Re: [PATCH] selinux: check level category sets once at load time
Paul Moore <[email protected]>
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <[email protected]> |
On Aug 4, 2026 Stephen Smalley <[email protected]> wrote: > > As reported by Jiri Vozar, commit 7edea6e8c8e8 ("selinux: beef up > isvalid checks") introduces a new loop in mls_level_isvalid() that > causes ~89-94% throughput regression in System V IPC message queue > operations (msgsnd/msgrcv). > > Move the expensive part of the ebitmap checking to policy load time > instead as the reporter suggested. > > Reported-by: Jiri Vozar <[email protected]> > Link: https://lore.kernel.org/selinux/CAMgFczCi2Z011dNf84Amc0Q-qnTt0+VUjWY+Y7zPyXdaH35Jvw@mail.gmail.com/ > Fixes: 7edea6e8c8e8 ("selinux: beef up isvalid checks") > Suggested-by: Jiri Vozar <[email protected]> > Signed-off-by: Stephen Smalley <[email protected]> > --- > security/selinux/ss/mls.c | 24 +++++++----------------- > security/selinux/ss/policydb.c | 23 +++++++++++++++++++++++ > 2 files changed, 30 insertions(+), 17 deletions(-) Merged into selinux/stable-7.2, thanks everyone! -- paul-moore.com