linux/security/apparmor
Sebastian Andrzej Siewior df323337e5 apparmor: Use a memory pool instead per-CPU caches
The get_buffers() macro may provide one or two buffers to the caller.
Those buffers are pre-allocated on init for each CPU. By default it
allocates
	2* 2 * MAX_PATH * POSSIBLE_CPU

which equals 64KiB on a system with 4 CPUs or 1MiB with 64 CPUs and so
on.

Replace the per-CPU buffers with a common memory pool which is shared
across all CPUs. The pool grows on demand and never shrinks. The pool
starts with two (UP) or four (SMP) elements. By using this pool it is
possible to request a buffer and keeping preemption enabled which avoids
the hack in profile_transition().

It has been pointed out by Tetsuo Handa that GFP_KERNEL allocations for
small amount of memory do not fail. In order not to have an endless
retry, __GFP_RETRY_MAYFAIL is passed (so the memory allocation is not
repeated until success) and retried once hoping that in the meantime a
buffer has been returned to the pool. Since now NULL is possible all
allocation paths check the buffer pointer and return -ENOMEM on failure.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-06-20 10:33:31 -07:00
..
include apparmor: Use a memory pool instead per-CPU caches 2019-06-20 10:33:31 -07:00
.gitignore apparmor: add base infastructure for socket mediation 2018-03-13 17:25:48 -07:00
Kconfig apparmor: fix missing ZLIB defines 2019-04-11 14:56:37 -07:00
Makefile apparmor: add base infastructure for socket mediation 2018-03-13 17:25:48 -07:00
apparmorfs.c apparmor: Initial implementation of raw policy blob compression 2019-04-11 14:56:29 -07:00
audit.c audit: remove unused actx param from audit_rule_match 2019-01-31 23:00:15 -05:00
capability.c LSM: generalize flag passing to security_capable 2019-01-10 14:16:06 -08:00
crypto.c crypto: drop mask=CRYPTO_ALG_ASYNC from 'shash' tfm allocations 2018-11-20 14:26:55 +08:00
domain.c apparmor: Use a memory pool instead per-CPU caches 2019-06-20 10:33:31 -07:00
file.c apparmor: Use a memory pool instead per-CPU caches 2019-06-20 10:33:31 -07:00
ipc.c LSM: generalize flag passing to security_capable 2019-01-10 14:16:06 -08:00
label.c apparmor: fixup secid map conversion to using IDR 2018-06-07 01:50:49 -07:00
lib.c apparmor: Fix uninitialized value in aa_split_fqname 2018-10-03 06:29:22 -07:00
lsm.c apparmor: Use a memory pool instead per-CPU caches 2019-06-20 10:33:31 -07:00
match.c apparmor: fix typo "traverse" 2018-05-03 00:50:12 -07:00
mount.c apparmor: Use a memory pool instead per-CPU caches 2019-06-20 10:33:31 -07:00
net.c apparmor: add #ifdef checks for secmark filtering 2018-10-12 17:09:56 -07:00
nulldfa.in apparmor: cleanup add proper line wrapping to nulldfa.in 2018-02-09 11:30:01 -08:00
path.c apparmor: Move path lookup to using preallocated buffers 2017-06-08 11:29:34 -07:00
policy.c apparmor: fix spelling mistake "immutible" -> "immutable" 2019-04-17 00:59:46 -07:00
policy_ns.c apparmor: fix an error code in __aa_create_ns() 2018-08-21 16:24:56 -07:00
policy_unpack.c apparmor: fix blob compression when ns is forced on a policy load 2019-04-11 14:56:37 -07:00
procattr.c apparmor: move context.h to cred.h 2018-02-09 11:30:01 -08:00
resource.c LSM: generalize flag passing to security_capable 2019-01-10 14:16:06 -08:00
secid.c + Features/Improvements 2018-11-02 10:04:26 -07:00
stacksplitdfa.in apparmor: use the dfa to do label parse string splitting 2018-02-09 11:30:01 -08:00
task.c AppArmor: Abstract use of cred security blob 2019-01-08 13:18:44 -08:00