Re: [PATCH] selinux: check level category sets once at load time

Hi,
thank you for the quick patching. I tried the patch and the
performance fully recovered.

JirkaV

út 4. 8. 2026 v 16:57 odesílatel Paul Moore <[email protected]> napsal:

>
> On Aug  4, 2026 Stephen Smalley <[email protected]> wrote:
> >
> > As reported by Jiri Vozar, commit 7edea6e8c8e8 ("selinux: beef up
> > isvalid checks") introduces a new loop in mls_level_isvalid() that
> > causes ~89-94% throughput regression in System V IPC message queue
> > operations (msgsnd/msgrcv).
> >
> > Move the expensive part of the ebitmap checking to policy load time
> > instead as the reporter suggested.
> >
> > Reported-by: Jiri Vozar <[email protected]>
> > Link: https://lore.kernel.org/selinux/CAMgFczCi2Z011dNf84Amc0Q-qnTt0+VUjWY+Y7zPyXdaH35Jvw@mail.gmail.com/
> > Fixes: 7edea6e8c8e8 ("selinux: beef up isvalid checks")
> > Suggested-by: Jiri Vozar <[email protected]>
> > Signed-off-by: Stephen Smalley <[email protected]>
> > ---
> >  security/selinux/ss/mls.c      | 24 +++++++-----------------
> >  security/selinux/ss/policydb.c | 23 +++++++++++++++++++++++
> >  2 files changed, 30 insertions(+), 17 deletions(-)
>
> Merged into selinux/stable-7.2, thanks everyone!
>
> --
> paul-moore.com
>