Re: [PATCH 0/5] LSM hook updates

Stephen Smalley
2005-08-26T13:30:28Z

On Fri, 2005-08-26 at 04:23 -0500, serue@us.ibm.com wrote:
> Here are some numbers on a 4way x86 - PIII 700Mhz with 1G memory (hmm,
> highmem not enabled). I should hopefully have a 2way ppc available
> later today for a pair of runs.
>
> dbench and tbench were run 50 times each, kernbench and reaim 10 times
> each. Results are mean +/- 95% confidence half-interval. Kernel had
> selinux and capabilities compiled in.
>
> A little surprising: kernbench is improved, but dbench and tbench
> are worse - though within the 95% CI.

Might be interesting to roll in Chris' patch (sent separately to lsm and
selinux list) for "remove selinux stacked ops" in place of your patch,
as that will avoid the indirect call through the secondary_ops in
SELinux. At that point, you can also disable the capability module
altogether, as SELinux will just directly use the built-in cap_
functions from commoncap.

--
Stephen Smalley
National Security Agency