(no subject)

[Richard W.M. Jones]

v1 was here:
https://lore.kernel.org/selinux/CAEjxPJ5BbCtQNjEdeSaHH1-54xzkYn_Qgptu91QKwfMQyyB9Gg@mail.gmail.com/T/#t

In this version I fixed up the usage documentation for setfiles.

Rich.

[PATCH v2] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Richard W.M. Jones]

SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have
differing contexts.  However doing this involves building a large
internal hashtable that stores the full path of every file examined by
setfiles.  For filesystems that have very large numbers of files or
long pathnames, this uses a lot of memory, which makes SELinux
relabelling in constrained memory environments infeasible.

This adds a new setfiles -A option that disables this tracking.

For example, using setfiles to relabel a filesystem with 15 million
files took 3.7GB of RAM.  Using this option, the same filesystem can
be relabelled in 121MB (albeit with no warnings or errors possible for
conflicting labels, but for our use case we don't care about that.)

Fixes: https://issues.redhat.com/browse/RHEL-111505
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
---
 policycoreutils/setfiles/setfiles.8 |  4 ++++
 policycoreutils/setfiles/setfiles.c | 11 +++++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index eabf0a1c..7c9c5d39 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
 .RB [ \-I | \-D ]
 .RB [ \-T
 .IR nthreads ]
+.RB [ \-A ]
 .I spec_file
 .IR pathname \ ...
 
@@ -187,6 +188,9 @@ use up to
 threads.  Specify 0 to create as many threads as there are available
 CPU cores; 1 to use only a single thread (default); or any positive
 number to use the given number of threads (if possible).
+.TP
+.B \-A
+do not track conflicting inodes (saves memory)
 
 .SH "ARGUMENTS"
 .TP
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
index ad09f840..4db3e894 100644
--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
 			name, name);
 	} else {
 		fprintf(stderr,
-			"usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
-			"usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
-			"usage:  %s -s [-diIDlmnpqvFUWT] spec_file\n",
+			"usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
+			"usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
+			"usage:  %s -s [-diIDlmnpqvAFUWT] spec_file\n",
 			name, name, name);
 	}
 	exit(-1);
@@ -147,7 +147,7 @@ int main(int argc, char **argv)
 	const char *base;
 	int errors = 0;
 	const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
-	const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
+	const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A";
 	const char *opts;
 	union selinux_callback cb;
 	long unsigned skipped_errors;
@@ -375,6 +375,9 @@ int main(int argc, char **argv)
 			if (*optarg == '\0' || *endptr != '\0')
 				usage(argv[0]);
 			break;
+		case 'A':
+			r_opts.add_assoc = 0;
+			break;
 		case 'h':
 		case '?':
 			usage(argv[0]);
-- 
2.50.1

Re: [PATCH v2] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Stephen Smalley]

On Tue, Sep 2, 2025 at 1:50 PM Richard W.M. Jones <rjones@redhat.com> wrote:
>
> SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have

Technically, for inodes with multiple hard links or bind mounts that
would match differing contexts. But no need to re-spin just for that.

> differing contexts.  However doing this involves building a large
> internal hashtable that stores the full path of every file examined by
> setfiles.  For filesystems that have very large numbers of files or
> long pathnames, this uses a lot of memory, which makes SELinux
> relabelling in constrained memory environments infeasible.
>
> This adds a new setfiles -A option that disables this tracking.
>
> For example, using setfiles to relabel a filesystem with 15 million
> files took 3.7GB of RAM.  Using this option, the same filesystem can
> be relabelled in 121MB (albeit with no warnings or errors possible for
> conflicting labels, but for our use case we don't care about that.)
>
> Fixes: https://issues.redhat.com/browse/RHEL-111505
> Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
> ---
>  policycoreutils/setfiles/setfiles.8 |  4 ++++
>  policycoreutils/setfiles/setfiles.c | 11 +++++++----
>  2 files changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
> index eabf0a1c..7c9c5d39 100644
> --- a/policycoreutils/setfiles/setfiles.8
> +++ b/policycoreutils/setfiles/setfiles.8
> @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
>  .RB [ \-I | \-D ]
>  .RB [ \-T
>  .IR nthreads ]
> +.RB [ \-A ]
>  .I spec_file
>  .IR pathname \ ...
>
> @@ -187,6 +188,9 @@ use up to
>  threads.  Specify 0 to create as many threads as there are available
>  CPU cores; 1 to use only a single thread (default); or any positive
>  number to use the given number of threads (if possible).
> +.TP
> +.B \-A
> +do not track conflicting inodes (saves memory)

Likewise here, I would say inodes with multiple hard links or bind
mounts that would match differing contexts but no need to re-spin just
for that IMHO.

>
>  .SH "ARGUMENTS"
>  .TP
> diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
> index ad09f840..4db3e894 100644
> --- a/policycoreutils/setfiles/setfiles.c
> +++ b/policycoreutils/setfiles/setfiles.c
> @@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
>                         name, name);
>         } else {
>                 fprintf(stderr,
> -                       "usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
> -                       "usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
> -                       "usage:  %s -s [-diIDlmnpqvFUWT] spec_file\n",
> +                       "usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
> +                       "usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
> +                       "usage:  %s -s [-diIDlmnpqvAFUWT] spec_file\n",
>                         name, name, name);
>         }
>         exit(-1);
> @@ -147,7 +147,7 @@ int main(int argc, char **argv)
>         const char *base;
>         int errors = 0;
>         const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
> -       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
> +       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A";

Should this be sorted? I'm ok either way and we don't seem to be
consistent, just asking.

>         const char *opts;
>         union selinux_callback cb;
>         long unsigned skipped_errors;
> @@ -375,6 +375,9 @@ int main(int argc, char **argv)
>                         if (*optarg == '\0' || *endptr != '\0')
>                                 usage(argv[0]);
>                         break;
> +               case 'A':
> +                       r_opts.add_assoc = 0;
> +                       break;
>                 case 'h':
>                 case '?':
>                         usage(argv[0]);
> --
> 2.50.1
>