From: Siarhei Liakh <siarhei.liakh@xxxxxxxxxxxxxxxxx>
This patch set is the result of an actual customer support case where a client
of ours observed unacceptable variability of timings while sending UDP packets
via sendto() with SELinux enabled. The initial investigation centered around
kernel 3.10.108 in CentOS 6.5 environment. Combination of these patches with
some substantial tuning of newly added Kconfig options was able to reduce
*maximum* sendto() latency to about 160us, down from well over 2ms. Worst
latency was typically observed when a new SSH login was initiated concurrently
with the test program running a sendto() loop, thus causing an AVC miss with a
subsequent call to security_compute_av(), which would spend most of its time
iterating through policydb within context_struct_compute_av().
The original patch set was developed for linux kernel 3.10.108 and later ported
to newer versions. The patch set presented here is based off Linus' tree as of
April 7, 2020 and contains only a subset of the changes which are still relevant
to 5.6+ as many of the issues had already been addressed in different ways.
The patch set consists of 9 patches total and is meant to achieve two goals:
1. Replace most local copies of custom hash functions with generic hash
functions already available in inlude/linux/*.h.
2. Replace hard-coded hash table sizing parameters with Kconfig tunables.
"Advanced Hashing" Kconfig option is the only dependency between the patches,
but other than that and any combination of them can be used.
Please CC me directly in all replies.
Siarhei Liakh (9):
SELinux: Introduce "Advanced Hashing" Kconfig option
SELinux: Use Bob Jenkins' lookup3 hash in AVC
SELinux: Expose AVC sizing tunables via Kconfig
SELinux: Replace custom hash in avtab with generic lookup3 from the
library
SELinux: Expose AVTab sizing tunables via Kconfig
SELinux: Replace custom hash with generic lookup3 in policydb
SELinux: Expose filename_tr hash table sizing via Kconfig
SELinux: Replace custom hash with generic lookup3 in symtab
SELinux: Expose netport hash table sizing via Kconfig
security/selinux/Kconfig | 83 ++++++++++++++++++++++++++++++++++
security/selinux/avc.c | 23 ++++++++--
security/selinux/netport.c | 4 +-
security/selinux/ss/avtab.c | 39 ++--------------
security/selinux/ss/avtab.h | 2 +-
security/selinux/ss/policydb.c | 46 +++++++++++++++----
security/selinux/ss/symtab.c | 12 +++++
7 files changed, 159 insertions(+), 50 deletions(-)
--
2.17.1
