Re: [PATCH] selinux: check level category sets once at load time

On Wed, Aug 5, 2026 at 10:56 AM Jiri Vozar <[email protected]> wrote:
>
> Hi,
> thank you for the quick patching. I tried the patch and the
> performance fully recovered.

Thanks for the verification.  Can I add your 'Tested-by:' tag to the commit?

> út 4. 8. 2026 v 16:57 odesílatel Paul Moore <[email protected]> napsal:
> > On Aug  4, 2026 Stephen Smalley <[email protected]> wrote:
> > >
> > > As reported by Jiri Vozar, commit 7edea6e8c8e8 ("selinux: beef up
> > > isvalid checks") introduces a new loop in mls_level_isvalid() that
> > > causes ~89-94% throughput regression in System V IPC message queue
> > > operations (msgsnd/msgrcv).
> > >
> > > Move the expensive part of the ebitmap checking to policy load time
> > > instead as the reporter suggested.
> > >
> > > Reported-by: Jiri Vozar <[email protected]>
> > > Link: https://lore.kernel.org/selinux/CAMgFczCi2Z011dNf84Amc0Q-qnTt0+VUjWY+Y7zPyXdaH35Jvw@mail.gmail.com/
> > > Fixes: 7edea6e8c8e8 ("selinux: beef up isvalid checks")
> > > Suggested-by: Jiri Vozar <[email protected]>
> > > Signed-off-by: Stephen Smalley <[email protected]>
> > > ---
> > >  security/selinux/ss/mls.c      | 24 +++++++-----------------
> > >  security/selinux/ss/policydb.c | 23 +++++++++++++++++++++++
> > >  2 files changed, 30 insertions(+), 17 deletions(-)
> >
> > Merged into selinux/stable-7.2, thanks everyone!

-- 
paul-moore.com