Previous Entry Share Next Entry
Fedora 16 Alpha available, New SELinux Feature/Prebuilt Policy.
Fedora 16 Alpha was just released: The announcement include the following:

  • SELinux Enhancements.
    SELinux policy package now includes a pre-built policy that will only rebuild policy if any customizations have been made. A sample test run shows 4 times speedup on installing the package from 48 Seconds to 12 Seconds and max memory usage from 38M to 6M. In addition to that, SELinux file name transition allows better policy management. For instance, policy writers can take advantage of this and write a policy rule that states, if a SELinux unconfined process creates a file named resolv.conf in a directory labelled etc_t, the file should get labeled appropriately. This results is less chances of mislabeled files. Also, from this release onwards, selinuxfs is mounted at /sys/fs/selinux instead of in /selinux. All the affected components including anaconda, dracut, livecd-tools and policycoreutils have been modified to work with this change.

Pre-Built Policy

We made major changes to the selinux-policy-TYPE rpm. (selinux-policy-targeted-3.10.0-21.fc16)

The rpm now includes a pre-built /etc/selinux/targeted/policy/policy.26.  This policy file can be loaded right away in a fresh install.  In all previous versions of SELinux for RHEL and Fedora, we rebuilt this file in the post install.  The reason for this is we  need to recompile in local customizations that the user/administrator might have made on your system.  Additionally if any package shipped  with a policy we would need to recompile in those policy packages.  But as the size of policy grew we were seeing Anaconda installation times  grow and memory requirements grow because of selinux-policy package.  We were even seeing virtual machine installations blow up on selinux-policy package installs because of limited memory.  When we looked at the problem, we realized that on initial install of policy, no user would have made local customizations and very few packages are shipping with their own policy.  

I reworked the tools to include the policy packages within the payload and now the package will check in the pre-install if there was any local customizations, if yes, the post install will recompile the policy, but if not the policy will just install.

We also used to have to ship all of the policy modules, over 300, in the directory /usr/share/selinux/targeted and these would be copied into /etc/selinux/targeted/modules/active/, were we would never touch the files in /usr/share/selinux/targeted again.  Now we install directly into /etc/selinux/targeted/modules/active/.

What you should see is faster initial installs and faster selinux-package updates.  In Fedora 15 a policy-package update would take around 45-50 seconds, in Fedora 16 on an unmodified selinux-policy system it should take < 15 seconds.  If you are updating from Fedora 15 the first time, it will still take a long time, but the next update should go quick.  If you have modified the SELinux system by adding pp
files you will still see the recompile times that you always have.  :^(

  • 1

Found what was wrong and had a workaround

Thanks for the suggestion. I have found what was wrong. There are three problems when compiling a monolithic policy:

1. In the combined policy.conf, the "user" statements, that are the results of the gen_user() macros defined at the end of some modules, are mixed among other statements. The SELinux compiler does not like that and causes the error as in my first post. To workaround this problem, I moved the gen_user() macros to users-targeted which will become users file and be added to the end of policy.conf.

To really fix this problem I think the pre-processing scripts should perform the move automatically.

The related modules are unconfineduser.te, guest.te, xguest.te. and git.te.

2. Another problem is that some type statements are defined inside a optional_policy() block in one module and referenced via gen_require() in another module. To workaround this I moved the type statements outside and above the optional_policy().

The related modules are samba.te, unconfineduser.te, and qemu.te

3. This is not quite a problem but the selinux-policy.spec file was written to build modular policy RPM only. If one wants to build a monolithic policy RPM, the file has to be modified.

  • 1

Log in

No account? Create an account