Re: [ SEMANAGE ] Stub pserver backend

[Joshua Brindle <jbrindle@tresys.com>]

Ivan Gyurdiev wrote:
> 
>>
>> the swig wrappers don't currently have any write (transaction) 
>> functionality, nor are the seuser keys and create functions wrapped, 
>> these will need to be done.
> 
> Speaking of transactions, I see the "moving genhomedircon patch outside 
> the active-lock section" patch has been merged. That's fine, but I also 
> pointed out why genhomedircon should be using transactions in read-only 
> mode as well - please see the relevant thread. Using transactions there 
> eliminates an unnecessary policy rebuild, and a race condition (but on 
> the other hand then you have another deadlock to deal with, because 
> you're calling it with the transaction lock held).
> 
> 
There is no race condition on reads. Every query returns the transaction 
number and the client should check the transaction numbers for consistency.

The policy rebuild is an implementation issue, as little or as much of 
the cache can be filled at any time, and the transaction number can 
always be polled to ensure its up to date.

That said, genhomedircon may be placed inside the transaction at some 
point in the future when the whole policy directory is inside the 
sandbox, but until then there is no need for this, and it causes tons of 
extra copying of files, filling of unused databases, parsing of policydb 
and a possible policy rebuild/reload.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.