SXE - Impact and Implications

Performance Effects

• The proposal for a MAC kernel implementation involves the use of Linux Intrusion Detection System (LIDS).
• The Security Enhanced Linux (SELinux) MAC kernel is currently integrated with 2.6 official Linus kernel sources. It has broad support despite indications of performance decrements of 7% over the normal kernel. SELinux uses file-system extended attributes, such as JFFS and YAFFS, that are not available for embedded file-systems at the time of writing. LIDS is much simpler than SELinux and is expected to perform well.
• Program Identification overheads are only a consideration when asynchronous IPC is being carried out; at which point some overhead is expected and accepted. The marginal or incremental overhead introduced by Program Identification is minimal.

  In many cases Simple authentication can be used, and optimizations are possible such that if key-based identification is required for complex scenarios the incremental addition to IPC end-to-end time is minimal and not noticeable.

• The server process table is in memory and will usually contain less than 10 entries. The installation table exists on storage but is read entirely into memory at run-time. It contains an entry for each currently installed package and one for each Qt Extended system binary: entries will be in an order of magnitude of 10^1.
• For trusted transports, eg QCop messaging on Unix Domain Sockets where the endpoints are protected by MAC rules, simple message authentication only occurs at the time of initial socket connect.
• The current implementation for message authentication is HMAC-MD5 with an option to switch to HMAC-SHA1 for greater security at performance cost. These algorithms are built into the Linux kernel and accessible to Qt Extended via a userspace framework; or are shipped with a vendor supplied accelerated cryptographic solution. As a generalization HMAC-MD5 for short messages like QCop is very fast.

  This is only required if an untrusted transport is used, for example if a UDP socket or similar system.

• The application rule-set contains a row for request allowed by the untrusted domain, entries will be in the magnitude of 10^2.

  To mitigate performance impact from the application rule-set, rule set lookups are cached and the caching policy may be adjusted for better performance if memory resources are available.