Bug 811656
Summary: | setsebool -P is terribly slow | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Bill Nottingham <notting> |
Component: | policycoreutils | Assignee: | Daniel Walsh <dwalsh> |
Status: | CLOSED NEXTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 17 | CC: | dwalsh, eparis, gua, mgrepl, rvokal |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2012-10-16 17:53:43 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Bill Nottingham
2012-04-11 15:59:36 UTC
Is this on a virtual machine? I see # time setsebool -P deny_ptrace=false real 0m13.920s user 0m12.718s sys 0m1.004s No, bare hardware, Core i7. If there is something I can do to get a better profile of what it's doing (either a trace mode, or oprofile, or whatever), just ask. It is doing a full compile of the policy. time setsebool -P deny_ptrace=true real 0m9.660s user 0m9.295s sys 0m0.251s ThinkPad X220 on SSD grep expand-check /etc/selinux/semanage.conf # expand-check check neverallow rules when executing all semanage commands. expand-check=0 Why is the compile so long on my box? (x201s, also ssd). expand-check is also 0 for me. No clue. Is it repeatable? Yes, happens every time. Eric have any ideas? Confirmed problem. Slow on my laptop too. I believe we have a fix. But if you want it faster, and your system to be a little more secure. semodule -d unconfined Which will disable most of the unconfined domains on your system. unconfined_t will still work. This is fixed in Fedora 18. |