I mentioned this to Marcus via irc yesterday and I think it is useful
context (leaving out parts that John already mentioned):

"07:48 <marcustomlinson> so question: when we have that slow boot, what screen 
is everyone left on to wait
07:48 <marcustomlinson> blank? spinning ubuntu icom
07:49 <jdstrand> blank
07:49 <jdstrand> it is after the image is flashed and is comin up. there is no 
feedback
...
07:54 <marcustomlinson> I think we can hold back on Michi's MP as worst case 
scenario
...
07:55 <jdstrand> basically, the way it is all framed is that these sorts of 
updates should typically only happen when jumping base releases, since a policy 
recompile has to happen anyway
07:55 <jdstrand> so, vivid to xenial
07:55 <jdstrand> I can push this change into xenial no problem
07:55 <jdstrand> then whenever that ota comes out, it is there
07:55 <marcustomlinson> ah ok
07:55 <jdstrand> but we try to reduce the pain of interim updates
07:56 <jdstrand> we don't want every ota to have a slow boot
07:56 <marcustomlinson> do you see these updates as that rarely required?
07:56 <jdstrand> but it is possible to batch them or make a decision that this 
is important enough to make everyone wait
07:56 <jdstrand> yes
07:56 <jdstrand> we've maybe only had to recompile all policy once since vivid 
base
...
07:57 <jdstrand> we do make other profile changes, but that might be in say, 
the calendar policy
07:57 <jdstrand> the calendar policy is only used by a few apps-- so no big deal
...
07:57 <jdstrand> but something that affects all scopes is a different thing
07:58 <marcustomlinson> ok, thanks for the info!
07:58 <jdstrand> np
07:58 <jdstrand> if you are interested in the nitty gritty details, do see the 
apparmor bug
07:58 <marcustomlinson> will do
07:59 <jdstrand> it should be noted that since that bug has been filed, we have 
made many policy compile improvements
07:59 <jdstrand> but the problem can never go away
07:59 <jdstrand> it was at 2.5 seconds
07:59 <jdstrand> per profile
08:00 <jdstrand> I think we are under 1.5 now
08:00 <marcustomlinson> nice
08:00 <jdstrand> but even if we got it to 1, if you have 200 apps installed, 
that is almost 3.5 minutes of waiting
08:00 <marcustomlinson> like I said, I think we actually "make this go away" by 
showing people a progress bar or something
...
08:00 <jdstrand> I agree. the pieces are there on click. something different 
would have to be done for snappy
"

In a nutshell, John has done some amazing stuff already with policy
compile times, and more improvements will come and in fact, we are
already considerably faster than IOS (aiui) and Android's app update
process after reboot even with full policy recompiles, but the problem
is we don't give people any feedback what is happening (I discuss ways
for unity/the platform to deal with this above). Do keep in mind that
because of the sheer volume of apps that can be installed on a phone and
because the compile time won't ever be '0', we will always want to be
judicious about policy updates that affect all apps-- that's where
visual feedback can help.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1350598

Title:
  AppArmor policy compile improvements

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1350598/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to