As the refpolicy and the default Fedora policy continue to grow in
size, especially with regard to rules / access vectors, the memory
usage of the policydb and runtime to search through it increases.
Looking at /proc/slabinfo indicates that the avtab_node_cachep
kmem_cache is significantly responsible for overall memory usage and
was a good target for optimizations. Running "perf stat" on the
"load_policy" command shows that a majority of time is spent adding
rules into the avtab.
This patch series is an attempt at optimizing these hot spots within
the security server implementation to help it scale with additional
rules in the future.
All patches are independent of each other.
Patches 1-2 are refactors of the internal avtab.c interfaces and code
paths with no logic changes. It removes duplicative code and
homogenizes access patterns.
Patch 3 changes avtab to use arrays instead of a kmem_cache for the
individual nodes of the hashtable.
Changelog:
v3:
- selinux: simplify avtab_insert_node() prototype
- dropped, already merged
- selinux: avtab iteration macros
- reverted changes to avtab_destroy() which created a UAF bug
- selinux: refactor avtab_node comparisons
- fixed indent issues in avtab_node_cmp()
- removed unlikely() macro in avtab_insert()
v2:
- selinux: use arrays for avtab hashtable nodes
- rewritten to use pointers instead of indices
- NULL_NODE_IDX and NODES_ARRAY_IDX macros removed
- getter functions removed
- two-pass algorithm used to compute cond. table size prior to
allocating the array
- selinux: hweight optimization in avtab_read_item
- dropped, already merged
- selinux: shrink conditional avtab node array
- dropped, not needed due to new allocation approach
- selinux: refactor avtab_node comparisons
- newly added
- selinux: avtab iteration macros
- newly added
- selinux: simplify avtab_insert_node() prototype
- newly added
Jacob Satterfield (3):
selinux: refactor avtab_node comparisons
selinux: avtab iteration macros
selinux: use arrays for avtab hashtable nodes
security/selinux/ss/avtab.c | 176 ++++++++++++++----------------
security/selinux/ss/avtab.h | 4 +-
security/selinux/ss/conditional.c | 37 +++++--
security/selinux/ss/conditional.h | 2 +-
4 files changed, 112 insertions(+), 107 deletions(-)
--
2.41.0
