From: John Richard Moser <nigelenki@comcast.net>
To: linux-kernel@vger.kernel.org
Subject: The price of SELinux (CPU)
Date: Tue, 04 Oct 2005 00:28:40 -0400 [thread overview]
Message-ID: <434204F8.2030209@comcast.net> (raw)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I've heard that SELinux has produced benchmarks such as 7% increased CPU
load. Is this true and current? Is it dependent on policy? What is
the policy lookup complexity ( O(1), O(n), O(nlogn)...)? Are there
other places where a bottleneck may exist aside from gruffing with the
policy? Isn't the policy actually in xattrs so it's O(1)? Where else
would an overhead that big come from aside from a lookup in a table?
....
Why is the sky blue? Why do you have a mustach? Why doesn't mommy have
one? Does she shave it?
At any rate, my personal end goal is a secure high-performance operating
system, as user friendly as Ubuntu, Mandriva, or Win----. To this end,
I'm (still; a lot of you have seen me before) evaluating the performance
hit of various user and kernel security enhancements like PaX,
ProPolice, various OpenWall/GrSecurity niceness that needs to be divided
out, and of course LSM/SELinux. Also wondering about that PHKMalloc
thing on openbsd; is it really all that, is it junk, how's it compare to
the recent ptmalloc work, and can it run on Linux for direct benching .
. . but that's off topic.
- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.
Creative brains are a valuable, limited resource. They shouldn't be
wasted on re-inventing the wheel when there are so many fascinating
new problems waiting out there.
-- Eric Steven Raymond
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFDQgT4hDd4aOud5P8RAoWBAJ0foEe4JcqDDlb7mMXQ6Z6FjCFjLACfdmJz
+j2lCH7DpTlZK6zUztldEGI=
=RzhA
-----END PGP SIGNATURE-----
next reply other threads:[~2005-10-04 4:30 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-10-04 4:28 John Richard Moser [this message]
2005-10-04 4:38 ` The price of SELinux (CPU) Dan C Marinescu
2005-10-04 4:59 ` John Richard Moser
2005-10-04 5:06 ` Dan C Marinescu
2005-10-04 6:20 ` John Richard Moser
2005-10-04 6:39 ` Dan C Marinescu
2005-10-04 6:43 ` Dan C Marinescu
2005-10-04 6:51 ` Dan C Marinescu
2005-10-04 13:57 ` serue
2005-10-04 6:57 ` Dan C Marinescu
2005-10-04 7:06 ` Dan C Marinescu
2005-10-04 20:36 ` Bill Davidsen
2005-10-04 22:24 ` Dan C Marinescu
2005-10-04 5:03 ` Dan C Marinescu
2005-10-04 14:34 ` James Morris
2005-10-04 15:39 ` Valdis.Kletnieks
2005-10-04 18:29 ` John Richard Moser
2005-10-04 19:43 ` Valdis.Kletnieks
2005-10-04 20:10 ` John Richard Moser
2005-10-04 22:32 ` Valdis.Kletnieks
2005-10-04 23:00 ` Dan C Marinescu
2005-10-05 2:02 ` John Richard Moser
2005-10-05 19:42 ` Bill Davidsen
2005-10-05 19:40 ` Bill Davidsen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=434204F8.2030209@comcast.net \
--to=nigelenki@comcast.net \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox