s.m.a.c.k

s.m.a.c.k

[Justin Mattock]

[-- Attachment #1: Type: text/plain, Size: 659 bytes --]

Hello; Thanks for the info on s.m.a.c.k, ("I thought it was part of
SELinux");  it seems similar to apparmour!  I think I'll stick with SELinux.

I had a quick question about power consumption, I've been doing a lot of
testing and seem to find no signs of SELinux or audit causing any wakeups at
all to the processor, but then googling some web site I came acrossed  said
there was a 7% overhead of energy or something in this area. What info do
you have in the area of power consumption, wakeups to the processor or load
on the processor with SELinux or audit that I should be aware of while Im
doing some testing?
regards;
              --Justin P. Mattock

[-- Attachment #2: Type: text/html, Size: 771 bytes --]

SELinux power consumption (was Re: s.m.a.c.k)

[James Morris]

On Thu, 14 Feb 2008, Justin Mattock wrote:

> I had a quick question about power consumption, I've been doing a lot of
> testing and seem to find no signs of SELinux or audit causing any wakeups at
> all to the processor, but then googling some web site I came acrossed  said
> there was a 7% overhead of energy or something in this area. What info do
> you have in the area of power consumption, wakeups to the processor or load
> on the processor with SELinux or audit that I should be aware of while Im
> doing some testing?

IIRC, this was something like the setroubleshoot desktop applet, and I'm 
not sure if it was fixed or not.  If not, it needs to be.

(cc'd Arjan, who I think discovered the issue).


- James
-- 
James Morris
<jmorris@namei.org>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: s.m.a.c.k

[Stephen Smalley]

On Thu, 2008-02-14 at 02:22 +0000, Justin Mattock wrote:
> Hello; Thanks for the info on s.m.a.c.k, ("I thought it was part of
> SELinux");  it seems similar to apparmour!  I think I'll stick with
> SELinux. 
> I had a quick question about power consumption, I've been doing a lot
> of testing and seem to find no signs of SELinux or audit causing any
> wakeups at all to the processor, but then googling some web site I
> came acrossed  said there was a 7% overhead of energy or something in
> this area. What info do you have in the area of power consumption,
> wakeups to the processor or load on the processor with SELinux or
> audit that I should be aware of while Im doing some testing?
> regards;

Smack is quite different from AppArmor, but also quite different from
SELinux.

SELinux imposes a performance overhead, but it shouldn't especially
affect power consumption.  You might be thinking of bugs in certain
SELinux-related daemons, like setroubleshootd in Fedora, that caused it
to spin.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux power consumption (was Re: s.m.a.c.k)

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

James Morris wrote:
> On Thu, 14 Feb 2008, Justin Mattock wrote:
> 
>> I had a quick question about power consumption, I've been doing a lot of
>> testing and seem to find no signs of SELinux or audit causing any wakeups at
>> all to the processor, but then googling some web site I came acrossed  said
>> there was a 7% overhead of energy or something in this area. What info do
>> you have in the area of power consumption, wakeups to the processor or load
>> on the processor with SELinux or audit that I should be aware of while Im
>> doing some testing?
> 
> IIRC, this was something like the setroubleshoot desktop applet, and I'm 
> not sure if it was fixed or not.  If not, it needs to be.
> 
> (cc'd Arjan, who I think discovered the issue).
> 
> 
> - James
sealert, the applet for setroubleshoot was a threaded python app.  The
python library that sealert uses wakes up every .1 seconds to see if the
parent received a signal.  This was causing the problem.   This has been
fixed in all versions of setroubleshoot, I believe.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAke0OV0ACgkQrlYvE4MpobOo0wCfRoyXVZcYkodfUGlL4qQ62JeF
V9oAoNmeRQuQOMZWpaAmJcoliaguUm9X
=F/p4
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: s.m.a.c.k

[Russell Coker]

On Thursday 14 February 2008 23:31, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> SELinux imposes a performance overhead, but it shouldn't especially
> affect power consumption.  You might be thinking of bugs in certain
> SELinux-related daemons, like setroubleshootd in Fedora, that caused it
> to spin.

There are a couple of cases where SE Linux will increase power use.

One is the case of broken applications that go into an infinite loop when 
confronted with an unexpected EPERM.  If you have a power hungry CPU (P4 or 
P-D) then a single process doing that can cost a significant amount of power.

Another is the issue of auditing.  When SE Linux denies an operation and 
doesn't have a dontaudit rule the event will be logged.  This involves some 
CPU use by the kernel and syslogd or auditd and then some disk IO.  Obviously 
in those cases more power is used than otherwise.

Ideally neither of these situations would ever occur on your machines, and in 
practice they are quite uncommon.

The vast majority of SE Linux access control decisions (on a system without 
Security Enhanced X) will concern system calls.  On most systems the majority 
of power is taken by IO (moving disk heads takes energy) and application 
computation (Firefox on my system has accumulated 24 DAYS of CPU time).  
Neither application computation nor disk IO will be affected by SE Linux 
(except in the cases of looping programs and logging).

On my desktop machine nothing other than Firefox matters for electricity use.  
The servers I run at the moment are mostly idle so the electricity use would 
be pretty close to the minimum for an idle system.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.