From: Ondrej Mosnacek <omosnace@redhat.com>
To: Lucas Stach <dev@lynxeye.de>
Cc: Paul Moore <paul@paul-moore.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
Eric Paris <eparis@parisplace.org>,
SElinux list <selinux@vger.kernel.org>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>,
Richard Haines <richard_c_haines@btinternet.com>
Subject: Re: [PATCH RFC] selinux: policydb - convert filename trans hash to rhashtable
Date: Wed, 12 Feb 2020 12:40:07 +0100 [thread overview]
Message-ID: <CAFqZXNsfq+JbTtEZtk-2NO8ciGLFy+n3hNP6HX9hTDOdCit5hA@mail.gmail.com> (raw)
In-Reply-To: <20200116213937.77795-1-dev@lynxeye.de>
Hi Lucas,
On Thu, Jan 16, 2020 at 10:48 PM Lucas Stach <dev@lynxeye.de> wrote:
> The current hash is too small for current usages in, e.g. the Fedora standard
> policy. On file creates a considerable amount of CPU time is spent walking the
> the hash chains. Increasing the number of hash buckets somewhat mitigates the
> issue, but doesn't completely get rid of the long hash chains.
>
> This patch does take the bit more invasive route by converting the filename
> trans hash to a rhashtable to allow this hash to scale with load.
>
> fs_mark create benchmark on a SSD device, no ramdisk:
> Count Size Files/sec App Overhead
> before:
> 10000 512 512.3 147715
> after:
> 10000 512 572.3 75141
>
> filenametr_cmp(), which was the topmost function in the CPU cycle trace before
> at ~5% of the overall CPU time, is now down in the noise.
>
> Signed-off-by: Lucas Stach <dev@lynxeye.de>
> ---
> security/selinux/ss/policydb.c | 140 +++++++++++++++++++++++----------
> security/selinux/ss/policydb.h | 14 ++--
> security/selinux/ss/services.c | 31 +-------
> 3 files changed, 109 insertions(+), 76 deletions(-)
>
FYI, I posted a related patch series [1] that should have a similar
effect on the file create performance, plus it also reduces memory
taken up by the file transition rules. It would be great if you could
test it vs. your (fixed) patch to see if it works for you.
Thanks!
[1] https://lore.kernel.org/selinux/20200212112255.105678-1-omosnace@redhat.com/T/
--
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
prev parent reply other threads:[~2020-02-12 11:40 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-16 21:39 [PATCH RFC] selinux: policydb - convert filename trans hash to rhashtable Lucas Stach
2020-01-17 19:11 ` Stephen Smalley
2020-02-04 15:01 ` Ondrej Mosnacek
2020-02-04 15:32 ` Stephen Smalley
2020-02-04 15:49 ` Ondrej Mosnacek
2020-02-12 11:40 ` Ondrej Mosnacek [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFqZXNsfq+JbTtEZtk-2NO8ciGLFy+n3hNP6HX9hTDOdCit5hA@mail.gmail.com \
--to=omosnace@redhat.com \
--cc=dev@lynxeye.de \
--cc=eparis@parisplace.org \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=richard_c_haines@btinternet.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).