[PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Richard W.M. Jones]

SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have
differing contexts.  However doing this involves building a large
internal hashtable that stores the full path of every file examined by
setfiles.  For filesystems that have very large numbers of files or
long pathnames, this uses a lot of memory, which makes SELinux
relabelling in constrained memory environments infeasible.

This adds a new 'setfiles -A' option that disables this tracking.

For example, using setfiles to relabel a filesystem with 15 million
files took 3.7GB of RAM.  Using this option, the same filesystem can
be relabelled in 121MB (albeit with no warnings or errors possible for
conflicting labels, but for our use case we don't care about that.)

While this is quite niche, reducing the memory usage of setfiles
allows us to do offline SELinux relabelling without worrying about the
number of files in the filesystem.

Fixes: https://issues.redhat.com/browse/RHEL-111505

(I also posted it as a pull request here:
https://github.com/SELinuxProject/selinux/pull/490)

[PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Richard W.M. Jones]

SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have
differing contexts.  However doing this involves building a large
internal hashtable that stores the full path of every file examined by
setfiles.  For filesystems that have very large numbers of files or
long pathnames, this uses a lot of memory, which makes SELinux
relabelling in constrained memory environments infeasible.

This adds a new setfiles -A option that disables this tracking.

For example, using setfiles to relabel a filesystem with 15 million
files took 3.7GB of RAM.  Using this option, the same filesystem can
be relabelled in 121MB (albeit with no warnings or errors possible for
conflicting labels, but for our use case we don't care about that.)

Fixes: https://issues.redhat.com/browse/RHEL-111505
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
---
 policycoreutils/setfiles/setfiles.8 | 4 ++++
 policycoreutils/setfiles/setfiles.c | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index eabf0a1c..7c9c5d39 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
 .RB [ \-I | \-D ]
 .RB [ \-T
 .IR nthreads ]
+.RB [ \-A ]
 .I spec_file
 .IR pathname \ ...
 
@@ -187,6 +188,9 @@ use up to
 threads.  Specify 0 to create as many threads as there are available
 CPU cores; 1 to use only a single thread (default); or any positive
 number to use the given number of threads (if possible).
+.TP
+.B \-A
+do not track conflicting inodes (saves memory)
 
 .SH "ARGUMENTS"
 .TP
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
index ad09f840..40f2e7fe 100644
--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
@@ -147,7 +147,7 @@ int main(int argc, char **argv)
 	const char *base;
 	int errors = 0;
 	const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
-	const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
+	const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A";
 	const char *opts;
 	union selinux_callback cb;
 	long unsigned skipped_errors;
@@ -375,6 +375,9 @@ int main(int argc, char **argv)
 			if (*optarg == '\0' || *endptr != '\0')
 				usage(argv[0]);
 			break;
+		case 'A':
+			r_opts.add_assoc = 0;
+			break;
 		case 'h':
 		case '?':
 			usage(argv[0]);
-- 
2.50.1

Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Stephen Smalley]

On Mon, Sep 1, 2025 at 10:34 AM Richard W.M. Jones <rjones@redhat.com> wrote:
>
> SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have
> differing contexts.  However doing this involves building a large
> internal hashtable that stores the full path of every file examined by
> setfiles.  For filesystems that have very large numbers of files or
> long pathnames, this uses a lot of memory, which makes SELinux
> relabelling in constrained memory environments infeasible.
>
> This adds a new setfiles -A option that disables this tracking.
>
> For example, using setfiles to relabel a filesystem with 15 million
> files took 3.7GB of RAM.  Using this option, the same filesystem can
> be relabelled in 121MB (albeit with no warnings or errors possible for
> conflicting labels, but for our use case we don't care about that.)
>
> Fixes: https://issues.redhat.com/browse/RHEL-111505
> Signed-off-by: Richard W.M. Jones <rjones@redhat.com>

I don't think we usually include downstream issue tracker links in our
upstream commit messages, but no need to re-submit just for that.

Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

> ---
>  policycoreutils/setfiles/setfiles.8 | 4 ++++
>  policycoreutils/setfiles/setfiles.c | 5 ++++-
>  2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
> index eabf0a1c..7c9c5d39 100644
> --- a/policycoreutils/setfiles/setfiles.8
> +++ b/policycoreutils/setfiles/setfiles.8
> @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
>  .RB [ \-I | \-D ]
>  .RB [ \-T
>  .IR nthreads ]
> +.RB [ \-A ]
>  .I spec_file
>  .IR pathname \ ...
>
> @@ -187,6 +188,9 @@ use up to
>  threads.  Specify 0 to create as many threads as there are available
>  CPU cores; 1 to use only a single thread (default); or any positive
>  number to use the given number of threads (if possible).
> +.TP
> +.B \-A
> +do not track conflicting inodes (saves memory)
>
>  .SH "ARGUMENTS"
>  .TP
> diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
> index ad09f840..40f2e7fe 100644
> --- a/policycoreutils/setfiles/setfiles.c
> +++ b/policycoreutils/setfiles/setfiles.c
> @@ -147,7 +147,7 @@ int main(int argc, char **argv)
>         const char *base;
>         int errors = 0;
>         const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
> -       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
> +       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A";
>         const char *opts;
>         union selinux_callback cb;
>         long unsigned skipped_errors;
> @@ -375,6 +375,9 @@ int main(int argc, char **argv)
>                         if (*optarg == '\0' || *endptr != '\0')
>                                 usage(argv[0]);
>                         break;
> +               case 'A':
> +                       r_opts.add_assoc = 0;
> +                       break;
>                 case 'h':
>                 case '?':
>                         usage(argv[0]);
> --
> 2.50.1
>
>

Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Petr Lautrbach]

Stephen Smalley <stephen.smalley.work@gmail.com> writes:

> On Mon, Sep 1, 2025 at 10:34 AM Richard W.M. Jones <rjones@redhat.com> wrote:
>>
>> SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have
>> differing contexts.  However doing this involves building a large
>> internal hashtable that stores the full path of every file examined by
>> setfiles.  For filesystems that have very large numbers of files or
>> long pathnames, this uses a lot of memory, which makes SELinux
>> relabelling in constrained memory environments infeasible.
>>
>> This adds a new setfiles -A option that disables this tracking.
>>
>> For example, using setfiles to relabel a filesystem with 15 million
>> files took 3.7GB of RAM.  Using this option, the same filesystem can
>> be relabelled in 121MB (albeit with no warnings or errors possible for
>> conflicting labels, but for our use case we don't care about that.)
>>
>> Fixes: https://issues.redhat.com/browse/RHEL-111505
>> Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
>
> I don't think we usually include downstream issue tracker links in our
> upstream commit messages, but no need to re-submit just for that.

FTR in git log there are already about 60 references to bugzilla.redhat.com and
issues.redhat.com is replacement of bugzilla.redhat.com for issues
reported on RHEL or CentOS. There are also bugs.debian.org,
bugs.gentoo.org, bugs.chromium.org references.


Until these issue trackers disappear, it could be a good source for another
context or related discussions.

> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
>
>> ---
>>  policycoreutils/setfiles/setfiles.8 | 4 ++++
>>  policycoreutils/setfiles/setfiles.c | 5 ++++-
>>  2 files changed, 8 insertions(+), 1 deletion(-)
>>
>> diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
>> index eabf0a1c..7c9c5d39 100644
>> --- a/policycoreutils/setfiles/setfiles.8
>> +++ b/policycoreutils/setfiles/setfiles.8
>> @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
>>  .RB [ \-I | \-D ]
>>  .RB [ \-T
>>  .IR nthreads ]
>> +.RB [ \-A ]
>>  .I spec_file
>>  .IR pathname \ ...
>>
>> @@ -187,6 +188,9 @@ use up to
>>  threads.  Specify 0 to create as many threads as there are available
>>  CPU cores; 1 to use only a single thread (default); or any positive
>>  number to use the given number of threads (if possible).
>> +.TP
>> +.B \-A
>> +do not track conflicting inodes (saves memory)
>>
>>  .SH "ARGUMENTS"
>>  .TP
>> diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
>> index ad09f840..40f2e7fe 100644
>> --- a/policycoreutils/setfiles/setfiles.c
>> +++ b/policycoreutils/setfiles/setfiles.c
>> @@ -147,7 +147,7 @@ int main(int argc, char **argv)
>>         const char *base;
>>         int errors = 0;
>>         const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
>> -       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
>> +       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A";
>>         const char *opts;
>>         union selinux_callback cb;
>>         long unsigned skipped_errors;
>> @@ -375,6 +375,9 @@ int main(int argc, char **argv)
>>                         if (*optarg == '\0' || *endptr != '\0')
>>                                 usage(argv[0]);
>>                         break;
>> +               case 'A':
>> +                       r_opts.add_assoc = 0;
>> +                       break;
>>                 case 'h':
>>                 case '?':
>>                         usage(argv[0]);
>> --
>> 2.50.1
>>
>>

Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Stephen Smalley]

On Tue, Sep 2, 2025 at 12:12 PM Petr Lautrbach <lautrbach@redhat.com> wrote:
>
> Stephen Smalley <stephen.smalley.work@gmail.com> writes:
>
> > On Mon, Sep 1, 2025 at 10:34 AM Richard W.M. Jones <rjones@redhat.com> wrote:
> >>
> >> SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes that have
> >> differing contexts.  However doing this involves building a large
> >> internal hashtable that stores the full path of every file examined by
> >> setfiles.  For filesystems that have very large numbers of files or
> >> long pathnames, this uses a lot of memory, which makes SELinux
> >> relabelling in constrained memory environments infeasible.
> >>
> >> This adds a new setfiles -A option that disables this tracking.
> >>
> >> For example, using setfiles to relabel a filesystem with 15 million
> >> files took 3.7GB of RAM.  Using this option, the same filesystem can
> >> be relabelled in 121MB (albeit with no warnings or errors possible for
> >> conflicting labels, but for our use case we don't care about that.)
> >>
> >> Fixes: https://issues.redhat.com/browse/RHEL-111505
> >> Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
> >
> > I don't think we usually include downstream issue tracker links in our
> > upstream commit messages, but no need to re-submit just for that.
>
> FTR in git log there are already about 60 references to bugzilla.redhat.com and
> issues.redhat.com is replacement of bugzilla.redhat.com for issues
> reported on RHEL or CentOS. There are also bugs.debian.org,
> bugs.gentoo.org, bugs.chromium.org references.
>
>
> Until these issue trackers disappear, it could be a good source for another
> context or related discussions.

Ok, thanks for clarifying. I know that tends to be frowned upon in the
kernel but wasn't sure what current userspace practice is.
My only request then is that such issues be publicly accessible if
they are going to be referenced upstream.
But I won't die on that hill if others disagree.

>
> > Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> >
> >> ---
> >>  policycoreutils/setfiles/setfiles.8 | 4 ++++
> >>  policycoreutils/setfiles/setfiles.c | 5 ++++-
> >>  2 files changed, 8 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
> >> index eabf0a1c..7c9c5d39 100644
> >> --- a/policycoreutils/setfiles/setfiles.8
> >> +++ b/policycoreutils/setfiles/setfiles.8
> >> @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
> >>  .RB [ \-I | \-D ]
> >>  .RB [ \-T
> >>  .IR nthreads ]
> >> +.RB [ \-A ]
> >>  .I spec_file
> >>  .IR pathname \ ...
> >>
> >> @@ -187,6 +188,9 @@ use up to
> >>  threads.  Specify 0 to create as many threads as there are available
> >>  CPU cores; 1 to use only a single thread (default); or any positive
> >>  number to use the given number of threads (if possible).
> >> +.TP
> >> +.B \-A
> >> +do not track conflicting inodes (saves memory)
> >>
> >>  .SH "ARGUMENTS"
> >>  .TP
> >> diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
> >> index ad09f840..40f2e7fe 100644
> >> --- a/policycoreutils/setfiles/setfiles.c
> >> +++ b/policycoreutils/setfiles/setfiles.c
> >> @@ -147,7 +147,7 @@ int main(int argc, char **argv)
> >>         const char *base;
> >>         int errors = 0;
> >>         const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
> >> -       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
> >> +       const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:A";
> >>         const char *opts;
> >>         union selinux_callback cb;
> >>         long unsigned skipped_errors;
> >> @@ -375,6 +375,9 @@ int main(int argc, char **argv)
> >>                         if (*optarg == '\0' || *endptr != '\0')
> >>                                 usage(argv[0]);
> >>                         break;
> >> +               case 'A':
> >> +                       r_opts.add_assoc = 0;
> >> +                       break;
> >>                 case 'h':
> >>                 case '?':
> >>                         usage(argv[0]);
> >> --
> >> 2.50.1
> >>
> >>
>

Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Richard W.M. Jones]

BTW we seem to have "forked" the reviews.  I made an update to the
pull request, as requested by a reviewer there:

https://github.com/SELinuxProject/selinux/pull/490

I can post a v2 on the list if required.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
Fedora Windows cross-compiler. Compile Windows programs, test, and
build Windows installers. Over 100 libraries supported.
http://fedoraproject.org/wiki/MinGW

Re: [PATCH] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Stephen Smalley]

On Tue, Sep 2, 2025 at 12:54 PM Richard W.M. Jones <rjones@redhat.com> wrote:
>
>
> BTW we seem to have "forked" the reviews.  I made an update to the
> pull request, as requested by a reviewer there:
>
> https://github.com/SELinuxProject/selinux/pull/490
>
> I can post a v2 on the list if required.

Yes please. The actual SELinux maintainers only review and merge
patches on the list.

>
> Rich.
>
> --
> Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
> Read my programming and virtualization blog: http://rwmj.wordpress.com
> Fedora Windows cross-compiler. Compile Windows programs, test, and
> build Windows installers. Over 100 libraries supported.
> http://fedoraproject.org/wiki/MinGW
>