From: Stephen Smalley <sds@tycho.nsa.gov>
To: James Carter <jwcart2@tycho.nsa.gov>, selinux@tycho.nsa.gov
Subject: Re: [PATCH 04/10 v2] libsepol: Refactored bounds (hierarchy) checking code
Date: Thu, 18 Jun 2015 16:29:22 -0400 [thread overview]
Message-ID: <55832A22.1040103@tycho.nsa.gov> (raw)
In-Reply-To: <55832977.9010804@tycho.nsa.gov>
On 06/18/2015 04:26 PM, James Carter wrote:
> On 06/18/2015 09:56 AM, Stephen Smalley wrote:
>> On 06/17/2015 03:58 PM, James Carter wrote:
>>> The largest change to the user and role bounds checking was to put
>>> them in their own functions, so they could be called independently.
>>>
>>> The type bounds checking was changed to check one type bounds at
>>> a time. An expanded avtab is still created, but now only the rules
>>> of the parent type are expanded. If violations are discovered,
>>> a list of avtab_ptr_t's provides details. This list is used to
>>> display error messages for backwards compatibility and will be
>>> used by CIL to provide a more detailed error message.
>>>
>>> Memory usage is reduced from 9,355M to 126M and time is reduced
>>> from 9 sec to 2 sec.
>>>
>>> Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
>>
>> Can we optimize the case where there are no bounded users/roles/types at
>> all in the policy, and quickly return in that situation? Seems like we
>> could just quickly walk them and check to see if any are bounded before
>> we start doing anything else. Surprised we don't already do that.
>>
>
> I am not sure how to do it faster.
>
> I am walking the types table [The statement:
> hashtab_map(p->p_types.table, bounds_check_type_callback, &args);] and
> only calling bounds_check_type() if the type has a bounds.
>
> Is there a faster way?
So is there any avtab allocation if there are no bounded types?
That's what I wanted to ensure we avoid or at least minimize.
I was surprised that you indicated that we have significant memory and
time usage from the old hierarchy checker since there are no bounded
types in the default policy; I had assumed that it would optimize for
that case, just as we quickly bail out of the assertion checker if there
are no neverallows before even doing an avtab_init.
next prev parent reply other threads:[~2015-06-18 20:29 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-06-17 19:58 [PATCH 00/10 v2] Improve libsepol and CIL neverallow and bounds checking James Carter
2015-06-17 19:58 ` [PATCH 01/10 v2] libsepol: Add new ebitmap function named ebitmap_match_any() James Carter
2015-06-18 13:23 ` Stephen Smalley
2015-06-17 19:58 ` [PATCH 02/10 v2] libsepol: Treat types like an attribute in the attr_type_map James Carter
2015-06-18 13:41 ` Stephen Smalley
2015-06-18 13:52 ` Stephen Smalley
2015-06-18 20:16 ` James Carter
2015-06-18 20:21 ` Stephen Smalley
2015-06-18 20:23 ` Stephen Smalley
2015-06-17 19:58 ` [PATCH 03/10 v2] libsepol: Refactored neverallow checking James Carter
2015-06-17 19:58 ` [PATCH 04/10 v2] libsepol: Refactored bounds (hierarchy) checking code James Carter
2015-06-18 13:56 ` Stephen Smalley
2015-06-18 20:26 ` James Carter
2015-06-18 20:29 ` Stephen Smalley [this message]
2015-06-18 20:35 ` James Carter
2015-06-17 19:58 ` [PATCH 05/10 v2] libsepol/cil: Add function to search the CIL AST for an AV rule James Carter
2015-06-17 19:58 ` [PATCH 06/10 v2] libsepol/cil: Refactored CIL neverallow checking and reporting James Carter
2015-06-17 19:58 ` [PATCH 07/10 v2] libsepol/cil: Track number of classes and number of types and attributes James Carter
2015-06-17 19:58 ` [PATCH 08/10 v2] libsepol/cil: Add CIL bounds checking and reporting James Carter
2015-06-17 19:58 ` [PATCH 09/10 v2] secilc: Add a CIL policy file to test neverallow checking James Carter
2015-06-17 19:58 ` [PATCH 10/10 v2] secilc: Add a CIL policy file to test bounds checking James Carter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55832A22.1040103@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=jwcart2@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.