Merge branch 'selinux' ("struct common_audit_data" sanitizer)
Merge common_audit_data cleanup patches from Eric Paris. This is really too late, but it's a long-overdue cleanup of the costly wrapper functions for the security layer. The "struct common_audit_data" is used all over in critical paths, allocated and initialized on the stack. And used to be much too large, causing not only unnecessarily big stack frames but the clearing of the (mostly useless) data was also very visible in profiles. As a particular example, in one microbenchmark for just doing "stat()" over files a lot, selinux_inode_permission() used 7% of the CPU time. That's despite the fact that it doesn't actually *do* anything: it is just a helper wrapper function in the selinux security layer. This patch-series shrinks "struct common_audit_data" sufficiently that code generation for these kinds of wrapper functions is improved noticeably, and we spend much less time just initializing data that we will never use. The functions still get called all the time, and it still shows up at 3.5+% in my microbenchmark, but it's quite a bit lower down the list, and much less noticeable. * Emailed patches from Eric Paris <eparis@redhat.com>: lsm_audit: don't specify the audit pre/post callbacks in 'struct common_audit_data' SELinux: do not allocate stack space for AVC data unless needed SELinux: remove avd from slow_avc_audit() SELinux: remove avd from selinux_audit_data LSM: shrink the common_audit_data data union LSM: shrink sizeof LSM specific portion of common_audit_data
Loading
Please register or sign in to comment