Description of problem: On systems that constantly fire AVCs, we can see setroubleshootd taking more and more memory with time. It's possible it's not a real memory leak but just enqueuing the AVC received by sedispatch for later processing (since setroubleshootd cannot handle AVCs as fast as sedispatch submits them), but on the long run, this memory consumption is a real issue. Version-Release number of selected component (if applicable): setroubleshoot-server-3.3.24-4.el8.x86_64 How reproducible: Always Steps to Reproduce: 1. Create a "AVC spawner", for example using the following /usr/local/bin/foobar script labeled intentionally with "logrotate_exec_t" -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- #!/bin/sh echo "$(basename $0): $(id -Z)" while :; do semanage fcontext -a -t http_config_t /tmp/foobar0001 done -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # chmod +x /usr/local/bin/foobar # chcon -t logrotate_exec_t /usr/local/bin/foobar -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 2. Create AVCs constantly -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # for i in $(seq 1 5); do; systemd-run --unit=foobar$i.service /usr/local/bin/foobar; done -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 3. Monitor setroubleshootd memory consumption -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # while :; do date; ps aux | grep setroubleshoot | grep -v grep; echo; sleep 10; done -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Actual results: initial: setroub+ 12979 8.1 7.3 547492 136712 ? Sl 10:07 0:12 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f setroub+ 12979 8.0 7.3 547492 136712 ? Sl 10:07 0:12 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f : after 1 hour: setroub+ 12979 7.3 12.0 634976 224156 ? Sl 10:07 5:14 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f setroub+ 12979 7.3 12.0 635232 224408 ? Sl 10:07 5:15 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f setroub+ 12979 7.3 12.0 635232 224588 ? Sl 10:07 5:16 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f : Expected results: Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (setroubleshoot bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:7642