setroubleshoot

#50 framework/util: optimize get_rpm_nvr_by_type by adding a cache
Closed by vmojzis. Opened by vmojzis.
vmojzis/setroubleshoot cache  into  master

Download 50.patch

The cache build could be optimized by assuming that all modules with
priority 100 are part of selinux-policy- package. This way
the cache would only have to contain types from modules of other
priorities.

Another optimization would be making the cache persistent. This way it
would only have to be rebuild on policy reload (sedispatch could trigger
cache rebuild over dbus).

My testing shows significant time save when processing multiple AVCs:
setroubleshoot-server-3.3.24-1.el8:
real 2m26.075s
user 2m17.989s
sys 0m5.916s

Cache:
real 0m15.337s
user 0m11.004s
sys 0m3.995s

But curiously, there is also a small time save for individual AVCs
(measured by forcing the cache rebuild for each call of
get_rpm_nvr_by_type):
real 1m40.393s
user 1m32.830s
sys 0m5.960s

It could be caused by processing policy modules by lines, which quickly
eliminates all lines not starting by "(type " (as opposed to comparing
the regular expression with the whole file).

Could you use os.scandir() instead of depend on behavior that os.walk() would first return the directory content? Or set explicitely topdown=True?

What if module_type_cache is None?

What if module_type_cache is None?

Right, I'll fix that.

Could you use os.scandir() instead of depend on behavior that os.walk() would first return the directory content? Or set explicitely topdown=True?

Topdown is true by default, but I can set it explicitely.
https://docs.python.org/3/library/os.html#os.walk

rebased onto 6fbf777bc59c005e04d4616b9aebeb7c7f0866c0

:thumbsup: feel free to merge

Thanks, merged.

Pull-Request has been closed by vmojzis
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.