Re: [PATCH] selinux: check level category sets once at load time

On Thu, Aug 6, 2026 at 4:20 AM Jiri Vozar <[email protected]> wrote:
>
> Yes, you can.

My apologies, I sent this up to Linus yesterday so was not able to
include your tested by tag, but you do have reporter and suggested
credit.  I also just saw that Linus has merged the fix and it should
be part of Linux v7.2 when it is released in a couple of weeks.

Thanks again for your help!

> st 5. 8. 2026 v 17:31 odesílatel Paul Moore <[email protected]> napsal:
> >
> > On Wed, Aug 5, 2026 at 10:56 AM Jiri Vozar <[email protected]> wrote:
> > >
> > > Hi,
> > > thank you for the quick patching. I tried the patch and the
> > > performance fully recovered.
> >
> > Thanks for the verification.  Can I add your 'Tested-by:' tag to the commit?
> >
> > > út 4. 8. 2026 v 16:57 odesílatel Paul Moore <[email protected]> napsal:
> > > > On Aug  4, 2026 Stephen Smalley <[email protected]> wrote:
> > > > >
> > > > > As reported by Jiri Vozar, commit 7edea6e8c8e8 ("selinux: beef up
> > > > > isvalid checks") introduces a new loop in mls_level_isvalid() that
> > > > > causes ~89-94% throughput regression in System V IPC message queue
> > > > > operations (msgsnd/msgrcv).
> > > > >
> > > > > Move the expensive part of the ebitmap checking to policy load time
> > > > > instead as the reporter suggested.
> > > > >
> > > > > Reported-by: Jiri Vozar <[email protected]>
> > > > > Link: https://lore.kernel.org/selinux/CAMgFczCi2Z011dNf84Amc0Q-qnTt0+VUjWY+Y7zPyXdaH35Jvw@mail.gmail.com/
> > > > > Fixes: 7edea6e8c8e8 ("selinux: beef up isvalid checks")
> > > > > Suggested-by: Jiri Vozar <[email protected]>
> > > > > Signed-off-by: Stephen Smalley <[email protected]>
> > > > > ---
> > > > >  security/selinux/ss/mls.c      | 24 +++++++-----------------
> > > > >  security/selinux/ss/policydb.c | 23 +++++++++++++++++++++++
> > > > >  2 files changed, 30 insertions(+), 17 deletions(-)
> > > >
> > > > Merged into selinux/stable-7.2, thanks everyone!

-- 
paul-moore.com