[lkml]   [2013]   [May]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Stupid VFS name lookup interface..
    On Sat, May 25, 2013 at 11:33 AM, Casey Schaufler
    <> wrote:
    > Now I'll put on my Smack maintainer hat. Performance improvement is
    > always welcome, but I would rather see attention to performance of
    > the LSM architecture than SELinux specific hacks.

    I haven't seen huge issues with performance at that level.

    > The LSM blob
    > pointer scheme is there so that you (Linus) don't have to see the
    > dreadful things that we security people are doing. Is it time to
    > get past that level of disassociation? Or, and I really hate asking
    > this, have you fallen into the SELinux camp?

    I only have selinux performance to look at, since I run Fedora. I used
    to actually turn it off entirely, because it impacted VFS performance
    so horribly. We fixed it. I (and Al) spent time to make sure that we
    don't need to drop RCU lookup just because we call into the security
    layers etc.

    But I haven't even looked at what non-selinux setups do to
    performance. Last time I tried Ubuntu (they still use apparmor, no?),
    "make modules_install ; make install" didn't work for the kernel, and
    if the Ubuntu people don't want to support kernel engineers, I
    certainly am not going to bother with them. Who uses smack?


     \ /
      Last update: 2013-05-26 05:41    [W:0.024 / U:3.404 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site