RE: Now that SELinux supports booleans should we replace tunables with booleans?

> > I think that the issue with performance is kernel memory use. Currently
> for
> > FC2T2 we have 7M policydb files which roughly equates to 7M of kernel
> memory
> > reserved, which has a huge impact on older hardware! Most of this is
> due to
> > compiling in support for every .te file.
>
> I think it's worse than this. It looks like we're using about 40 bytes of
> kernel memory for each rule, and with almost 300,000 rules, it's more like
> 12MB (for i386).
>
> Making better use of kernel memory is on my todo list.
>

I dug up two simple patches that I did a while back for the conditional policy work that makes the avtab size configurable. It won't help much, but it allows for a smaller conditional avtab on the assumption that there will be fewer conditional rules. I also had a patch to make the hashing perform slightly better which helped when using a smaller number of buckets, but I can't find that. These patches are against on older checkpolicy and linux 2.6.1, but they are trivial enough to port if you think they are useful.

Karl

Karl MacMillan
Tresys Technology
http://www.tresys.com
(410)290-1411 ext 134

>
> - James
> --
> James Morris
> <jmorris@redhat.com>
>
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
> with
> the words "unsubscribe selinux" without quotes as the message.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/octet-stream attachment: conditional-avtab-selinux-usr-1-15-2004.patch



application/octet-stream attachment: conditional-avtab-linux-2.6-1-15-2004.patch