On 2/18/20 6:27 AM, Ondrej Mosnacek wrote:
In these rules, each rule with the same (target type, target class,
filename) values is (in practice) always mapped to the same result type.
Therefore, it is much more efficient to group the rules by (ttype,
tclass, filename).
Thus, this patch drops the stype field from the key and changes the
datum to be a linked list of one or more structures that contain a
result type and an ebitmap of source types that map the given target to
the given result type under the given filename. The size of the hash
table is also incremented to 2048 to be more optimal for Fedora policy
(which currently has ~2500 unique (ttype, tclass, filename) tuples,
regardless of whether the 'unconfined' module is enabled).
Not only does this dramtically reduce memory usage when the policy
contains a lot of unconfined domains (ergo a lot of filename based
transitions), but it also slightly reduces memory usage of strongly
confined policies (modeled on Fedora policy with 'unconfined' module
disabled) and significantly reduces lookup times of these rules on
Fedora (roughly matches the performance of the rhashtable conversion
patch [1] posted recently to selinux@xxxxxxxxxxxxxxx).
An obvious next step is to change binary policy format to match this
layout, so that disk space is also saved. However, since that requires
more work (including matching userspace changes) and this patch is
already beneficial on its own, I'm posting it separately.
Performance/memory usage comparison:
Kernel | Policy load | Policy load | Mem usage | Mem usage | openbench
| | (-unconfined) | | (-unconfined) | (createfiles)
-----------------|-------------|---------------|-----------|---------------|--------------
reference | 1,30s | 0,91s | 90MB | 77MB | 55 us/file
rhashtable patch | 0.98s | 0,85s | 85MB | 75MB | 38 us/file
this patch | 0,95s | 0,87s | 75MB | 75MB | 40 us/file
(Memory usage is measured after boot. With SELinux disabled the memory
usage was ~60MB on the same system.)
[1] https://lore.kernel.org/selinux/20200116213937.77795-1-dev@xxxxxxxxxx/T/
Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
---
Changes in v3:
- filename_trans_read_one()
- remove the 'newdatum' variable
- uintptr_t -> u32 (leftover from a WIP version of this patch)
- drop 'already_there', just goto out immediately
- allocate 'ft' using kmemdup() instead of kzalloc()
- filename_write_helper()
- move strlen() call outside the loop
- move declaration of 'node' outside the loop
security/selinux/ss/policydb.c | 166 +++++++++++++++++++--------------
security/selinux/ss/policydb.h | 8 +-
security/selinux/ss/services.c | 16 ++--
3 files changed, 110 insertions(+), 80 deletions(-)
[...]
