Re: [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC

[Stephen Smalley <stephen.smalley.work@gmail.com>]

On Wed, Sep 10, 2025 at 10:14 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Wed, Sep 10, 2025 at 6:43 AM Richard W.M. Jones <rjones@redhat.com> wrote:
> >
> > SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with
> > multiple hard links or bind mounts that have differing contexts.
> > However doing this involves building a large internal hashtable that
> > stores the full path of every file examined by setfiles.  For
> > filesystems that have very large numbers of files or long pathnames,
> > this uses a lot of memory, which makes SELinux relabelling in
> > constrained memory environments infeasible.
> >
> > This adds a new setfiles -A option that disables this tracking.
> >
> > For example, using setfiles to relabel a filesystem with 15 million
> > files took 3.7GB of RAM.  Using this option, the same filesystem can
> > be relabelled in 121MB (albeit with no warnings or errors possible for
> > conflicting labels, but for our use case we don't care about that.)
> >
> > Fixes: https://issues.redhat.com/browse/RHEL-111505
> > Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Thanks, applied.