Re: Looking at profile data once again - avc lookup

From: Linus Torvalds <torvalds@linux-foundation.org>
To: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>,
	SElinux list <selinux@vger.kernel.org>
Subject: Re: Looking at profile data once again - avc lookup
Date: Sun, 29 Jan 2023 11:36:46 -0800	[thread overview]
Message-ID: <CAHk-=whLndwMFSF_OAWdqxXYXUev_H9YqEkXQ1_PKoPO8u=G2g@mail.gmail.com> (raw)
In-Reply-To: <CAHC9VhR1jRM2K0757sNYS8VvSUxRWOKUJ1unbsZm9LOEM3Up6Q@mail.gmail.com>

On Sat, Jan 28, 2023 at 2:33 PM Paul Moore <paul@paul-moore.com> wrote:
>
> I'll take a look, although just a heads-up that I don't generally
> merge patches into selinux/next at this point in the -rc cycle unless
> they are bug fixes, or some other critical patch; it's likely this
> will need to wait until after the upcoming merge window closes.

Yeah, that patch was not some kind of "please apply this urgent fix",
more of a "I'm looking at path walking again, and the selinux code is
more expensive than the *actual* path walk is" heads up.

> > Comments? Is there some case I've missed?
>
> You're correct in that selinux_state parameters currently always point
> back to the single global instance, however there was, and still is, a
> point to that patch ... although I will admit it is a long time
> coming.

Honestly, considering that the selinux code is literally more
expensive than THE REAL WORKLOAD it is checking, I really want people
to take a second look.

If some new feature makes that crazy-expensive thing *worse*, we have issues.

If it's been that way for five years with no progress, and no clear
indication that it's even some high-priority issue that lots of people
are asking for, maybe that should be a big hint.

                 Linus