The major performance hit that SELinux can make on the system is
in the kernel, where the hooks used through LSM divert the kernel
flow into the AVC. Usually, the working set of cached permissions
used in normal system operations is relatively small, fewer than
100 AVC entries for most systems with a focused mission. SELinux
maintains up to 512 entries in the cache, and does not usually need
to perform additional lookups outside of that cache.
If you suspect you are having performance problems due to
SELinux or you generally want to fine tune your system, you can
monitor the AVC through the /selinux file
system. The first file, /selinux/avc/hash_stats, shows the number of
entries, the number of hash buckets used by the entries, and the
length of the longest hash chain:
cat /selinux/avc/hash_stats
entries: 521 # total number of AVC entries
buckets used: 285/512 # total number of buckets
longest chain: 6 # hash chain of less than 10 is
# optimal
|
If your hash chains are growing to be larger than 10, there may
be a performance impact. You can consider reducing the size of the
cache. To increase or decrease the size of the cache, you can set a
new value through this tunable:
cat /selinux/avc/cache_threshold
512
echo 768 > /selinux/avc/cache_threshold
# Check to be sure the change took hold. Be sure you are
# root when using the targeted policy.
cat /selinux/avc/cache_threshold
768
|
 |
Caution |
| |
The default value of 512 for the cache threshold in Red Hat
Enterprise Linux is set from extensive optimization benchmarking.
Changing this value could have negative effects on system
performance.
|
To be sure adjusting the cache limit is having positive effects
on your performance, watch the number of reclaimed cache entries.
Stale cache entries can build up following boot or long after
daemon startup, which requires reclaiming entries when more are
required for new processes. If you have a system where there are a
high number of entries changing across a broad enough policy, this
reclamation may occur more often and effect system performance. You
can watch the reclaims column
in the output of avcstat using the
-c option, which displays the cumulative
values:
avcstat -c 1
... reclaims ...
... 800 ...
... 830 ...
... 876 ...
... 912 ...
... 955 ...
... 992 ...
|
Occasional reclaim activity is within the bounds of normal, and
it may increase when changing workloads. Excessive reclaims over a
sustained period of time should be looked into.
