Something went wrong on our end
Select Git revision
-
Nick Kralevich authoredOn boot, Android runs restorecon on a number of virtual directories, such as /sys and /sys/kernel/debug, to ensure that the SELinux labels are correct. To avoid causing excessive boot time delays, the restorecon code aggressively prunes directories, to avoid recursing down directory trees which will never have a matching SELinux label. See: * https://android-review.googlesource.com/93401 * https://android-review.googlesource.com/109103 The key to this optimization is avoiding unnecessarily broad regular expressions in file_contexts. If an overly broad regex exists, the tree pruning code is ineffective, and the restorecon ends up visiting lots of unnecessary directories. The directory /sys/kernel/debug/tracing contains approximately 4500 files normally, and on debuggable builds, this number can jump to over 9000 files when the processing from wifi-events.rc occurs. For comparison, the entire /sys/kernel/debug tree (excluding /sys/kernel/debug/tracing) only contains approximately 8000 files. The regular expression "/sys/kernel(/debug)?/tracing/(.*)?" ends up matching a significant number of files, which impacts boot performance. Instead of using an overly broad regex, refine the regex so only the files needed have an entry in file_contexts. This list of files is essentially a duplicate of the entries in frameworks/native/cmds/atrace/atrace.rc . This change reduces the restorecon_recursive call for /sys/kernel/debug from approximately 260ms to 40ms, a boot time reduction of approximately 220ms. Bug: 35248779 Test: device boots, no SELinux denials, faster boot. Change-Id: I70f8af102762ec0180546b05fcf014c097135f3e
Nick Kralevich authoredOn boot, Android runs restorecon on a number of virtual directories, such as /sys and /sys/kernel/debug, to ensure that the SELinux labels are correct. To avoid causing excessive boot time delays, the restorecon code aggressively prunes directories, to avoid recursing down directory trees which will never have a matching SELinux label. See: * https://android-review.googlesource.com/93401 * https://android-review.googlesource.com/109103 The key to this optimization is avoiding unnecessarily broad regular expressions in file_contexts. If an overly broad regex exists, the tree pruning code is ineffective, and the restorecon ends up visiting lots of unnecessary directories. The directory /sys/kernel/debug/tracing contains approximately 4500 files normally, and on debuggable builds, this number can jump to over 9000 files when the processing from wifi-events.rc occurs. For comparison, the entire /sys/kernel/debug tree (excluding /sys/kernel/debug/tracing) only contains approximately 8000 files. The regular expression "/sys/kernel(/debug)?/tracing/(.*)?" ends up matching a significant number of files, which impacts boot performance. Instead of using an overly broad regex, refine the regex so only the files needed have an entry in file_contexts. This list of files is essentially a duplicate of the entries in frameworks/native/cmds/atrace/atrace.rc . This change reduces the restorecon_recursive call for /sys/kernel/debug from approximately 260ms to 40ms, a boot time reduction of approximately 220ms. Bug: 35248779 Test: device boots, no SELinux denials, faster boot. Change-Id: I70f8af102762ec0180546b05fcf014c097135f3e
file.te 10.97 KiB
# Filesystem types
type labeledfs, fs_type;
type pipefs, fs_type;
type sockfs, fs_type;
type rootfs, fs_type;
type proc, fs_type;
# Security-sensitive proc nodes that should not be writable to most.
type proc_security, fs_type;
type proc_drop_caches, fs_type;
type proc_overcommit_memory, fs_type;
# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
type usermodehelper, fs_type, sysfs_type;
type qtaguid_proc, fs_type, mlstrustedobject;
type proc_bluetooth_writable, fs_type;
type proc_cpuinfo, fs_type;
type proc_interrupts, fs_type;
type proc_iomem, fs_type;
type proc_meminfo, fs_type;
type proc_net, fs_type;
type proc_stat, fs_type;
type proc_sysrq, fs_type;
type proc_timer, fs_type;
type proc_tty_drivers, fs_type;
type proc_uid_cputime_showstat, fs_type;
type proc_uid_cputime_removeuid, fs_type;
type proc_uid_io_stats, fs_type;
type proc_uid_procstat_set, fs_type;
type proc_zoneinfo, fs_type;
type selinuxfs, fs_type, mlstrustedobject;
type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, sysfs_type, mlstrustedobject;
type sysfs_uio, sysfs_type, fs_type;
type sysfs_batteryinfo, fs_type, sysfs_type;
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
type sysfs_leds, fs_type, sysfs_type;
type sysfs_hwrandom, fs_type, sysfs_type;
type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
type sysfs_wake_lock, fs_type, sysfs_type;
type sysfs_mac_address, fs_type, sysfs_type;
type sysfs_usb, sysfs_type, file_type, mlstrustedobject;
type configfs, fs_type;
# /sys/devices/system/cpu
type sysfs_devices_system_cpu, fs_type, sysfs_type;
# /sys/module/lowmemorykiller
type sysfs_lowmemorykiller, fs_type, sysfs_type;
# /sys/module/wlan/parameters/fwpath
type sysfs_wlan_fwpath, fs_type, sysfs_type;
type sysfs_vibrator, fs_type, sysfs_type;
type sysfs_thermal, sysfs_type, fs_type;
type sysfs_zram, fs_type, sysfs_type;
type sysfs_zram_uevent, fs_type, sysfs_type;
type inotify, fs_type, mlstrustedobject;
type devpts, fs_type, mlstrustedobject;
type tmpfs, fs_type;
type shm, fs_type;
type mqueue, fs_type;
type fuse, sdcard_type, fs_type, mlstrustedobject;
type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
type vfat, sdcard_type, fs_type, mlstrustedobject;
type debugfs, fs_type;
type debugfs_mmc, fs_type, debugfs_type;
type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
type debugfs_tracing, fs_type, debugfs_type;
type debugfs_tracing_instances, fs_type, debugfs_type;
type debugfs_wifi_tracing, fs_type, debugfs_type;
type tracing_shell_writable, fs_type, debugfs_type;
type pstorefs, fs_type;
type functionfs, fs_type, mlstrustedobject;