Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1177994
| Summary: | selinux-policy build never checks assertions | |||
|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | John Brooks <john> | |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> | |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 23 | CC: | dominick.grift, dwalsh, john, lvrabec, mgrepl, plautrba | |
| Target Milestone: | --- | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | selinux-policy-3.13.1-143.fc23 | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1319652 (view as bug list) | Environment: | ||
| Last Closed: | 2015-12-09 16:19:53 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1319652 | |||
I gave up after about an hour of waiting for check_assertion to run on fedora policy, and started looking at performance. Most of the time is in libsepol's avtab hash table lookups. With some changes to the hash table and -O2, it now takes about 5 minutes. I suspect we can do much better. There is still a peak of about 1.2GB RES. I'll clean up that patch and submit it soon. If you fix the performance problem, we can turn this back on. https://github.com/fedora-selinux/selinux/pull/3 Let me know if there is a better way to submit changes. Petr, there is updated patch in upstream from John. This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle. Changing version to '23'. (As we did not run this process for some time, it could affect also pre-Fedora 23 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23 The updated libsepol-2.4 with John's patches is already in Fedora 23 so I guess you can remove '-a' option. We should have all fixes in Fedora userspace and also in Fedora policy in F23/Rawhide. We also removed this option from selinux-policy.spec in rawhide and we are testing in for F23. So you can test it with the latest F23 policy and libsepol builds to see how it works. Thank you. I believe this is already incorporated in Fedora 23. |
Description of problem: Back around 2008, semanage.conf was changed to not check policy assertions during load, by setting expand-check=0. The reasoning[1] was that it could be done instead during policy build with a 'make validate' step, because the process takes a long time. In this commit[2] in 2012, that step in the build was silently changed to add: make validate [...] SEMOD_EXP="/usr/bin/semodule_expand -a" The problem is that the '-a' option means "don't check assertions"[3]. As far as I can tell, they haven't been checked at build or load time since f18. It takes an incredibly long time to run (I'm at 40min and still going). Running it over a reduced policy in a different environment reveals there are bugs hidden here: libsepol.check_assertion_helper: neverallow violated by allow restorecond_t semanage_store_t:file { relabelto }; (and more, but it's only showing one error at a time) [1] http://www.spinics.net/lists/selinux/msg03931.html [2] https://lists.fedoraproject.org/pipermail/scm-commits/2012-September/866834.html [3] https://github.com/fedora-selinux/selinux/blob/master/policycoreutils/semodule_expand/semodule_expand.c#L79