I am thinking of adding compression to libselinux
Daniel J Walsh
dwalsh at redhat.com
Thu Sep 12 12:16:32 UTC 2013
-----BEGIN PGP SIGNED MESSAGE-----
On 09/12/2013 08:11 AM, Lennart Poettering wrote:
> On Thu, 12.09.13 07:53, Daniel J Walsh (dwalsh at redhat.com) wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> Basically looking at compressing the policy file to shrink SELinux
>> footprint in the minimal install/cloud image.
>> Currently the policy modules (pp files) are shipped with bzip compression
>> but the actually policy file.
>> But the /etc/selinux/targeted/policy/policy.29 is not compressed.
>> systemd and load_policy use libselinux to read in the policy file and
>> load it into the kernel, so since systemd currently uses libxz, I figured
>> this would be the best solution to add libxz support to libselinux.
>> ls -l /etc/selinux/targeted/policy/policy.29* - -rw-r--r--. 1 root root
>> 2703245 Sep 11 13:56 /etc/selinux/targeted/policy/policy.29 - -rw-r--r--.
>> 1 root root 395072 Sep 11 13:56
>> Worth the effort?
> Well, you might buy smaller footprint with slower boot time, but I figure
> without trying it there's no way to know that for sure.
> (That said, our minimal image is a couple of 100mb still, iirc, so 2mb is
> not thaaaat much.)
>> Should I use a different algorithm?
>> Advise on using libxz? Keep memory small?
> I think nowadays it's either gzip or xz, and everything else is not
> interesting, as the others either are slower or compress worses, and most
> importantly: libgz/liblzma are deps of the core OS anyway and included in
> the minimal image anyway and are also already mapped into memory, so come
> basically free.
Well I will need to support both compressed and uncompressed versions, so I
guess I could set up the tooling to create either based on config.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
-----END PGP SIGNATURE-----
More information about the devel