From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Weimer Subject: Re: Thoughts on credential switching Date: Thu, 27 Mar 2014 16:41:27 +0100 Message-ID: <533446A7.6020003@redhat.com> References: <20140327004225.GA20247@sergelap> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Jim Lieb , "Eric W. Biederman" , LSM List , "Serge E. Hallyn" , Kees Cook , Linux FS Devel , "Theodore Ts'o" , "linux-kernel@vger.kernel.org" , bfields@redhat.com, Jeff Layton To: Andy Lutomirski , Serge Hallyn Return-path: In-Reply-To: Sender: linux-security-module-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On 03/27/2014 02:01 AM, Andy Lutomirski wrote: > Essentially, it's a performance problem. knfsd has override_creds, > and it can cache struct cred. But userspace doing the same thing > (i.e. impersonating a user) has to do setresuid, setresgid, and > setgroups, which kills performance, since it results in something like > five RCU callbacks per impersonation round-trip. Do you mean setfsuid instead of setresuid? -- Florian Weimer / Red Hat Product Security Team