Re: [PATCH v2 2/2] selinux: optimize selinux_inode_getattr/permission() based on neveraudit|permissive

[Paul Moore <paul@paul-moore.com>]

On May 21, 2025 Stephen Smalley <stephen.smalley.work@gmail.com> wrote:
> 
> Extend the task avdcache to also cache whether the task SID is both
> permissive and neveraudit, and return immediately if so in both
> selinux_inode_getattr() and selinux_inode_permission().
> 
> The same approach could be applied to many of the hook functions
> although the avdcache would need to be updated for more than directory
> search checks in order for this optimization to be beneficial for checks
> on objects other than directories.
> 
> To test, apply https://github.com/SELinuxProject/selinux/pull/473 to
> your selinux userspace, build and install libsepol, and use the following
> CIL policy module:
> $ cat neverauditpermissive.cil
> (typeneveraudit unconfined_t)
> (typepermissive unconfined_t)
> 
> Without this module inserted, running the following commands:
>    perf record make -jN # on an already built allmodconfig tree
>    perf report --sort=symbol,dso
> yields the following percentages (only showing __d_lookup_rcu for
> reference and only showing relevant SELinux functions):
>    1.65%  [k] __d_lookup_rcu
>    0.53%  [k] selinux_inode_permission
>    0.40%  [k] selinux_inode_getattr
>    0.15%  [k] avc_lookup
>    0.05%  [k] avc_has_perm
>    0.05%  [k] avc_has_perm_noaudit
>    0.02%  [k] avc_policy_seqno
>    0.02%  [k] selinux_file_permission
>    0.01%  [k] selinux_inode_alloc_security
>    0.01%  [k] selinux_file_alloc_security
> for a total of 1.24% for SELinux compared to 1.65% for
> __d_lookup_rcu().
> 
> After running the following command to insert this module:
>    semodule -i neverauditpermissive.cil
> and then re-running the same perf commands from above yields
> the following non-zero percentages:
>    1.74%  [k] __d_lookup_rcu
>    0.31%  [k] selinux_inode_permission
>    0.03%  [k] selinux_inode_getattr
>    0.03%  [k] avc_policy_seqno
>    0.01%  [k] avc_lookup
>    0.01%  [k] selinux_file_permission
>    0.01%  [k] selinux_file_open
> for a total of 0.40% for SELinux compared to 1.74% for
> __d_lookup_rcu().
> 
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> v2 introduces a task_avdcache_permnoaudit() static inline function.
> 
>  security/selinux/hooks.c          | 14 +++++++++++++-
>  security/selinux/include/objsec.h |  8 ++++++++
>  2 files changed, 21 insertions(+), 1 deletion(-)

Merged into selinux/dev, thanks.

--
paul-moore.com