Re: [PATCH 06/11] IMA: use i_writecount rather than a private counter

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 2010-10-25 at 15:27 -0400, John Stoffel wrote:

> The problems with kernel.org is a perfect exmaple of how an annocuous
> feature like this, can kill a system's performance.

You admit that you don't know what you are talking about and then state
that this kills systems performance.  Interesting conclusion.

I'm not going to try to refute you point by point but will instead paint
a broad picture.  I see 3 possible states:
1) Configured out - 0 overhead.  period.
2) Configured in but default disabled
3) Configured in and enabled by admin intervention

I have (I think) pretty clearly discussed the overhead and the changes
made in case #2.  We expand struct inode by 4 bytes, we increment and
decrement those 4 bytes on open/close() and we use a new inode->i_flags.

In you e-mail you seemed to be asking about case #3 where you explicitly
chose to load a measurement policy (either custom or using the imb_tcb=1
boot option).  There are additional overheads in that case if the inode
in question matches the measurement policy.  I don't see the need to go
into the details of that overhead since you have 0 intention of using
this feature no matter what and don't seem to be interested in helping
to change those overheads for users of the subsystem.  Please correct me
if I'm wrong.  I do readily admit there is overhead, and that overhead
will be higher if inodes which have been deemed integrity relevant by
the measurement policy you chose to load are changed in certain
patterns.

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux