daemon/selinux.ml: Use setfiles -A option to reduce memory usage

In filesystems that have many millions of files, the default behaviour
of setfiles is to build a huge hash table containing every filename.
This uses up lots of memory which prevents relabelling from happening
in the reduced memory environment of the libguestfs appliance.

I added the setfiles -A option to change this default behaviour.  If
setfiles has the option then use it.

Fixes: https://issues.redhat.com/browse/RHEL-114292
Related: https://issues.redhat.com/browse/RHEL-111165
Related: https://issues.redhat.com/browse/RHEL-111505
This commit is contained in:
Richard W.M. Jones
2025-09-11 21:03:37 +01:00
parent 5f47af7f3e
commit 30ccb9a3e6

View File

@@ -73,6 +73,12 @@ let setfiles ?(force = false) specfile paths =
*) *)
if setfiles_has_option 'C' then List.push_back args "-C"; if setfiles_has_option 'C' then List.push_back args "-C";
(* Use the -A option if available to reduce the amount of memory
* used in filesystems with millions of files
* See: https://issues.redhat.com/browse/RHEL-111505
*)
if setfiles_has_option 'A' then List.push_back args "-A";
(* If the appliance is being run with multiple vCPUs, running setfiles (* If the appliance is being run with multiple vCPUs, running setfiles
* in multithreading mode might speed up the process. Option "-T" was * in multithreading mode might speed up the process. Option "-T" was
* introduced in SELinux userspace v3.4, and we need to check whether it's * introduced in SELinux userspace v3.4, and we need to check whether it's