From 894288340f561865b6585935c9446abe7dd3af03 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 10 Nov 2023 00:22:21 +0000 Subject: [PATCH] executor: lazily load SELinux Loading the SELinux DB on every invocation can be slow and takes 2ms-10ms, so do not initialize it unconditionally, but wait for the first use. On a mkosi Fedora rawhide image, this cuts the number of loads in half. --- src/core/executor.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/core/executor.c b/src/core/executor.c index 86fbaef347..e07a689074 100644 --- a/src/core/executor.c +++ b/src/core/executor.c @@ -199,10 +199,6 @@ int main(int argc, char *argv[]) { log_set_prohibit_ipc(true); log_setup(); - r = mac_init(); - if (r < 0) - return log_error_errno(r, "Failed to initialize MAC layer: %m"); - r = fdset_new_fill(/* filter_cloexec= */ 0, &fdset); if (r < 0) return log_error_errno(r, "Failed to create fd set: %m"); @@ -217,6 +213,13 @@ int main(int argc, char *argv[]) { log_open(); } + /* Initialize lazily. SMACK is just a few operations, but the SELinux is very slow as it requires + * loading the entire database in memory, so we will do it lazily only if it is actually needed, to + * avoid wasting 2ms-10ms for each sd-executor that gets spawned. */ + r = mac_init_lazy(); + if (r < 0) + return log_error_errno(r, "Failed to initialize MAC layer: %m"); + r = fdset_remove(fdset, fileno(arg_serialization)); if (r < 0) return log_error_errno(r, "Failed to remove serialization fd from fd set: %m");