This patchset is a second iteration of this patchset: https://lore.kernel.org/selinux/20181113135255.26045-1-omosnace@xxxxxxxxxx/T/ The patches that have "[squash]" in the subject are posted separately for ease of review but will be folded into the previous patch in the final posting. Changes in v2: - dropped the first patch since it is already merged in -next - fixed initial SID table to not reserve an entry for SECSID_NULL - added back an equivalent of the reverse lookup cache - fixed checkpatch.pl errors and some warnings Notes on the reverse lookup cache: I updated the sidtab insertion measurements [1] with data for the new patchset (the difference being the cache addition) and I also measured the base code with the reverse lookup cache removed [3] for comparison. Note that in this case (adding a new context) the cache will never give a hit so this only measures the overhead of traversing the whole cache. It seems that both cache implementations have similar overhead, the new one being a bit slower (but it has one entry more so it is expected). I don't have any data on how the cache helps during regular reverse lookups, since I couldn't come up with any good way to measure that. Testing: A Fedora 29 kernel with this patchset applied passes selinux-testsuite and fixes GH issue #38 [2]. Additionaly, I decided to eat my own dog food and I have now been running this kernel on my F29 work machine for several days. So far everything runs smoothly and I haven't noticed any functional or performance issues. [1] https://docs.google.com/spreadsheets/d/e/2PACX-1vRUArNJR6kckm2SEs4dRZlijNVdCTmsNuWRGe7X3fC01YkBHpxXHnmcssxEiMF3Z7ivtXN2L5MC0ry-/pubhtml [2] https://github.com/SELinuxProject/selinux-kernel/issues/38 [3] https://gitlab.com/omos/linux-public/commit/2c1ebcb8fbdcc6400734ba8d1c3015bd446e6fa5 Ondrej Mosnacek (4): selinux: use separate table for initial SID lookup [squash] do not store entry for SECSID_NULL selinux: overhaul sidtab to fix bug and improve performance [squash] add back reverse lookup cache to sidtab security/selinux/ss/mls.c | 23 +- security/selinux/ss/mls.h | 3 +- security/selinux/ss/policydb.c | 10 +- security/selinux/ss/services.c | 170 +++++---- security/selinux/ss/services.h | 2 +- security/selinux/ss/sidtab.c | 616 +++++++++++++++++++++------------ security/selinux/ss/sidtab.h | 95 +++-- 7 files changed, 560 insertions(+), 359 deletions(-) -- 2.19.1
