Re: [RFC PATCH 2/2] SELinux: cache inode checks inside struct inode

[Linus Torvalds <torvalds@linux-foundation.org>]

On Mon, 3 Jun 2013, Eric Paris wrote:
>  
>  #ifdef CONFIG_SECURITY
> +	seqcount_t		i_security_seqcount;
> +	u32			i_last_task_sid;
> +	u32			i_last_granting;
> +	u32			i_last_perms;
> +	u32			i_audit_allow;
>  	void			*i_security;
>  #endif

This is much too big. I was really hoping for "another word that the 
security layer can use" or similar. 

Something this big would be acceptable if it would be a *generic* security 
cache, and others could use it too, and would avoid ever actually calling 
into any security layer at all (ie we could do the checks entirely at the 
VFS layer). Then it would be fine. But for just the fact that SELinux is 
too slow? No.

              Linus