• Ondrej Mosnacek's avatar
    selinux: cache the SID -> context string translation · d97bd23c
    Ondrej Mosnacek authored
    Translating a context struct to string can be quite slow, especially if
    the context has a lot of category bits set. This can cause quite
    noticeable performance impact in situations where the translation needs
    to be done repeatedly. A common example is a UNIX datagram socket with
    the SO_PASSSEC option enabled, which is used e.g. by systemd-journald
    when receiving log messages via datagram socket. This scenario can be
    reproduced with:
    
        cat /dev/urandom | base64 | logger &
        timeout 30s perf record -p $(pidof systemd-journald) -a -g
        kill %1
        perf report -g none --pretty raw | grep security_secid_to_secctx
    
    Before the caching introduced by this patch, computing the context
    string (security_secid_to_secctx() function) takes up ~65% of
    systemd-journald's CPU time (assuming a context with 1024 categories
    set and Fedora x86_64 release kernel configs). After this patch
    (assuming near-perfect cache hit ratio) this overhead is reduced to just
    ~2%.
    
    This patch addresses the issue by caching a certain number (compile-time
    configurable) of recently used context strings to speed up repeated
    translations of the same context, while using only a small amount of
    memory.
    
    The cache is integrated into the existing sidtab table by adding a field
    to each entry, which when not NULL contains an RCU-protected pointer to
    a cache entry containing the cached string. The cache entries are kept
    in a linked list sorted according to how recently they were used. On a
    cache miss when the cache is full, the least recently used entry is
    removed to make space for the new entry.
    
    The patch migrates security_sid_to_context_core() to use the cache (also
    a few other functions where it was possible without too much fuss, but
    these mostly use the translation for logging in case of error, which is
    rare).
    
    Link: https://bugzilla.redhat.com/show_bug.cgi?id=1733259
    Cc: Michal Sekletar <msekleta@redhat.com>
    Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
    Reviewed-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    Tested-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    Reviewed-by: default avatarPaul E. McKenney <paulmck@kernel.org>
    [PM: lots of merge fixups due to collisions with other sidtab patches]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    d97bd23c
sidtab.h 4.11 KB