diff options
| author | Mateusz Guzik <mjguzik@gmail.com> | 2025-03-18 23:06:41 +0100 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2025-07-15 22:39:43 -0700 |
| commit | 87cc7b00114f6f751d25f6a5f05128dc27ef64db (patch) | |
| tree | c8acf0039c846af5129c5e09977785033304ebb6 /security/apparmor/policy.c | |
| parent | 37a3741d27b64012ab6a5d9c92b514b977349dbb (diff) | |
apparmor: make __begin_current_label_crit_section() indicate whether put is needed
Same as aa_get_newest_cred_label_condref().
This avoids a bunch of work overall and allows the compiler to note when no
clean up is necessary, allowing for tail calls.
This in particular happens in apparmor_file_permission(), which manages to
tail call aa_file_perm() 105 bytes in (vs a regular call 112 bytes in
followed by branches to figure out if clean up is needed).
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/policy.c')
| -rw-r--r-- | security/apparmor/policy.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 1f532fe48a1c..a60bb7d9b583 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -870,11 +870,11 @@ bool aa_policy_admin_capable(const struct cred *subj_cred, bool aa_current_policy_view_capable(struct aa_ns *ns) { struct aa_label *label; - bool res; + bool needput, res; - label = __begin_current_label_crit_section(); + label = __begin_current_label_crit_section(&needput); res = aa_policy_view_capable(current_cred(), label, ns); - __end_current_label_crit_section(label); + __end_current_label_crit_section(label, needput); return res; } @@ -882,11 +882,11 @@ bool aa_current_policy_view_capable(struct aa_ns *ns) bool aa_current_policy_admin_capable(struct aa_ns *ns) { struct aa_label *label; - bool res; + bool needput, res; - label = __begin_current_label_crit_section(); + label = __begin_current_label_crit_section(&needput); res = aa_policy_admin_capable(current_cred(), label, ns); - __end_current_label_crit_section(label); + __end_current_label_crit_section(label, needput); return res; } |