The price of SELinux (CPU)

[John Richard Moser <nigelenki@comcast.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've heard that SELinux has produced benchmarks such as 7% increased CPU
load.  Is this true and current?  Is it dependent on policy?  What is
the policy lookup complexity ( O(1), O(n), O(nlogn)...)?  Are there
other places where a bottleneck may exist aside from gruffing with the
policy?  Isn't the policy actually in xattrs so it's O(1)?  Where else
would an overhead that big come from aside from a lookup in a table?

....

Why is the sky blue?  Why do you have a mustach?  Why doesn't mommy have
one?  Does she shave it?

At any rate, my personal end goal is a secure high-performance operating
system, as user friendly as Ubuntu, Mandriva, or Win----.  To this end,
I'm (still; a lot of you have seen me before) evaluating the performance
hit of various user and kernel security enhancements like PaX,
ProPolice, various OpenWall/GrSecurity niceness that needs to be divided
out, and of course LSM/SELinux.  Also wondering about that PHKMalloc
thing on openbsd; is it really all that, is it junk, how's it compare to
the recent ptmalloc work, and can it run on Linux for direct benching .
. . but that's off topic.

- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

    Creative brains are a valuable, limited resource. They shouldn't be
    wasted on re-inventing the wheel when there are so many fascinating
    new problems waiting out there.
                                                 -- Eric Steven Raymond
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDQgT4hDd4aOud5P8RAoWBAJ0foEe4JcqDDlb7mMXQ6Z6FjCFjLACfdmJz
+j2lCH7DpTlZK6zUztldEGI=
=RzhA
-----END PGP SIGNATURE-----