[Selinux-commits] SF.net SVN: selinux: [2782] trunk

[<ssm...@us...>]

Revision: 2782
          http://selinux.svn.sourceforge.net/selinux/?rev=2782&view=rev
Author:   ssmalley
Date:     2008-02-04 08:33:54 -0800 (Mon, 04 Feb 2008)

Log Message:
-----------
Author: Joshua Brindle
Email: me...@ma...
Subject: libsemanage: free policydb before fork
Date: Sat, 02 Feb 2008 22:12:31 -0500

While testing the recent memory-related patches on a low memory machine 
(512m total) I found that semodule still failed. It turns out that 
fork() requires enough free ram for the amount of private dirty memory 
in the parent process to succeed (even if it is never written to in the 
child process). This patch moves the genhomedircon call to outside of 
semanage_sandbox_install so that the policydb can be freed before any 
forks happen. With this patch and the prior ones semodule runs fine on a 
512m machine.
 
Signed-off-By: Joshua Brindle <me...@ma...>

Modified Paths:
--------------
    trunk/libsemanage/src/direct_api.c
    trunk/libsemanage/src/semanage_store.c
    trunk/libsemanage/src/semanage_store.h
    trunk/scripts/selinux-maint

Modified: trunk/libsemanage/src/direct_api.c
===================================================================
--- trunk/libsemanage/src/direct_api.c	2008-02-04 15:42:17 UTC (rev 2781)
+++ trunk/libsemanage/src/direct_api.c	2008-02-04 16:33:54 UTC (rev 2782)
@@ -41,6 +41,7 @@
 #include "boolean_internal.h"
 #include "fcontext_internal.h"
 #include "node_internal.h"
+#include "genhomedircon.h"
 
 #include "debug.h"
 #include "handle.h"
@@ -704,8 +705,27 @@
 	if (retval < 0)
 		goto cleanup;
 
+	/* run genhomedircon if its enabled, this should be the last operation
+	 * which requires the out policydb */
+	if (!sh->conf->disable_genhomedircon) {
+		if ((retval =
+		     semanage_genhomedircon(sh, out, 1)) != 0) {
+			ERR(sh, "semanage_genhomedircon returned error code %d.",
+			    retval);
+			goto cleanup;
+		}
+	} else {
+		WARN(sh, "WARNING: genhomedircon is disabled. \
+                               See /etc/selinux/semanage.conf if you need to enable it.");
+        }
+
+	/* free out, if we don't free it before calling semanage_install_sandbox 
+	 * then fork() may fail on low memory machines */
+	sepol_policydb_free(out);
+	out = NULL;
+
 	if (sh->do_rebuild || modified) {
-		retval = semanage_install_sandbox(sh, out);
+		retval = semanage_install_sandbox(sh);
 	}
 
       cleanup:

Modified: trunk/libsemanage/src/semanage_store.c
===================================================================
--- trunk/libsemanage/src/semanage_store.c	2008-02-04 15:42:17 UTC (rev 2781)
+++ trunk/libsemanage/src/semanage_store.c	2008-02-04 16:33:54 UTC (rev 2782)
@@ -34,7 +34,6 @@
 #include "semanage_store.h"
 #include "database_policydb.h"
 #include "handle.h"
-#include "genhomedircon.h"
 
 #include <selinux/selinux.h>
 #include <sepol/policydb.h>
@@ -1279,8 +1278,7 @@
  * should be placed within a mutex lock to ensure that it runs
  * atomically.	Returns commit number on success, -1 on error.
  */
-int semanage_install_sandbox(semanage_handle_t * sh,
-			     sepol_policydb_t * policydb)
+int semanage_install_sandbox(semanage_handle_t * sh)
 {
 	int retval = -1, commit_num = -1;
 
@@ -1293,17 +1291,6 @@
 		ERR(sh, "No setfiles program specified in configuration file.");
 		goto cleanup;
 	}
-	if (!sh->conf->disable_genhomedircon) {
-		if ((retval =
-		     semanage_genhomedircon(sh, policydb, TRUE)) != 0) {
-			ERR(sh, "semanage_genhomedircon returned error code %d.",
-			    retval);
-			goto cleanup;
-		}
-	} else {
-		WARN(sh, "WARNING: genhomedircon is disabled. \
-See /etc/selinux/semanage.conf if you need to enable it.");
-	}
 
 	if ((commit_num = semanage_commit_sandbox(sh)) < 0) {
 		retval = commit_num;

Modified: trunk/libsemanage/src/semanage_store.h
===================================================================
--- trunk/libsemanage/src/semanage_store.h	2008-02-04 15:42:17 UTC (rev 2781)
+++ trunk/libsemanage/src/semanage_store.h	2008-02-04 16:33:54 UTC (rev 2782)
@@ -100,8 +100,7 @@
 int semanage_write_policydb(semanage_handle_t * sh,
 			    sepol_policydb_t * policydb);
 
-int semanage_install_sandbox(semanage_handle_t * sh,
-			     sepol_policydb_t * policydb);
+int semanage_install_sandbox(semanage_handle_t * sh);
 
 int semanage_verify_modules(semanage_handle_t * sh,
 			    char **module_filenames, int num_modules);

Modified: trunk/scripts/selinux-maint
===================================================================
--- trunk/scripts/selinux-maint	2008-02-04 15:42:17 UTC (rev 2781)
+++ trunk/scripts/selinux-maint	2008-02-04 16:33:54 UTC (rev 2782)
@@ -104,13 +104,13 @@
         os.chdir(patch_dir)
         
     patchfd = open(patch_name)
-    retcode = subprocess.call(["patch", patch_level, "--dry-run"], stdin=patchfd)
+    retcode = subprocess.call(["patch", patch_level, "--dry-run", "-l"], stdin=patchfd)
     resp = raw_input("apply [y/n]: ")
     if resp != "y":
         sys.exit(0)
 
     patchfd = open(patch_name)
-    patch_output = subprocess.Popen(["patch", patch_level], stdin=patchfd,
+    patch_output = subprocess.Popen(["patch", patch_level, "-l"], stdin=patchfd,
                                     stdout=subprocess.PIPE).communicate()[0]
 
     status_output = subprocess.Popen(["svn", "status"], stdout=subprocess.PIPE).communicate()[0]


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.