Check out the new USENIX Web site. next up previous
Next: Discussion Up: Performance Overhead Previous: Macrobenchmark: Kernel Compilation


Macrobenchmarks: Webstone

Using Webstone [33] we benchmarked the overhead imposed on a typical server application -- a webserver. We collected data showing the overhead of both a basic LSM kernel and an LSM kernel with the SELinux module loaded. The SELinux module uses the Netfilter based hooks, so all three kernels have Netfilter support compiled in, and are based on the 2.5.7 Linux kernel.

The standard kernel was compiled with Netfilter support. The LSM kernel was compiled with support for the Netfilter based hooks and used the default superuser logic. The SELinux kernel was compiled with support for SELinux and the Netfilter based hooks. The SELinux module was also stacked with the capabilities module, a typical SELinux configuration. We ran these tests on a dual 550MHz Celeron with 384MB RAM. The NIC was a Gigabit Netgear GA302T on a 32-bit 33MHz PCI bus. The webserver was Apache 1.3.22-0.6 (Red Hat 6.2 update).

Netfilter is a critical issue here. The 5-7% overhead observed in the LSM benchmarks in Tables 5 and 6 is greater than we would like. A separate experiment configured with LSM and Netfilter but without the Netfilter LSM hooks showed the more desirable 1-2% performance overhead. This is consistent with the worst case 5% overhead in TCP select observed in Section 5.2.1, and identifies the Netfilter LSM hooks as critical for optimization.


Table: UP Webstone results comparing LSM to standard kernel.
Connection rate measured in connections per second.
  Server Server  
Number connection connection  
of rate rate %
clients 2.5.7 2.5.7-lsm Overhead
8 916.56 870.98 4.97%
16 917.64 869.79 5.21%
24 917.44 872.28 4.92%
32 918.91 876.17 4.65%



Table: SMP Webstone results comparing LSM to standard kernel.
Connection rate measured in connections per second.
  Server Server  
Number connection connection  
of rate rate %
clients 2.5.7 2.5.7-lsm Overhead
8 1206.05 1115.29 7.53%
16 1206.74 1117.61 7.39%
24 1214.54 1130.13 6.95%
32 1207.30 1125.89 6.74%



Table: UP Webstone results comparing SELinux to standard kernel.
Connection rate measured in connections per second.
  Server Server  
Number connection connection  
of rate rate %
clients 2.5.7 2.5.7-SEL Overhead
8 916.56 766.58 16.4%
16 917.64 766.48 15.5%
24 917.44 765.56 16.6%
32 918.91 764.80 16.8%



Table: SMP Webstone results comparing SELinux to standard kernel.
Connection rate measured in connections per second.
  Server Server  
Number connection connection  
of rate rate %
clients 2.5.7 2.5.7-SEL Overhead
8 1206.05 949.56 21.3%
16 1206.74 949.74 21.3%
24 1214.54 952.28 21.6%
32 1207.30 956.76 20.1%


The UP benchmark data in Table 7 shows that SELinux imposes about 16% overhead on connection rate, and we found similar overhead in throughput. The SMP benchmark data in Table 8 shows about 21% overhead on connection rate, and we found similar overhead in throughput. The greater overhead for the SMP test is likely due to locking issues. Note that these overhead rates are specific to the SELinux module (a particularly popular module) and that performance costs for other modules will vary.


next up previous
Next: Discussion Up: Performance Overhead Previous: Macrobenchmark: Kernel Compilation
Chris Wright 2002-05-13