• Casey Schaufler's avatar
    Smack: Rule list lookup performance · 272cd7a8
    Casey Schaufler authored
    This patch is targeted for the smack-next tree.
    
    Smack access checks suffer from two significant performance
    issues. In cases where there are large numbers of rules the
    search of the single list of rules is wasteful. Comparing the
    string values of the smack labels is less efficient than a
    numeric comparison would.
    
    These changes take advantage of the Smack label list, which
    maintains the mapping of Smack labels to secids and optional
    CIPSO labels. Because the labels are kept perpetually, an
    access check can be done strictly based on the address of the
    label in the list without ever looking at the label itself.
    Rather than keeping one global list of rules the rules with
    a particular subject label can be based off of that label
    list entry. The access check need never look at entries that
    do not use the current subject label.
    
    This requires that packets coming off the network with
    CIPSO direct Smack labels that have never been seen before
    be treated carefully. The only case where they could be
    delivered is where the receiving socket has an IPIN star
    label, so that case is explicitly addressed.
    
    On a system with 39,800 rules (200 labels in all permutations)
    a system with this patch runs an access speed test in 5% of
    the time of the old version. That should be a best case
    improvement. If all of the rules are associated with the
    same subject label and all of the accesses are for processes
    with that label (unlikely) the improvement is about 30%.
    Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
    272cd7a8
smack_access.c 13.4 KB