Hi Xing, On Wed, 2020-06-10 at 11:21 +0800, Xing Zhengjun wrote: > Hi Mimi, > > Do you have time to take a look at this? we noticed a 3.7% > regression of boot-time.dhcp and a 84.2% regression of > stress-ng.icache.ops_per_sec. Thanks. > > On 6/3/2020 5:11 PM, kernel test robot wrote: > > Greeting, > > > > FYI, we noticed a 3.7% regression of boot-time.dhcp due to commit: > > > > > > commit: 8eb613c0b8f19627ba1846dcf78bb2c85edbe8dd ("ima: verify mprotect > > change is consistent with mmap policy") > > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master > > > > in testcase: stress-ng > > on test machine: 96 threads Intel(R) Xeon(R) Gold 6252 CPU @ 2.10GHz with > > 192G memory > > with following parameters: > > > > nr_threads: 100% > > disk: 1HDD > > testtime: 30s > > class: cpu-cache > > cpufreq_governor: performance > > ucode: 0x500002c
Does the following change resolve it? diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index c44414a7f82e..78e1dfc8a3f2 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -426,7 +426,8 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot) int pcr; /* Is mprotect making an mmap'ed file executable? */ - if (!vma->vm_file || !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC)) + if (!(ima_policy_flag & IMA_APPRAISE) || !vma->vm_file || + !(prot & PROT_EXEC) || (vma->vm_flags & VM_EXEC)) return 0; security_task_getsecid(current, &secid);