Do not call 'ima_path_check()' for each path component
authorLinus Torvalds <torvalds@linux-foundation.org>
Fri, 28 Aug 2009 17:05:33 +0000 (10:05 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 8 Sep 2009 18:07:17 +0000 (11:07 -0700)
Not only is that a supremely timing-critical path, but it's hopefully
some day going to be lockless for the common case, and ima can't do
that.

Plus the integrity code doesn't even care about non-regular files, so it
was always a total waste of time and effort.

Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/namei.c

index 1f13751693a5007e8ba1be6b0b06c948665b260c..a005d8b7afad7c941e79749261753e45493008bd 100644 (file)
@@ -856,9 +856,6 @@ static int __link_path_walk(const char *name, struct nameidata *nd)
                if (err == -EAGAIN)
                        err = inode_permission(nd->path.dentry->d_inode,
                                               MAY_EXEC);
-               if (!err)
-                       err = ima_path_check(&nd->path, MAY_EXEC,
-                                            IMA_COUNT_UPDATE);
                if (err)
                        break;