Re: New skb extension for use by LSMs (skb "security blob")?

From
David Miller <davem@davemloft.net>
Date
2019-08-22 22:36:45
Also in
linux-security-module, selinux
Reply to
Casey Schaufler, 2019-08-22
From: Casey Schaufler <casey@schaufler-ca.com>
Date: Thu, 22 Aug 2019 15:34:44 -0700
On 8/22/2019 3:28 PM, David Miller wrote:
quoted
From: Casey Schaufler <casey@schaufler-ca.com>
Date: Thu, 22 Aug 2019 14:59:37 -0700
quoted
Sure, you *can* do that, but it would be insane to do so.
We look up the neighbour table entries on every single packet we
transmit from the kernel in the same exact way.

And it was exactly to get rid of a pointer in a data structure.
I very much expect that the lifecycle management issues would
be completely different, but I'll admit to having little understanding
of the details of the neighbour table.
Neighbour table entries can live anywhere from essentially forever down
to several microseconds.

If your hash is good, and you use RCU locking on the read side, it's a
single pointer dereference in cost.
Thread (17 messages) 17 messages, 4 authors, last reply 2019-08-23
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help