Re: [PATCH RFC 0/9] sk_buff: optimize layout for GRO

On Mon, Jul 26, 2021 at 11:13 AM Casey Schaufler [off-list ref] wrote:

On 7/25/2021 3:52 PM, Florian Westphal wrote:

quoted

Casey Schaufler [off-list ref] wrote:

quoted

RedHat and android use SELinux and will want this. Ubuntu doesn't
yet, but netfilter in in the AppArmor task list. Tizen definitely
uses it with Smack. The notion that security modules are only used
in fringe cases is antiquated.

I was not talking about LSM in general, I was referring to the
extended info that Paul mentioned.

If thats indeed going to be used on every distro then skb extensions
are not suitable for this, it would result in extr akmalloc for every
skb.

I am explicitly talking about the use of secmarks. All my
references are uses of secmarks.

I'm talking about a void* which would contain LSM specific data; as I
said earlier, think of inodes.  This LSM specific data would include
the existing secmark data as well as network peer security information
which would finally (!!!) allow us to handle forwarded traffic and
enable a number of other fixes and performance improvements.

(The details are a bit beyond this discussion but it basically
revolves around us not having to investigate the import the packet
headers every time we want to determine the network peer security
attributes, we could store the resolved LSM information in the
sk_buff.security blob.)

-- 
paul moore
www.paul-moore.com