Messages in this thread | | | Date | Fri, 03 Mar 2017 19:38:33 +0900 | From | Hyunchul Lee <> | Subject | Re: [PATCH] ubifs: add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels |
| |
Hi, Richard
On 03/03/2017 04:56 PM, Richard Weinberger wrote: > Hyunchul Lee, > > Am 03.03.2017 um 08:44 schrieb Hyunchul Lee: >> From: Hyunchul Lee <cheol.lee@lge.com> >> >> When write syscall is called, every time security label is searched to >> determine that file's privileges should be changed. >> If LSM(Linux Security Model) is not used, this is useless. >> >> So introduce CONFIG_UBIFS_SECURITY to disable security labels. it's default >> value is "y". > > Can you please explain what the benefit is and why UBIFS needs this (and why not > all other filesystems)? > I guess some performance issue, do you have numbers?
no, i don't have issues and profile result. but, every time when i write 4KB blocks, ubifs_xattr_get is called with "security.capabilties" for each 4KB write. so i think that it is useless if LSM isn't used.
<7>[92028.334484] xattr_get:610: UBIFS DBG gen (pid 25746): xattr 'capability', ino 70 ('rand_5'), buf size 0 <7>[92028.334485] ubifs_lookup_level0:1183: UBIFS DBG tnc (pid 25746): search key (70, xentry, 0x10888ae6) <7>[92028.334486] ubifs_lookup_level0:1221: UBIFS DBG tnc (pid 25746): found 0, lvl 0, n 6
and some file system such as ext4 and f2fs have a kernel config to disable security labels. (EXT4_FS_SECURITY, F2FS_FS_SECURITY)
> > Thanks, > //richard >
Thanks, Hyunchul
| |