Bug 2115242

Summary:	SELinux Parallel Autorelabel
Product:	Red Hat Enterprise Linux 9	Reporter:	Petr Lautrbach <plautrba>
Component:	policycoreutils	Assignee:	Petr Lautrbach <plautrba>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	low	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	medium
Version:	9.1	CC:	dwalsh, jafiala, lvrabec, mjahoda, mmalik, omosnace, plautrba, ssekidde, vmojzis
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	policycoreutils-3.4-3.el9	Doc Type:	Enhancement
Doc Text:	.SELinux automatic relabeling is now parallel by default Because the newly introduced parallel relabeling option significantly reduces the time required for the SELinux relabeling process on multi-core systems, the automatic relabeling script now contains the `-T 0` option in the `fixfiles` command line. The `-T 0` option ensures that the `setfiles` program uses the maximum of available processor cores for relabeling by default. To use only one process thread for relabeling as in the previous version of RHEL, override this setting by entering either the `fixfiles -T 1 onboot` command instead of just `fixfiles onboot` or the `echo "-T 1" > /.autorelabel` command instead of `touch /.autorelabel`.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-15 11:18:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Lautrbach 2022-08-04 08:23:02 UTC

Description of problem:

https://fedoraproject.org/wiki/Changes/SELinux_Parallel_Autorelabel

 Summary

After a system's SELinux mode is switched from disabled to enabled, or after an administrator runs fixfiles onboot, SELinux autorelabel will be run in parallel by default. 

Detailed Description

SELinux tools restorecon and fixfiles recently gained the ability to relabel files in parallel using the -T nthreads option. This option is currently not used in the automatic relabel after reboot. When users want/need the parallel relabeling they have to specify the option explicitly (e.g. fixfiles -T 0 onboot). With this change -T 0 (0 == use all available CPU cores) will be the default for fixfiles onboot and users will have to use fixfiles -T 1 onboot to force it to use only one thread.

The rationale is that when autorelabel runs, there are no other resource-intensive processes running on the system, so it's fine (and actually better) to use all available parallelism to speed up the task and get to a fully booted system faster. 

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Petr Lautrbach 2022-08-08 10:51:18 UTC

https://gitlab.com/redhat/centos-stream/rpms/policycoreutils/-/merge_requests/20

Comment 16 errata-xmlrpc 2022-11-15 11:18:54 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8335