Macrobenchmarks: Webstone

Using Webstone [33] we benchmarked the overhead imposed on a typical server application -- a webserver. We collected data showing the overhead of both a basic LSM kernel and an LSM kernel with the SELinux module loaded. The SELinux module uses the Netfilter based hooks, so all three kernels have Netfilter support compiled in, and are based on the 2.5.7 Linux kernel.

The standard kernel was compiled with Netfilter support. The LSM kernel was compiled with support for the Netfilter based hooks and used the default superuser logic. The SELinux kernel was compiled with support for SELinux and the Netfilter based hooks. The SELinux module was also stacked with the capabilities module, a typical SELinux configuration. We ran these tests on a dual 550MHz Celeron with 384MB RAM. The NIC was a Gigabit Netgear GA302T on a 32-bit 33MHz PCI bus. The webserver was Apache 1.3.22-0.6 (Red Hat 6.2 update).

Netfilter is a critical issue here. The 5-7% overhead observed in the LSM benchmarks in Tables 5 and 6 is greater than we would like. A separate experiment configured with LSM and Netfilter but without the Netfilter LSM hooks showed the more desirable 1-2% performance overhead. This is consistent with the worst case 5% overhead in TCP select observed in Section 5.2.1, and identifies the Netfilter LSM hooks as critical for optimization.

Table: UP Webstone results comparing LSM to standard kernel.

Connection rate measured in connections per second.
	Server	Server
Number	connection	connection
of	rate	rate	%
clients	2.5.7	2.5.7-lsm	Overhead
8	916.56	870.98	4.97%
16	917.64	869.79	5.21%
24	917.44	872.28	4.92%
32	918.91	876.17	4.65%

Table: SMP Webstone results comparing LSM to standard kernel.

Connection rate measured in connections per second.
	Server	Server
Number	connection	connection
of	rate	rate	%
clients	2.5.7	2.5.7-lsm	Overhead
8	1206.05	1115.29	7.53%
16	1206.74	1117.61	7.39%
24	1214.54	1130.13	6.95%
32	1207.30	1125.89	6.74%

Table: UP Webstone results comparing SELinux to standard kernel.

Connection rate measured in connections per second.
	Server	Server
Number	connection	connection
of	rate	rate	%
clients	2.5.7	2.5.7-SEL	Overhead
8	916.56	766.58	16.4%
16	917.64	766.48	15.5%
24	917.44	765.56	16.6%
32	918.91	764.80	16.8%

Table: SMP Webstone results comparing SELinux to standard kernel.

Connection rate measured in connections per second.
	Server	Server
Number	connection	connection
of	rate	rate	%
clients	2.5.7	2.5.7-SEL	Overhead
8	1206.05	949.56	21.3%
16	1206.74	949.74	21.3%
24	1214.54	952.28	21.6%
32	1207.30	956.76	20.1%

The UP benchmark data in Table 7 shows that SELinux imposes about 16% overhead on connection rate, and we found similar overhead in throughput. The SMP benchmark data in Table 8 shows about 21% overhead on connection rate, and we found similar overhead in throughput. The greater overhead for the SMP test is likely due to locking issues. Note that these overhead rates are specific to the SELinux module (a particularly popular module) and that performance costs for other modules will vary.