From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f172.google.com (mail-qk1-f172.google.com [209.85.222.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F0561A83E4 for ; Wed, 8 Jan 2025 03:00:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736305213; cv=none; b=i+ME/Zw0A9Sn9ONsSJxt1atNBq2vkZOFsgslvzxb+WY0S0z7zQO/RUX+9Mq+221ZPCVWRJFfutqZCyYEvuPvfjtDIVJS/q/K9gDWSbwvv5iMNVYB5OfOqKCLNPtQiiyJRsgVXZHjTHwezGxIaV40bb7iaSOYS+8hds6ruWDd8dg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736305213; c=relaxed/simple; bh=dpW07r02+vAWiXyYKKllW9tQ/V7+u4ovL/HDCCgJWQE=; h=Date:Message-ID:MIME-Version:Content-Type:From:To:Cc:Subject: References:In-Reply-To; b=ZnHiyW5Rpuj+zvsfcEcp4jyo1RekKKEeur4D9zUpz2g5vsqTMTTZgfutNtHgyt1s35nTnBlnEAg9yeSzdF2GPik0zrrAyLQ34wskXvZM+sDYOUDasja+0lDNf4MFfHpUa/8yNX4oGFOhaEKRXqv+XRz2ECN3CtSOgcQrb9EAuHI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com; spf=pass smtp.mailfrom=paul-moore.com; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b=fgm0g4g6; arc=none smtp.client-ip=209.85.222.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=paul-moore.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b="fgm0g4g6" Received: by mail-qk1-f172.google.com with SMTP id af79cd13be357-7b6e8fe401eso1344278185a.2 for ; Tue, 07 Jan 2025 19:00:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore.com; s=google; t=1736305210; x=1736910010; darn=vger.kernel.org; h=in-reply-to:references:subject:cc:to:from:content-transfer-encoding :mime-version:message-id:date:from:to:cc:subject:date:message-id :reply-to; bh=zpwGF4ZPc5zkh/c6DMxwRDr8v/VzMYpFaykW6r71bZk=; b=fgm0g4g6k+0FU8jqK1L8bHAW9FGT4neDqBz5K5XzMJKI9R6q1+sKFVzovb8syq2o7r Aq+o+R/VAYdQje1xQhF12D5Kcv/3Q5R5+PRsPpSZYKCttM7PMxfUGiVnytfMs0Krm0qD 3BRpRy1oZKA58V8uVVOQqpoPmUrDdYy/TE1jpOUHNMNGxoH/Lu5Itcs32xtuxhgKLgUI kOTiV3g/Gp2ltWkPCR+FprgxnBE9JJOntRAj4yqoz/aX3T4CVaGJyko0K9JXGJ8LDwhr wREJLc2z1MWxwDi5tAAoYbG7UT9BXnvXXb3n6kvtNJAb7+0zVTevzGLL2A3FDGXyPUCO o6Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1736305210; x=1736910010; h=in-reply-to:references:subject:cc:to:from:content-transfer-encoding :mime-version:message-id:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=zpwGF4ZPc5zkh/c6DMxwRDr8v/VzMYpFaykW6r71bZk=; b=M3zWy/vhSryIDzqkOOSrCFL7K+HFJsNmaneEkW0v4SXoYroOURRCff/dxJuKaKSaUN /YDZqdvqLLLb7WibEpaDMmzo2OwO8IzgxWCKBrFkbcCHOUmcIkI4ROtbhJBZJtsseuAB grWKUpYYrD2zSPtLZRr4KT1S6GOiom5WxKY+merkNVE7vRWs0npDmn1nS1Pb4OuAn2oB qwNk2Iir2HIwb+WMh6jklx0wl2jyZLkMmZa0dcDT4R8j/V25sra7UBaJZ2+f12psaSFj Qczg7moEC0oKOPZAWaRllbVRgy+EHA3HqD0paxmaj8D3KYeTF5V2hyHPQCX/FkuCAGT4 wGsQ== X-Forwarded-Encrypted: i=1; AJvYcCWrPP0Q9yc9XB+Gi3LbQ0tmcPu3GqNjqOCrlTYECFzjgkLSH/Dk4pCm96uqgW5Tn/JFTpOG+9Exy28AMj8=@vger.kernel.org X-Gm-Message-State: AOJu0YxfSB8zvK6igRm7wlX8XuAdluHcPZ+gNj+wxOowHiC3SYIGj/24 PNlRp45Rl/5HgdWElirq6McJVq1+RFbMqtnHCxDhp4coXVe4jEGyVIeFcy8X2w== X-Gm-Gg: ASbGnctQD3DihNJkBbc3AzV+ub7VRteVm3KAxnxBfatPqugk7MJuI0PnFXSZKnngDQh 0S60kvZaoUaTFxrH87r+h5HMI1vzO1fMyORAfXp29YVsSu3Ae7xzawF3Oqu9Md/bw9S+b8VXiLr WhbkUoSWCF+kmGTEm+q/IczWUxdX/GUGko3smXM8p/cX1rvVuU15uwoh3NfA/P6eXb1xDkDuTbd p4I1LwBjRZNL4lDxY14K8ukWzPfcf4X6g7pQhXNwEizclQCtKA= X-Google-Smtp-Source: AGHT+IG9lHm2hSXpL2ALHMVYpNGR+NPhmNlgxnbcIWTjNSbgzaPtBoqVZFBXmmBFrsxuavT1v+9vtg== X-Received: by 2002:a05:620a:240d:b0:7b1:e0f:bf9b with SMTP id af79cd13be357-7bcd97afd59mr145106485a.45.1736305210186; Tue, 07 Jan 2025 19:00:10 -0800 (PST) Received: from localhost ([70.22.175.108]) by smtp.gmail.com with ESMTPSA id af79cd13be357-7b9ac2f8fe6sm1637237185a.51.2025.01.07.19.00.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jan 2025 19:00:09 -0800 (PST) Date: Tue, 07 Jan 2025 22:00:09 -0500 Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Mailer: pstg-pwork:20250107_1610/pstg-lib:20250107_1603/pstg-pwork:20250107_1610 From: Paul Moore To: =?UTF-8?q?Christian=20G=C3=B6ttsche?= , selinux@vger.kernel.org Cc: =?UTF-8?q?Christian=20G=C3=B6ttsche?= , Stephen Smalley , Ondrej Mosnacek , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , =?UTF-8?q?Thi=C3=A9baud=20Weksteen?= , =?UTF-8?q?Bram=20Bonn=C3=A9?= , Masahiro Yamada , linux-kernel@vger.kernel.org, llvm@lists.linux.dev Subject: Re: [PATCH RFC v2 19/22] selinux: validate symbols References: <20241216164055.96267-19-cgoettsche@seltendoof.de> In-Reply-To: <20241216164055.96267-19-cgoettsche@seltendoof.de> On Dec 16, 2024 =?UTF-8?q?Christian=20G=C3=B6ttsche?= wrote: > > Some symbol tables need to be validated after indexing, since during > indexing their referenced entries might not yet have been indexed. > > Signed-off-by: Christian Göttsche > --- > security/selinux/ss/policydb.c | 94 ++++++++++++++++++++++++++++++++++ > 1 file changed, 94 insertions(+) Out of curiosity, have you measured the policy load times before and after this patchset? I'd like to understand the performance impact of the additional checks and validations. -- paul-moore.com