Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to start using SELinux, and was wondering what kind of performance hit I should expect to see on a webserver with high Apache traffic?

<1%, 5%, 10% ? What range are we talking about?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

SELinux Unofficial FAQ says 7%. In my experience I cannot tell the difference whether it's on or it's off (it used to be easy because with it on nothing worked!) but I'd not be surprised if it's much less than 7% that as there are lots of mentions of performance improvements on the release notes In RHEL5 the annoying things have gone away and the feedback from setroubleshoot and the audit logs is really good.

I'd suggest you come up with some kind of benchmark maybe using JMEter/Selenium to replay tests against your webserver in a lab where you can test against an SE enabled and a disabled machine.A Usenix Paper discussing a benchmark on SELinux is interesting and might provide a good start. It might be that one a webserver, once all the caches are warmed up then the overhead is very small.

Let us know what your results are.

share|improve this answer
    
Thank you very much. ~7% can I live with. As the hacker of the Xbox 1 said: "There isn't any compromise between speed and security. Either the system secure or not." =) –  Sandra Sep 4 '10 at 15:46

I agree with davey's answer of approximately 7%. I would post this as a comment but I don't have enough karma.

However, do keep in mind that the three modes of SELinux: disabled, permissive, and enforcing. There is no speed difference between permissive and enforcing.

share|improve this answer
    
Thanks for pointing that out. Very useful to know =) –  Sandra Sep 8 '10 at 11:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.