linux-kernel - [PATCH v4 0/3] selinux: speed up avc_search

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <cover.1761217900.git.zhanghongru@xiaomi.com>
Date: Thu, 23 Oct 2025 19:27:55 +0800
From: Hongru Zhang <zhanghongru06@...il.com>
To: paul@...l-moore.com,
	stephen.smalley.work@...il.com,
	omosnace@...hat.com
Cc: linux-kernel@...r.kernel.org,
	selinux@...r.kernel.org,
	zhanghongru@...omi.com
Subject: [PATCH v4 0/3] selinux: speed up avc_search_node() with large number of avc nodes

On mobile device high-load situations, permission check can happen
more than 90,000/s (8 core system). With default 512 cache nodes
configuration, avc cache miss happens more often and occasionally
leads to long time (>2ms) irqs off on both big and little cores,
which decreases system real-time capability.

Although we can expand avc nodes through /sys/fs/selinux/cache_threshold
to mitigate long time irqs off, hash conflicts make the bucket average
length longer because of the fixed size of cache slots, leading to
avc_search_node() latency increase.

This patch series aims to expand AVC nodes without significantly increasing
avc_search_node() latency.

This is v4 of the patch series.
Changes since v3:
- use MurmurHash3 to improve avc_hash()
- add a config to adjust avc cache slot size instead of kernel parameter
Changes since v2:
- update changelog and fix warnings for commit ("000bce8f11d0
  selinux: improve bucket distribution uniformity of avc_hash()")
Changes since v1:
- improve hash algorithm in avc_hash()
- define avc_cache_slots as a static variable

v1 discussion:
https://lore.kernel.org/selinux/20250905100454.685866-1-zhanghongru@xiaomi.com/
v2 discussion:
https://lore.kernel.org/selinux/cover.1758633723.git.zhanghongru@xiaomi.com/
v3 discussion:
https://lore.kernel.org/selinux/cover.1758859391.git.zhanghongru@xiaomi.com/

Hongru Zhang (3):
  selinux: Introduce a new config to make avc cache slot size adjustable
  selinux: Move avtab_hash() to a shared location for future reuse
  selinux: improve bucket distribution uniformity of avc_hash()

 security/selinux/Kconfig        | 11 ++++++++
 security/selinux/avc.c          |  9 ++++---
 security/selinux/include/hash.h | 47 +++++++++++++++++++++++++++++++++
 security/selinux/ss/avtab.c     | 39 +++------------------------
 4 files changed, 66 insertions(+), 40 deletions(-)
 create mode 100644 security/selinux/include/hash.h


base-commit: c6f0a830ef4bffc8eedd7ddb307bfba4929cd3e1
-- 
2.43.0