On 10/22/2013 03:39 PM, Michael Orlitzky wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/22/2013 03:08 PM, Allan Wegan wrote:
When you emerge something with a bazillion files, the install
wrapper (and thus the python interpreter) get launched that many
times. It's the startup time that kills it.
Should that PAX markings not only be neccessary for a few
hand-selected binaries that refuse to work with secure-by-default
settings? I remember setting PAX-markings by hand (a year or so
ago) for a few binaries that would else crash with Grsec loglines.
I did not had the impression, that there are much of them (that
where mostly games, i admit).
Yes, and it should be possible to "write down" which binaries got
pax-marked, and only use the python install wrapper for those
particular files.
But, there is an underlying problem that it would be nice to solve at
the same time. It should be possible to set any sort of xattrs (not
just PAX!) in an ebuild and have them correctly copied to the live
filesystem during an emerge.
My motivation here was beyond just user.pax.flags. Right now the
install.py wrapper only does XT_PAX flags, ie the user.pax.flags
namespace, but it should be able to do any extended attribute namespace.
I'm trying to pave the way for full end-to-end extended attribute support.
For this to work, we have to handle the
case where a developer (or an upstream makefile) calls setfattr
manually on some files. When FEATURES="xattr" is set, portage uses the
wrapper to install /every/ file, ostensibly for this case.
I know, that's the real catch-22 here. The wrapper can't even decide if
it even needs to run unless it runs. Which means python has already
been invoked with all its overhead.
I'm not sure how to trap this within portage itself. There is a
pre-wrapper wrapper at
/usr/lib/portage/bin/ebuild-helpers/xattr/install
which is a bash script. Maybe I can trap it there and shave some time
off the python wrapper running. Else, I'll just have to rewrite
install.py in C.
The other way to handle it would be to check whether or not some file
has xattrs, and use the regular 'install' if it doesn't. But how do
you implement that? You'd either have to hack portage, or write some
sort of wrapper...
How *do* you implement that? it would solve the above catch-22.
There's already a hack in portage to support xattrs, so maybe that
would work, who knows. I'm in over my head here.
Portage has to preserve xattrs at lots of points. The previous work
just preserved xattrs in copying from $D to $ROOT (ie during qmerge when
the stuff in /var/tmp/portage/.../image is copied to the actual file
system). What I added was to preserve xattrs when doing install, ie
when installing from $S into $D. The problem there is that coreutils'
install does NOT preserve xattrs and does not even have a flag to turn
on the preserving of xattrs :( To top it off, we have to selectively
decide which xattr namespaces to preserve and which not to because
selinux labels were not to be copied. I could produce a patch but
core-system was leary of changing the default behavior of install. The
*obvious* solution was to write a python wrapper ... little did we know
how slow it would be! I don't feel so bad because I bounced this off of
others and no one suspected it either :(
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.20 (GNU/Linux)
iQIcBAEBAgAGBQJSZtRsAAoJEBxJck0inpOiz7AQAJIW8wrNorRl8YOjAOlTpoq/
rerZ2IIpyYYg6uB9fotEcJYtmiinClX4Yf3crl2tyqLZLlQJUFrIM+A90LdNAdXY
wYbf5R9HpMxhNsTVKb4sP/ErZzktVOf26kyjzPlql+P/ICk0NYO+YgAswJI4b5L9
trVuraFPwPQGEDDEq5Ep8+9Mm6rBgAj95HlZHIChKVR0zB7jKL372z3QemeFS1sO
Hc7YDZvlwb1U9Ab/EK7qy1aqTZg6Zrzn/wslyZo+tpnJ+aCJENXGDXWh678LDDTP
BnKXsTjNkMXs+fmRfkL2ivIJNs8dYIlcTZ4rBotdBgXQ+fusRuyKXQe3CbyjMzjV
7V8s+aMj31QN29MbQ33zDIEdDyuhulXv4SpxZQfYyRn7ZBdmz2AxSABySQA7DzvJ
OVwe6jRd7Zm272STBj0Agnf2ct6F0KRsC+gPl2COY9y+sV90BzquCsDYB4Z6ybX4
6Ttl/oAxVYjWZNu669TFxeiiga0FhjLVOTvaCJdXrva97iZsssjJFPJcCVSx/IKQ
gu2WbZDX5yx0/TYNRIrqZ8MDB49sCMSLktvjJoOoEydaBDCv6X3y+zvVuR/OCElV
DHdNRi25shztbQTZamgQdQLKOluTEPZ4gkAKH5jUHrg70cfQMG1HXMZFqC64aSi8
lUkJE3WYhuXJX9S6RvDE
=G/D/
-----END PGP SIGNATURE-----
--
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197
