netdev - Re: [PATCH RFC 0/9] sk_buff: optimize layout for GRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d0186e8f-41f8-7d4d-5c2c-706bfe3c30cc@schaufler-ca.com>
Date:   Mon, 26 Jul 2021 08:13:28 -0700
From:   Casey Schaufler <casey@...aufler-ca.com>
To:     Florian Westphal <fw@...len.de>
Cc:     Paul Moore <paul@...l-moore.com>, Paolo Abeni <pabeni@...hat.com>,
        netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        linux-security-module@...r.kernel.org, selinux@...r.kernel.org,
        Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH RFC 0/9] sk_buff: optimize layout for GRO

On 7/25/2021 3:52 PM, Florian Westphal wrote:
> Casey Schaufler <casey@...aufler-ca.com> wrote:
>> RedHat and android use SELinux and will want this. Ubuntu doesn't
>> yet, but netfilter in in the AppArmor task list. Tizen definitely
>> uses it with Smack. The notion that security modules are only used
>> in fringe cases is antiquated. 
> I was not talking about LSM in general, I was referring to the
> extended info that Paul mentioned.
>
> If thats indeed going to be used on every distro then skb extensions
> are not suitable for this, it would result in extr akmalloc for every
> skb.

I am explicitly talking about the use of secmarks. All my
references are uses of secmarks.

>>> It certainly makes more sense to me than doing lookups
>>> in a hashtable based on a ID
>> Agreed. The data burden required to support a hash scheme
>> for the security module stacking case is staggering.
> It depends on the type of data (and its lifetime).
>
> I suspect you have something that is more like skb->dev/dst,
> i.e. reference to object that persists after the skb is free'd.

Just so. Only to make it more complicated, SELinux and Smack,
the two LSMs currently using secmarks, use them differently.
SELinux uses u32 "secids" natively, but Smack suffers serious
performance degradation because it has to look up (efficiently,
but look up nonetheless) the real Smack value on every packet.
Please, I know about hash caches, cache hashes and all sorts
of clever tricks to reduce the impact. Nothing beats having the
end value up front.