Re: [PATCH] selinux: check level category sets once at load time

Yes, you can.

st 5. 8. 2026 v 17:31 odesílatel Paul Moore <[email protected]> napsal:
>
> On Wed, Aug 5, 2026 at 10:56 AM Jiri Vozar <[email protected]> wrote:
> >
> > Hi,
> > thank you for the quick patching. I tried the patch and the
> > performance fully recovered.
>
> Thanks for the verification.  Can I add your 'Tested-by:' tag to the commit?
>
> > út 4. 8. 2026 v 16:57 odesílatel Paul Moore <[email protected]> napsal:
> > > On Aug  4, 2026 Stephen Smalley <[email protected]> wrote:
> > > >
> > > > As reported by Jiri Vozar, commit 7edea6e8c8e8 ("selinux: beef up
> > > > isvalid checks") introduces a new loop in mls_level_isvalid() that
> > > > causes ~89-94% throughput regression in System V IPC message queue
> > > > operations (msgsnd/msgrcv).
> > > >
> > > > Move the expensive part of the ebitmap checking to policy load time
> > > > instead as the reporter suggested.
> > > >
> > > > Reported-by: Jiri Vozar <[email protected]>
> > > > Link: https://lore.kernel.org/selinux/CAMgFczCi2Z011dNf84Amc0Q-qnTt0+VUjWY+Y7zPyXdaH35Jvw@mail.gmail.com/
> > > > Fixes: 7edea6e8c8e8 ("selinux: beef up isvalid checks")
> > > > Suggested-by: Jiri Vozar <[email protected]>
> > > > Signed-off-by: Stephen Smalley <[email protected]>
> > > > ---
> > > >  security/selinux/ss/mls.c      | 24 +++++++-----------------
> > > >  security/selinux/ss/policydb.c | 23 +++++++++++++++++++++++
> > > >  2 files changed, 30 insertions(+), 17 deletions(-)
> > >
> > > Merged into selinux/stable-7.2, thanks everyone!
>
> --
> paul-moore.com
>