diff options
| author | Ondrej Mosnacek <omosnace@redhat.com> | 2020-04-07 21:28:58 +0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2020-04-17 22:20:22 +0300 |
| commit | e67b2ec9f6171895e774f6543626913960e019df (patch) | |
| tree | e1520bce539fd62639ab310c6c9385522b48c73f /security/selinux/ss/services.c | |
| parent | 433e3aa37773e8a36858b9417c3e345eff79a079 (diff) | |
| download | linux-e67b2ec9f6171895e774f6543626913960e019df.tar.xz | |
selinux: store role transitions in a hash table
Currently, they are stored in a linked list, which adds significant
overhead to security_transition_sid(). On Fedora, with 428 role
transitions in policy, converting this list to a hash table cuts down
its run time by about 50%. This was measured by running 'stress-ng --msg
1 --msg-ops 100000' under perf with and without this patch.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/ss/services.c')
| -rw-r--r-- | security/selinux/ss/services.c | 21 |
1 files changed, 10 insertions, 11 deletions
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 3b592d17d2d3..07cdda2ff49c 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1731,7 +1731,6 @@ static int security_compute_sid(struct selinux_state *state, struct class_datum *cladatum = NULL; struct context *scontext, *tcontext, newcontext; struct sidtab_entry *sentry, *tentry; - struct role_trans *roletr = NULL; struct avtab_key avkey; struct avtab_datum *avdatum; struct avtab_node *node; @@ -1864,16 +1863,16 @@ static int security_compute_sid(struct selinux_state *state, /* Check for class-specific changes. */ if (specified & AVTAB_TRANSITION) { /* Look for a role transition rule. */ - for (roletr = policydb->role_tr; roletr; - roletr = roletr->next) { - if ((roletr->role == scontext->role) && - (roletr->type == tcontext->type) && - (roletr->tclass == tclass)) { - /* Use the role transition rule. */ - newcontext.role = roletr->new_role; - break; - } - } + struct role_trans_datum *rtd; + struct role_trans_key rtk = { + .role = scontext->role, + .type = tcontext->type, + .tclass = tclass, + }; + + rtd = hashtab_search(policydb->role_tr, &rtk); + if (rtd) + newcontext.role = rtd->new_role; } /* Set the MLS attributes. |