lkml.org 
[lkml]   [2017]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] ubifs: add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels
Hi, Richard

On 03/03/2017 04:56 PM, Richard Weinberger wrote:
> Hyunchul Lee,
>
> Am 03.03.2017 um 08:44 schrieb Hyunchul Lee:
>> From: Hyunchul Lee <cheol.lee@lge.com>
>>
>> When write syscall is called, every time security label is searched to
>> determine that file's privileges should be changed.
>> If LSM(Linux Security Model) is not used, this is useless.
>>
>> So introduce CONFIG_UBIFS_SECURITY to disable security labels. it's default
>> value is "y".
>
> Can you please explain what the benefit is and why UBIFS needs this (and why not
> all other filesystems)?
> I guess some performance issue, do you have numbers?

no, i don't have issues and profile result. but, every time when i write
4KB blocks, ubifs_xattr_get is called with "security.capabilties" for
each 4KB write. so i think that it is useless if LSM isn't used.

<7>[92028.334484] xattr_get:610: UBIFS DBG gen (pid 25746): xattr 'capability', ino 70 ('rand_5'), buf size 0
<7>[92028.334485] ubifs_lookup_level0:1183: UBIFS DBG tnc (pid 25746): search key (70, xentry, 0x10888ae6)
<7>[92028.334486] ubifs_lookup_level0:1221: UBIFS DBG tnc (pid 25746): found 0, lvl 0, n 6

and some file system such as ext4 and f2fs have a kernel config to
disable security labels. (EXT4_FS_SECURITY, F2FS_FS_SECURITY)

>
> Thanks,
> //richard
>

Thanks,
Hyunchul

\
 
 \ /
  Last update: 2017-03-03 12:10    [W:0.048 / U:0.476 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site