selinux-commits Mailing List for Security-enhanced Linux (Page 8)

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Revision: 2775
          http://selinux.svn.sourceforge.net/selinux/?rev=2775&view=rev
Author:   madmethod
Date:     2008-02-02 07:36:53 -0800 (Sat, 02 Feb 2008)

Log Message:
-----------
On Fri, 2008-02-01 at 09:12 -0500, Joshua Brindle wrote:
> > This patch should reduce the amount of peak memory required to expand 
> > the policy by consuming part of the input policy during expansion. It 
> > reduced the rss of semodule_expand with a full refpolicy from 86 to 66 meg.
> > 
> > On a side note, if anyone knows of a good tool for profiling heap usage 
> > I'd like to hear, I've tried valgrind massif, google-perftools, and 
> > smaps and none of them seem to work that well...
> > 
> > Signed-off-by: Joshua Brindle <me...@ma...>

Looks sane, but patch is whitespace damaged here.  Feel free to apply.

Acked-by:  Stephen Smalley <sd...@ty...>

Modified Paths:
--------------
    trunk/libsemanage/src/semanage_store.c
    trunk/libsepol/include/sepol/handle.h
    trunk/libsepol/src/expand.c
    trunk/libsepol/src/handle.c
    trunk/libsepol/src/handle.h
    trunk/libsepol/src/libsepol.map
    trunk/policycoreutils/semodule_expand/semodule_expand.c

Modified: trunk/libsemanage/src/semanage_store.c
===================================================================

--- trunk/libsemanage/src/semanage_store.c	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/libsemanage/src/semanage_store.c	2008-02-02 15:36:53 UTC (rev 2775)
@@ -1636,6 +1636,8 @@
 	if (sepol_policydb_create(&out))
 		goto err;
 
+	sepol_set_expand_consume_base(sh->sepolh, 1);
+
 	if (sepol_expand_module(sh->sepolh,
 				sepol_module_package_get_policy(base), out, 0,
 				expand_check)

Modified: trunk/libsepol/include/sepol/handle.h
===================================================================
--- trunk/libsepol/include/sepol/handle.h	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/libsepol/include/sepol/handle.h	2008-02-02 15:36:53 UTC (rev 2775)
@@ -11,6 +11,10 @@
  * not disable dontaudits, 1 disables them */
 void sepol_set_disable_dontaudit(sepol_handle_t * sh, int disable_dontaudit);
 
+/* Set whether module_expand() should consume the base policy passed in.
+ * This should reduce the amount of memory required to expand the policy. */
+void sepol_set_expand_consume_base(sepol_handle_t * sh, int consume_base);
+
 /* Destroy a sepol handle. */
 void sepol_handle_destroy(sepol_handle_t *);
 

Modified: trunk/libsepol/src/expand.c
===================================================================
--- trunk/libsepol/src/expand.c	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/libsepol/src/expand.c	2008-02-02 15:36:53 UTC (rev 2775)
@@ -2134,17 +2134,17 @@
  */
 static int copy_and_expand_avrule_block(expand_state_t * state)
 {
-	avrule_block_t *curblock;
+	avrule_block_t *curblock = state->base->global;
+	avrule_block_t *prevblock;
 	int retval = -1;
 
-	for (curblock = state->base->global; curblock != NULL;
-	     curblock = curblock->next) {
+	while (curblock) {
 		avrule_decl_t *decl = curblock->enabled;
 		avrule_t *cur_avrule;
 
 		if (decl == NULL) {
 			/* nothing was enabled within this block */
-			continue;
+			goto cont;
 		}
 
 		/* copy role allows and role trans */
@@ -2186,6 +2186,18 @@
 		/* copy conditional rules */
 		if (cond_node_copy(state, decl->cond_list))
 			goto cleanup;
+
+      cont:
+		prevblock = curblock;
+		curblock = curblock->next;
+
+		if (state->handle && state->handle->expand_consume_base) {
+			/* set base top avrule block in case there
+ 			 * is an error condition and the policy needs 
+ 			 * to be destroyed */
+			state->base->global = curblock;
+			avrule_block_destroy(prevblock);
+		}
 	}
 
 	retval = 0;

Modified: trunk/libsepol/src/handle.c
===================================================================
--- trunk/libsepol/src/handle.c	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/libsepol/src/handle.c	2008-02-02 15:36:53 UTC (rev 2775)
@@ -16,6 +16,7 @@
 
 	/* by default do not disable dontaudits */
 	sh->disable_dontaudit = 0;
+	sh->expand_consume_base = 0;
 
 	return sh;
 }
@@ -26,6 +27,12 @@
 	sh->disable_dontaudit = disable_dontaudit;
 }
 
+void sepol_set_expand_consume_base(sepol_handle_t *sh, int consume_base)
+{
+	assert(sh != NULL);
+	sh->expand_consume_base = consume_base;
+}
+
 void sepol_handle_destroy(sepol_handle_t * sh)
 {
 	free(sh);

Modified: trunk/libsepol/src/handle.h
===================================================================
--- trunk/libsepol/src/handle.h	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/libsepol/src/handle.h	2008-02-02 15:36:53 UTC (rev 2775)
@@ -16,6 +16,7 @@
 	void *msg_callback_arg;
 
 	int disable_dontaudit;
+	int expand_consume_base;
 
 };
 

Modified: trunk/libsepol/src/libsepol.map
===================================================================
--- trunk/libsepol/src/libsepol.map	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/libsepol/src/libsepol.map	2008-02-02 15:36:53 UTC (rev 2775)
@@ -13,5 +13,6 @@
 	sepol_policy_kern_*;
 	sepol_policy_file_*;
 	sepol_set_disable_dontaudit;
+	sepol_set_expand_consume_base;
   local: *;
 };

Modified: trunk/policycoreutils/semodule_expand/semodule_expand.c
===================================================================
--- trunk/policycoreutils/semodule_expand/semodule_expand.c	2008-01-31 19:42:58 UTC (rev 2774)
+++ trunk/policycoreutils/semodule_expand/semodule_expand.c	2008-02-02 15:36:53 UTC (rev 2775)
@@ -44,6 +44,7 @@
 	sepol_policydb_t *out, *p;
 	FILE *fp, *outfile;
 	int check_assertions = 1;
+	sepol_handle_t *handle;
 
 	while ((ch = getopt(argc, argv, "c:Vva")) != EOF) {
 		switch (ch) {
@@ -105,6 +106,10 @@
 	basename = argv[optind++];
 	outname = argv[optind];
 
+	handle = sepol_handle_create();
+	if (!handle)
+		exit(1);
+
 	if (sepol_policy_file_create(&pf)) {
 		fprintf(stderr, "%s:  Out of memory\n", argv[0]);
 		exit(1);
@@ -132,7 +137,7 @@
 
 	/* linking the base takes care of enabling optional avrules */
 	p = sepol_module_package_get_policy(base);
-	if (sepol_link_modules(NULL, p, NULL, 0, 0)) {
+	if (sepol_link_modules(handle, p, NULL, 0, 0)) {
 		fprintf(stderr, "%s:  Error while enabling avrules\n", argv[0]);
 		exit(1);
 	}
@@ -144,7 +149,9 @@
 		exit(1);
 	}
 
-	if (sepol_expand_module(NULL, p, out, verbose, check_assertions)) {
+	sepol_set_expand_consume_base(handle, 1);
+
+	if (sepol_expand_module(handle, p, out, verbose, check_assertions)) {
 		fprintf(stderr, "%s:  Error while expanding policy\n", argv[0]);
 		exit(1);
 	}
@@ -174,6 +181,7 @@
 		exit(1);
 	}
 	fclose(outfile);
+	sepol_handle_destroy(handle);
 	sepol_policydb_free(out);
 	sepol_policy_file_free(pf);
 


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.




2006	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug (24)	Sep (38)	Oct (29)	Nov (40)	Dec (4)
2007	Jan (88)	Feb (66)	Mar (44)	Apr (104)	May (35)	Jun (34)	Jul (12)	Aug (42)	Sep (84)	Oct (34)	Nov (30)	Dec (22)
2008	Jan (60)	Feb (54)	Mar (32)	Apr (14)	May (16)	Jun (26)	Jul (22)	Aug (12)	Sep	Oct	Nov	Dec

selinux-commits Mailing List for Security-enhanced Linux (Page 8)

selinux-commits — Commits to the subversion repo