[PATCH RFC 0/9] sk_buff: optimize layout for GRO

Florian Westphal fw at strlen.de
Sun Jul 25 22:52:00 UTC 2021

Casey Schaufler <casey at schaufler-ca.com> wrote:
> RedHat and android use SELinux and will want this. Ubuntu doesn't
> yet, but netfilter in in the AppArmor task list. Tizen definitely
> uses it with Smack. The notion that security modules are only used
> in fringe cases is antiquated. 

I was not talking about LSM in general, I was referring to the
extended info that Paul mentioned.

If thats indeed going to be used on every distro then skb extensions
are not suitable for this, it would result in extr akmalloc for every

> > It certainly makes more sense to me than doing lookups
> > in a hashtable based on a ID
> Agreed. The data burden required to support a hash scheme
> for the security module stacking case is staggering.

It depends on the type of data (and its lifetime).

I suspect you have something that is more like skb->dev/dst,
i.e. reference to object that persists after the skb is free'd.

More information about the Linux-security-module-archive mailing list