linux-kernel - Re: [apparmor] [PATCH v2] APPARMOR: add sid to profile mapping and sidrecycling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 30 Nov 2010 10:12:20 +0000
From:	"Seth Arnold" <seth.arnold@...il.com>
To:	wzt.wzt@...il.com, linux-kernel@...r.kernel.org
Cc:	linux-security-module@...r.kernel.org, apparmor@...ts.ubuntu.com
Subject: Re: [apparmor] [PATCH v2] APPARMOR: add sid to profile mapping and sidrecycling

Please forgive the rubbish blackberry quoting.

+
+/* find the first zero bit in the sid_bitmap array */
+spin_lock(&aa_sid_hash_table->lock);
+for (i = 0; i < AA_SID_BITMAP_SIZE; i++) {
+for (j = 0; j < 32; j++) {
+if (!(sid_bitmap[i] & (1 << j))) {
+/* convert offset to sid */
+sid = i * 32 + j;
+goto alloc_ok;
+}
+}
+}
+spin_unlock(&aa_sid_hash_table->lock);

This could be 32768 bit comparisons performed under spinlock (unlikely, perhaps, but that is the size of the datastructures...). At the least a check for sid_bitmap[I]!=0xFFFFFFFF should be placed in the outer for loop, but that could still leave 1024 word comparisons under spinlock, which feels expensive to me.

Thanks
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/