* [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC @ 2025-09-01 14:31 Richard W.M. Jones 2025-09-01 14:31 ` Richard W.M. Jones 0 siblings, 1 reply; 7+ messages in thread From: Richard W.M. Jones @ 2025-09-01 14:31 UTC (permalink / raw) To: selinux SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have differing contexts. However doing this involves building a large internal hashtable that stores the full path of every file examined by setfiles. For filesystems that have very large numbers of files or long pathnames, this uses a lot of memory, which makes SELinux relabelling in constrained memory environments infeasible. This adds a new 'setfiles -A' option that disables this tracking. For example, using setfiles to relabel a filesystem with 15 million files took 3.7GB of RAM. Using this option, the same filesystem can be relabelled in 121MB (albeit with no warnings or errors possible for conflicting labels, but for our use case we don't care about that.) While this is quite niche, reducing the memory usage of setfiles allows us to do offline SELinux relabelling without worrying about the number of files in the filesystem. Fixes: https://issues.redhat.com/browse/RHEL-111505 (I also posted it as a pull request here: https://github.com/SELinuxProject/selinux/pull/490) ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-01 14:31 [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC Richard W.M. Jones @ 2025-09-01 14:31 ` Richard W.M. Jones 2025-09-02 15:46 ` Stephen Smalley 0 siblings, 1 reply; 7+ messages in thread From: Richard W.M. Jones @ 2025-09-01 14:31 UTC (permalink / raw) To: selinux SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have differing contexts. However doing this involves building a large internal hashtable that stores the full path of every file examined by setfiles. For filesystems that have very large numbers of files or long pathnames, this uses a lot of memory, which makes SELinux relabelling in constrained memory environments infeasible. This adds a new setfiles -A option that disables this tracking. For example, using setfiles to relabel a filesystem with 15 million files took 3.7GB of RAM. Using this option, the same filesystem can be relabelled in 121MB (albeit with no warnings or errors possible for conflicting labels, but for our use case we don't care about that.) Fixes: https://issues.redhat.com/browse/RHEL-111505 Signed-off-by: Richard W.M. Jones <rjones@redhat.com> --- policycoreutils/setfiles/setfiles.8 | 4 ++++ policycoreutils/setfiles/setfiles.c | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 index eabf0a1c..7c9c5d39 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. .RB [ \-I | \-D ] .RB [ \-T .IR nthreads ] +.RB [ \-A ] .I spec_file .IR pathname \ ... @@ -187,6 +188,9 @@ use up to threads. Specify 0 to create as many threads as there are available CPU cores; 1 to use only a single thread (default); or any positive number to use the given number of threads (if possible). +.TP +.B \-A +do not track conflicting inodes (saves memory) .SH "ARGUMENTS" .TP diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c index ad09f840..40f2e7fe 100644 --- a/policycoreutils/setfiles/setfiles.c +++ b/policycoreutils/setfiles/setfiles.c @@ -147,7 +147,7 @@ int main(int argc, char **argv) const char *base; int errors = 0; const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; - const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; + const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A"; const char *opts; union selinux_callback cb; long unsigned skipped_errors; @@ -375,6 +375,9 @@ int main(int argc, char **argv) if (*optarg == '\0' || *endptr != '\0') usage(argv[0]); break; + case 'A': + r_opts.add_assoc = 0; + break; case 'h': case '?': usage(argv[0]); -- 2.50.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-01 14:31 ` Richard W.M. Jones @ 2025-09-02 15:46 ` Stephen Smalley 2025-09-02 16:12 ` Petr Lautrbach 0 siblings, 1 reply; 7+ messages in thread From: Stephen Smalley @ 2025-09-02 15:46 UTC (permalink / raw) To: Richard W.M. Jones; +Cc: selinux On Mon, Sep 1, 2025 at 10:34 AM Richard W.M. Jones <rjones@redhat.com> wrote: > > SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have > differing contexts. However doing this involves building a large > internal hashtable that stores the full path of every file examined by > setfiles. For filesystems that have very large numbers of files or > long pathnames, this uses a lot of memory, which makes SELinux > relabelling in constrained memory environments infeasible. > > This adds a new setfiles -A option that disables this tracking. > > For example, using setfiles to relabel a filesystem with 15 million > files took 3.7GB of RAM. Using this option, the same filesystem can > be relabelled in 121MB (albeit with no warnings or errors possible for > conflicting labels, but for our use case we don't care about that.) > > Fixes: https://issues.redhat.com/browse/RHEL-111505 > Signed-off-by: Richard W.M. Jones <rjones@redhat.com> I don't think we usually include downstream issue tracker links in our upstream commit messages, but no need to re-submit just for that. Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> > --- > policycoreutils/setfiles/setfiles.8 | 4 ++++ > policycoreutils/setfiles/setfiles.c | 5 ++++- > 2 files changed, 8 insertions(+), 1 deletion(-) > > diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 > index eabf0a1c..7c9c5d39 100644 > --- a/policycoreutils/setfiles/setfiles.8 > +++ b/policycoreutils/setfiles/setfiles.8 > @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. > .RB [ \-I | \-D ] > .RB [ \-T > .IR nthreads ] > +.RB [ \-A ] > .I spec_file > .IR pathname \ ... > > @@ -187,6 +188,9 @@ use up to > threads. Specify 0 to create as many threads as there are available > CPU cores; 1 to use only a single thread (default); or any positive > number to use the given number of threads (if possible). > +.TP > +.B \-A > +do not track conflicting inodes (saves memory) > > .SH "ARGUMENTS" > .TP > diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c > index ad09f840..40f2e7fe 100644 > --- a/policycoreutils/setfiles/setfiles.c > +++ b/policycoreutils/setfiles/setfiles.c > @@ -147,7 +147,7 @@ int main(int argc, char **argv) > const char *base; > int errors = 0; > const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; > - const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; > + const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A"; > const char *opts; > union selinux_callback cb; > long unsigned skipped_errors; > @@ -375,6 +375,9 @@ int main(int argc, char **argv) > if (*optarg == '\0' || *endptr != '\0') > usage(argv[0]); > break; > + case 'A': > + r_opts.add_assoc = 0; > + break; > case 'h': > case '?': > usage(argv[0]); > -- > 2.50.1 > > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-02 15:46 ` Stephen Smalley @ 2025-09-02 16:12 ` Petr Lautrbach 2025-09-02 16:30 ` Stephen Smalley 2025-09-02 16:54 ` Richard W.M. Jones 0 siblings, 2 replies; 7+ messages in thread From: Petr Lautrbach @ 2025-09-02 16:12 UTC (permalink / raw) To: Stephen Smalley, Richard W.M. Jones; +Cc: selinux Stephen Smalley <stephen.smalley.work@gmail.com> writes: > On Mon, Sep 1, 2025 at 10:34 AM Richard W.M. Jones <rjones@redhat.com> wrote: >> >> SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have >> differing contexts. However doing this involves building a large >> internal hashtable that stores the full path of every file examined by >> setfiles. For filesystems that have very large numbers of files or >> long pathnames, this uses a lot of memory, which makes SELinux >> relabelling in constrained memory environments infeasible. >> >> This adds a new setfiles -A option that disables this tracking. >> >> For example, using setfiles to relabel a filesystem with 15 million >> files took 3.7GB of RAM. Using this option, the same filesystem can >> be relabelled in 121MB (albeit with no warnings or errors possible for >> conflicting labels, but for our use case we don't care about that.) >> >> Fixes: https://issues.redhat.com/browse/RHEL-111505 >> Signed-off-by: Richard W.M. Jones <rjones@redhat.com> > > I don't think we usually include downstream issue tracker links in our > upstream commit messages, but no need to re-submit just for that. FTR in git log there are already about 60 references to bugzilla.redhat.com and issues.redhat.com is replacement of bugzilla.redhat.com for issues reported on RHEL or CentOS. There are also bugs.debian.org, bugs.gentoo.org, bugs.chromium.org references. Until these issue trackers disappear, it could be a good source for another context or related discussions. > Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> > >> --- >> policycoreutils/setfiles/setfiles.8 | 4 ++++ >> policycoreutils/setfiles/setfiles.c | 5 ++++- >> 2 files changed, 8 insertions(+), 1 deletion(-) >> >> diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 >> index eabf0a1c..7c9c5d39 100644 >> --- a/policycoreutils/setfiles/setfiles.8 >> +++ b/policycoreutils/setfiles/setfiles.8 >> @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. >> .RB [ \-I | \-D ] >> .RB [ \-T >> .IR nthreads ] >> +.RB [ \-A ] >> .I spec_file >> .IR pathname \ ... >> >> @@ -187,6 +188,9 @@ use up to >> threads. Specify 0 to create as many threads as there are available >> CPU cores; 1 to use only a single thread (default); or any positive >> number to use the given number of threads (if possible). >> +.TP >> +.B \-A >> +do not track conflicting inodes (saves memory) >> >> .SH "ARGUMENTS" >> .TP >> diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c >> index ad09f840..40f2e7fe 100644 >> --- a/policycoreutils/setfiles/setfiles.c >> +++ b/policycoreutils/setfiles/setfiles.c >> @@ -147,7 +147,7 @@ int main(int argc, char **argv) >> const char *base; >> int errors = 0; >> const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; >> - const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; >> + const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A"; >> const char *opts; >> union selinux_callback cb; >> long unsigned skipped_errors; >> @@ -375,6 +375,9 @@ int main(int argc, char **argv) >> if (*optarg == '\0' || *endptr != '\0') >> usage(argv[0]); >> break; >> + case 'A': >> + r_opts.add_assoc = 0; >> + break; >> case 'h': >> case '?': >> usage(argv[0]); >> -- >> 2.50.1 >> >> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-02 16:12 ` Petr Lautrbach @ 2025-09-02 16:30 ` Stephen Smalley 2025-09-02 16:54 ` Richard W.M. Jones 1 sibling, 0 replies; 7+ messages in thread From: Stephen Smalley @ 2025-09-02 16:30 UTC (permalink / raw) To: Petr Lautrbach; +Cc: Richard W.M. Jones, selinux On Tue, Sep 2, 2025 at 12:12 PM Petr Lautrbach <lautrbach@redhat.com> wrote: > > Stephen Smalley <stephen.smalley.work@gmail.com> writes: > > > On Mon, Sep 1, 2025 at 10:34 AM Richard W.M. Jones <rjones@redhat.com> wrote: > >> > >> SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have > >> differing contexts. However doing this involves building a large > >> internal hashtable that stores the full path of every file examined by > >> setfiles. For filesystems that have very large numbers of files or > >> long pathnames, this uses a lot of memory, which makes SELinux > >> relabelling in constrained memory environments infeasible. > >> > >> This adds a new setfiles -A option that disables this tracking. > >> > >> For example, using setfiles to relabel a filesystem with 15 million > >> files took 3.7GB of RAM. Using this option, the same filesystem can > >> be relabelled in 121MB (albeit with no warnings or errors possible for > >> conflicting labels, but for our use case we don't care about that.) > >> > >> Fixes: https://issues.redhat.com/browse/RHEL-111505 > >> Signed-off-by: Richard W.M. Jones <rjones@redhat.com> > > > > I don't think we usually include downstream issue tracker links in our > > upstream commit messages, but no need to re-submit just for that. > > FTR in git log there are already about 60 references to bugzilla.redhat.com and > issues.redhat.com is replacement of bugzilla.redhat.com for issues > reported on RHEL or CentOS. There are also bugs.debian.org, > bugs.gentoo.org, bugs.chromium.org references. > > > Until these issue trackers disappear, it could be a good source for another > context or related discussions. Ok, thanks for clarifying. I know that tends to be frowned upon in the kernel but wasn't sure what current userspace practice is. My only request then is that such issues be publicly accessible if they are going to be referenced upstream. But I won't die on that hill if others disagree. > > > Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> > > > >> --- > >> policycoreutils/setfiles/setfiles.8 | 4 ++++ > >> policycoreutils/setfiles/setfiles.c | 5 ++++- > >> 2 files changed, 8 insertions(+), 1 deletion(-) > >> > >> diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 > >> index eabf0a1c..7c9c5d39 100644 > >> --- a/policycoreutils/setfiles/setfiles.8 > >> +++ b/policycoreutils/setfiles/setfiles.8 > >> @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. > >> .RB [ \-I | \-D ] > >> .RB [ \-T > >> .IR nthreads ] > >> +.RB [ \-A ] > >> .I spec_file > >> .IR pathname \ ... > >> > >> @@ -187,6 +188,9 @@ use up to > >> threads. Specify 0 to create as many threads as there are available > >> CPU cores; 1 to use only a single thread (default); or any positive > >> number to use the given number of threads (if possible). > >> +.TP > >> +.B \-A > >> +do not track conflicting inodes (saves memory) > >> > >> .SH "ARGUMENTS" > >> .TP > >> diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c > >> index ad09f840..40f2e7fe 100644 > >> --- a/policycoreutils/setfiles/setfiles.c > >> +++ b/policycoreutils/setfiles/setfiles.c > >> @@ -147,7 +147,7 @@ int main(int argc, char **argv) > >> const char *base; > >> int errors = 0; > >> const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; > >> - const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; > >> + const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A"; > >> const char *opts; > >> union selinux_callback cb; > >> long unsigned skipped_errors; > >> @@ -375,6 +375,9 @@ int main(int argc, char **argv) > >> if (*optarg == '\0' || *endptr != '\0') > >> usage(argv[0]); > >> break; > >> + case 'A': > >> + r_opts.add_assoc = 0; > >> + break; > >> case 'h': > >> case '?': > >> usage(argv[0]); > >> -- > >> 2.50.1 > >> > >> > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-02 16:12 ` Petr Lautrbach 2025-09-02 16:30 ` Stephen Smalley @ 2025-09-02 16:54 ` Richard W.M. Jones 2025-09-02 17:45 ` Stephen Smalley 1 sibling, 1 reply; 7+ messages in thread From: Richard W.M. Jones @ 2025-09-02 16:54 UTC (permalink / raw) To: Petr Lautrbach; +Cc: Stephen Smalley, selinux BTW we seem to have "forked" the reviews. I made an update to the pull request, as requested by a reviewer there: https://github.com/SELinuxProject/selinux/pull/490 I can post a v2 on the list if required. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 100 libraries supported. http://fedoraproject.org/wiki/MinGW ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-02 16:54 ` Richard W.M. Jones @ 2025-09-02 17:45 ` Stephen Smalley 0 siblings, 0 replies; 7+ messages in thread From: Stephen Smalley @ 2025-09-02 17:45 UTC (permalink / raw) To: Richard W.M. Jones; +Cc: Petr Lautrbach, selinux On Tue, Sep 2, 2025 at 12:54 PM Richard W.M. Jones <rjones@redhat.com> wrote: > > > BTW we seem to have "forked" the reviews. I made an update to the > pull request, as requested by a reviewer there: > > https://github.com/SELinuxProject/selinux/pull/490 > > I can post a v2 on the list if required. Yes please. The actual SELinux maintainers only review and merge patches on the list. > > Rich. > > -- > Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones > Read my programming and virtualization blog: http://rwmj.wordpress.com > Fedora Windows cross-compiler. Compile Windows programs, test, and > build Windows installers. Over 100 libraries supported. > http://fedoraproject.org/wiki/MinGW > ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-09-02 17:45 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-09-01 14:31 [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC Richard W.M. Jones 2025-09-01 14:31 ` Richard W.M. Jones 2025-09-02 15:46 ` Stephen Smalley 2025-09-02 16:12 ` Petr Lautrbach 2025-09-02 16:30 ` Stephen Smalley 2025-09-02 16:54 ` Richard W.M. Jones 2025-09-02 17:45 ` Stephen Smalley
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).