Re: Fwd: Booting time is increased after applying kernel 3.10

[Paul Moore <paul@paul-moore.com>]

On Thursday, June 26, 2014 09:57:57 AM Stephen Smalley wrote:
> On 06/25/2014 03:49 PM, Stephen Smalley wrote:
> > I suspect it won't matter in practice, but the reason for it is that
> > permissions or other state may have been cached during bootup prior to
> > initial policy load that may no longer be valid.

...

> So I am not sure we can safely remove the avc_ss_reset() from initial
> policy load in the mainline kernel, as we are not guaranteed that there
> is no network interface configuration prior to initial policy load and
> we are not guaranteed that there will be a setenforce 1.  It would
> perhaps be better there to instead just avoid calling synchronize_net
> altogether if possible or only call it once for the entire avc_ss_reset,
> not on each of the netif/node/port callbacks.

When I took a quick glance at this briefly yesterday one of the things that 
crossed my mind was exporting the different netif/node/port flush functions 
and grouping the callbacks into a single callback that calls each of the flush 
functions and then synchronize_net() once at the end; similar to what you 
describe above.  Perhaps that is the best solution upstream.

Unless someone else wants to develop/test a patch, I'll put one together.

-- 
paul moore
www.paul-moore.com