Description of problem: Back around 2008, semanage.conf was changed to not check policy assertions during load, by setting expand-check=0. The reasoning[1] was that it could be done instead during policy build with a 'make validate' step, because the process takes a long time. In this commit[2] in 2012, that step in the build was silently changed to add: make validate [...] SEMOD_EXP="/usr/bin/semodule_expand -a" The problem is that the '-a' option means "don't check assertions"[3]. As far as I can tell, they haven't been checked at build or load time since f18. It takes an incredibly long time to run (I'm at 40min and still going). Running it over a reduced policy in a different environment reveals there are bugs hidden here: libsepol.check_assertion_helper: neverallow violated by allow restorecond_t semanage_store_t:file { relabelto }; (and more, but it's only showing one error at a time) [1] http://www.spinics.net/lists/selinux/msg03931.html [2] https://lists.fedoraproject.org/pipermail/scm-commits/2012-September/866834.html [3] https://github.com/fedora-selinux/selinux/blob/master/policycoreutils/semodule_expand/semodule_expand.c#L79
I gave up after about an hour of waiting for check_assertion to run on fedora policy, and started looking at performance. Most of the time is in libsepol's avtab hash table lookups. With some changes to the hash table and -O2, it now takes about 5 minutes. I suspect we can do much better. There is still a peak of about 1.2GB RES. I'll clean up that patch and submit it soon.
If you fix the performance problem, we can turn this back on.
https://github.com/fedora-selinux/selinux/pull/3 Let me know if there is a better way to submit changes.
Petr, there is updated patch in upstream from John.
This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle. Changing version to '23'. (As we did not run this process for some time, it could affect also pre-Fedora 23 development cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.) More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23
The updated libsepol-2.4 with John's patches is already in Fedora 23 so I guess you can remove '-a' option.
We should have all fixes in Fedora userspace and also in Fedora policy in F23/Rawhide. We also removed this option from selinux-policy.spec in rawhide and we are testing in for F23. So you can test it with the latest F23 policy and libsepol builds to see how it works. Thank you.
I believe this is already incorporated in Fedora 23.