3

I want to start using SELinux, and was wondering what kind of performance hit I should expect to see on a webserver with high Apache traffic?

<1%, 5%, 10% ? What range are we talking about?

Improve this question

2 Answers 2

Reset to default
4

SELinux Unofficial FAQ says 7%. In my experience I cannot tell the difference whether it's on or it's off (it used to be easy because with it on nothing worked!) but I'd not be surprised if it's much less than 7% that as there are lots of mentions of performance improvements on the release notes In RHEL5 the annoying things have gone away and the feedback from setroubleshoot and the audit logs is really good.

I'd suggest you come up with some kind of benchmark maybe using JMEter/Selenium to replay tests against your webserver in a lab where you can test against an SE enabled and a disabled machine.A Usenix Paper discussing a benchmark on SELinux is interesting and might provide a good start. It might be that one a webserver, once all the caches are warmed up then the overhead is very small.

Let us know what your results are.

Improve this answer
1
  • 1
    Thank you very much. ~7% can I live with. As the hacker of the Xbox 1 said: "There isn't any compromise between speed and security. Either the system secure or not." =)
    – Sandra
    Sep 4, 2010 at 15:46
2

I agree with davey's answer of approximately 7%. I would post this as a comment but I don't have enough karma.

However, do keep in mind that the three modes of SELinux: disabled, permissive, and enforcing. There is no speed difference between permissive and enforcing.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .