tech-security archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: nfs optimization and veriexec



[ replying to a little old mail. ]

> YAMAMOTO Takashi wrote:
> 
> > for long term, i want to remove "lookup before create" from vfs.
> > so i hope to see the assumption is removed from veriexec, rather than
> > making the rest of kernel veriexec-aware.
> 
> So it's not just an *NFS* optimization, is it? :)

sure.

> Basically, Veriexec has a feature where it can prevent creation of new
> files. I'd like to maintain that feature... or at least learn more about
> what benefits this optimization has if the direction is that the two
> can't co-exist.

depending on latencies, saving some RPCs can make big performance differences.

YAMAMOTO Takashi

> Would it be possible to have Veriexec treat a "create unless exists" as
> "create"? or would that break programs that open, say, log files with
> O_RDWR|O_CREAT?
> 
> -e.


Home | Main Index | Thread Index | Old Index