diff options
| author | Mateusz Guzik <mjguzik@gmail.com> | 2024-06-20 19:15:27 +0200 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2024-07-24 11:05:14 -0700 |
| commit | f4fee216df7d28b87d1c9cc60bcebfecb51c1a05 (patch) | |
| tree | 43f46dacda613f67cda982c55588f0dd3e457de6 /security/apparmor/include/cred.h | |
| parent | 4b954a025591a1c7d3a0c0111b6d4730596046b6 (diff) | |
apparmor: try to avoid refing the label in apparmor_file_open
If the label is not stale (which is the common case), the fact that the
passed file object holds a reference can be leverged to avoid the
ref/unref cycle. Doing so reduces performance impact of apparmor on
parallel open() invocations.
When benchmarking on a 24-core vm using will-it-scale's open1_process
("Separate file open"), the results are (ops/s):
before: 6092196
after: 8309726 (+36%)
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor/include/cred.h')
| -rw-r--r-- | security/apparmor/include/cred.h | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/security/apparmor/include/cred.h b/security/apparmor/include/cred.h index 58fdc72af664..7265d2f81dd5 100644 --- a/security/apparmor/include/cred.h +++ b/security/apparmor/include/cred.h @@ -63,6 +63,26 @@ static inline struct aa_label *aa_get_newest_cred_label(const struct cred *cred) return aa_get_newest_label(aa_cred_raw_label(cred)); } +static inline struct aa_label *aa_get_newest_cred_label_condref(const struct cred *cred, + bool *needput) +{ + struct aa_label *l = aa_cred_raw_label(cred); + + if (unlikely(label_is_stale(l))) { + *needput = true; + return aa_get_newest_label(l); + } + + *needput = false; + return l; +} + +static inline void aa_put_label_condref(struct aa_label *l, bool needput) +{ + if (unlikely(needput)) + aa_put_label(l); +} + /** * aa_current_raw_label - find the current tasks confining label * |