SELinux Seeing Performance Improvements With Linux 5.7

A few months back when we last looked at the performance impact of having SELinux enabled there was a hit but not too bad for most workloads. But we'll need to take another look soon as with the Linux 5.7 kernel are some performance improvements and more for SELinux.

The NSA-backed Security Enhanced Linux has seen a fair amount of work build up for the now-open Linux 5.7 kernel merge window. The highlights of the new SELinux work for v5.7 includes:

- Optimizing how filename transitions in the kernel are stored to provide faster policy load times.

- More accurate calculations of internal hash table size needs to also help with policy load times and "likely" general SELinux performance improvements. It will be interesting to see if this carries over indeed to general SELinux performance benefits.

- Support for per-file labeling for the BPF file-system.

- Fixes for NFS v4.2 and XFS file-systems.

That's more than we see for SELinux most kernel cycles. The full list of SELinux updates via this pull request.