit_data sa;
+                struct apparmor_audit_data aad = {0,};
                 COMMON_AUDIT_DATA_INIT(&sa, NONE);
-                sa.aad.info = str;
+                sa.aad = &aad;
+                aad.info = str;
                 aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, NULL);
         }
         printk(KERN_INFO "AppArmor: %s\n", str);
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 97ce8fae49b..ad05d391974 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -588,10 +588,12 @@ static int apparmor_setprocattr(struct task_struct *task, char *name,
                         error = aa_setprocattr_permipc(args);
                 } else {
                         struct common_audit_data sa;
+                        struct apparmor_audit_data aad = {0,};
                         COMMON_AUDIT_DATA_INIT(&sa, NONE);
-                        sa.aad.op = OP_SETPROCATTR;
-                        sa.aad.info = name;
-                        sa.aad.error = -EINVAL;
+                        sa.aad = &aad;
+                        aad.op = OP_SETPROCATTR;
+                        aad.info = name;
+                        aad.error = -EINVAL;
                         return aa_audit(AUDIT_APPARMOR_DENIED,
                                         __aa_current_profile(), GFP_KERNEL,
                                         &sa, NULL);
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
index 90641438302..f1f7506a464 100644
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -964,11 +964,13 @@ static int audit_policy(int op, gfp_t gfp, const char *name, const char *info,
                         int error)
 {
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
         COMMON_AUDIT_DATA_INIT(&sa, NONE);
-        sa.aad.op = op;
-        sa.aad.name = name;
-        sa.aad.info = info;
-        sa.aad.error = error;
+        sa.aad = &aad;
+        aad.op = op;
+        aad.name = name;
+        aad.info = info;
+        aad.error = error;
 
         return aa_audit(AUDIT_APPARMOR_STATUS, __aa_current_profile(), gfp,
                         &sa, NULL);
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 25fd51edc8d..deab7c7e8dc 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -70,13 +70,13 @@ struct aa_ext {
 static void audit_cb(struct audit_buffer *ab, void *va)
 {
         struct common_audit_data *sa = va;
-        if (sa->aad.iface.target) {
-                struct aa_profile *name = sa->aad.iface.target;
+        if (sa->aad->iface.target) {
+                struct aa_profile *name = sa->aad->iface.target;
                 audit_log_format(ab, " name=");
                 audit_log_untrustedstring(ab, name->base.hname);
         }
-        if (sa->aad.iface.pos)
-                audit_log_format(ab, " offset=%ld", sa->aad.iface.pos);
+        if (sa->aad->iface.pos)
+                audit_log_format(ab, " offset=%ld", sa->aad->iface.pos);
 }
 
 /**
@@ -94,13 +94,15 @@ static int audit_iface(struct aa_profile *new, const char *name,
 {
         struct aa_profile *profile = __aa_current_profile();
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
         COMMON_AUDIT_DATA_INIT(&sa, NONE);
+        sa.aad = &aad;
         if (e)
-                sa.aad.iface.pos = e->pos - e->start;
-        sa.aad.iface.target = new;
-        sa.aad.name = name;
-        sa.aad.info = info;
-        sa.aad.error = error;
+                aad.iface.pos = e->pos - e->start;
+        aad.iface.target = new;
+        aad.name = name;
+        aad.info = info;
+        aad.error = error;
 
         return aa_audit(AUDIT_APPARMOR_STATUS, profile, GFP_KERNEL, &sa,
                         audit_cb);
diff --git a/security/apparmor/resource.c b/security/apparmor/resource.c
index 72c25a4f2cf..2fe8613efe3 100644
--- a/security/apparmor/resource.c
+++ b/security/apparmor/resource.c
@@ -34,7 +34,7 @@ static void audit_cb(struct audit_buffer *ab, void *va)
         struct common_audit_data *sa = va;
 
         audit_log_format(ab, " rlimit=%s value=%lu",
-                         rlim_names[sa->aad.rlim.rlim], sa->aad.rlim.max);
+                         rlim_names[sa->aad->rlim.rlim], sa->aad->rlim.max);
 }
 
 /**
@@ -50,12 +50,14 @@ static int audit_resource(struct aa_profile *profile, unsigned int resource,
                           unsigned long value, int error)
 {
         struct common_audit_data sa;
+        struct apparmor_audit_data aad = {0,};
 
         COMMON_AUDIT_DATA_INIT(&sa, NONE);
-        sa.aad.op = OP_SETRLIMIT,
-        sa.aad.rlim.rlim = resource;
-        sa.aad.rlim.max = value;
-        sa.aad.error = error;
+        sa.aad = &aad;
+        aad.op = OP_SETRLIMIT,
+        aad.rlim.rlim = resource;
+        aad.rlim.max = value;
+        aad.error = error;
         return aa_audit(AUDIT_APPARMOR_AUTO, profile, GFP_KERNEL, &sa,
                         audit_cb);
 }