| 2014-10-21 19:10:07 |
Jamie Strandboge |
bug |
|
|
added bug |
| 2014-10-21 19:10:21 |
Jamie Strandboge |
bug task added |
|
click-apparmor (Ubuntu) |
|
| 2014-10-21 19:10:44 |
Jamie Strandboge |
apparmor (Ubuntu): status |
New |
Triaged |
|
| 2014-10-21 19:10:47 |
Jamie Strandboge |
click-apparmor (Ubuntu): status |
New |
Triaged |
|
| 2014-10-21 19:10:51 |
Jamie Strandboge |
apparmor (Ubuntu): importance |
Undecided |
High |
|
| 2014-10-21 19:10:54 |
Jamie Strandboge |
click-apparmor (Ubuntu): importance |
Undecided |
High |
|
| 2014-10-21 19:47:25 |
Jamie Strandboge |
summary |
use 'no-expr-simplify' parser option for clicks |
improve click apparmor policy times by using 'no-expr-simplify' parser option for click policy |
|
| 2014-10-21 19:47:27 |
Jamie Strandboge |
apparmor (Ubuntu): importance |
High |
Critical |
|
| 2014-10-21 19:47:29 |
Jamie Strandboge |
click-apparmor (Ubuntu): importance |
High |
Critical |
|
| 2014-10-21 19:47:31 |
Jamie Strandboge |
click-apparmor (Ubuntu): assignee |
|
Jamie Strandboge (jdstrand) |
|
| 2014-10-21 19:47:33 |
Jamie Strandboge |
apparmor (Ubuntu): assignee |
|
Jamie Strandboge (jdstrand) |
|
| 2014-10-21 19:47:41 |
Jamie Strandboge |
tags |
|
rtm14 |
|
| 2014-10-21 19:48:57 |
Jamie Strandboge |
description |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44%.
The proper fix is to adjust expr tree simplification to not be more efficient, however, in the short term we can adjust the apparmor upstart job to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor. |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44%.
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option. |
|
| 2014-10-21 20:18:06 |
Jamie Strandboge |
description |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44%.
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option. |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor. |
|
| 2014-10-21 20:19:47 |
Jamie Strandboge |
description |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor. |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
|
| 2014-10-21 20:20:32 |
Jamie Strandboge |
summary |
improve click apparmor policy times by using 'no-expr-simplify' parser option for click policy |
expr-simplify optimization slows click policy compilation |
|
| 2014-10-21 20:20:42 |
Jamie Strandboge |
bug task added |
|
apparmor |
|
| 2014-10-21 20:20:59 |
Jamie Strandboge |
apparmor: status |
New |
Triaged |
|
| 2014-10-21 20:21:02 |
Jamie Strandboge |
apparmor: importance |
Undecided |
Medium |
|
| 2014-10-22 15:09:20 |
Jamie Strandboge |
description |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
On Krillin, the difference is even more substantial: 636 vs 233 seconds (63%).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
|
| 2014-10-22 15:36:57 |
Jamie Strandboge |
affects |
apparmor (Ubuntu) |
apparmor (Ubuntu RTM) |
|
| 2014-10-22 15:37:22 |
Jamie Strandboge |
affects |
click-apparmor (Ubuntu) |
click-apparmor (Ubuntu RTM) |
|
| 2014-10-22 15:37:22 |
Jamie Strandboge |
click-apparmor (Ubuntu RTM): status |
Triaged |
In Progress |
|
| 2014-10-22 15:37:31 |
Jamie Strandboge |
apparmor (Ubuntu RTM): status |
Triaged |
In Progress |
|
| 2014-10-22 15:37:44 |
Jamie Strandboge |
bug task added |
|
apparmor (Ubuntu) |
|
| 2014-10-22 15:37:57 |
Jamie Strandboge |
bug task added |
|
click-apparmor (Ubuntu) |
|
| 2014-10-22 15:38:12 |
Jamie Strandboge |
apparmor (Ubuntu): milestone |
|
ubuntu-15.01 |
|
| 2014-10-22 15:38:19 |
Jamie Strandboge |
click-apparmor (Ubuntu): milestone |
|
ubuntu-15.01 |
|
| 2014-10-22 15:38:24 |
Jamie Strandboge |
click-apparmor (Ubuntu): status |
New |
Triaged |
|
| 2014-10-22 15:38:27 |
Jamie Strandboge |
apparmor (Ubuntu): status |
New |
Triaged |
|
| 2014-10-22 15:38:31 |
Jamie Strandboge |
click-apparmor (Ubuntu): importance |
Undecided |
Medium |
|
| 2014-10-22 15:38:33 |
Jamie Strandboge |
apparmor (Ubuntu): importance |
Undecided |
Medium |
|
| 2014-10-22 15:38:40 |
Jamie Strandboge |
click-apparmor (Ubuntu): assignee |
|
Jamie Strandboge (jdstrand) |
|
| 2014-10-22 15:38:43 |
Jamie Strandboge |
apparmor (Ubuntu): assignee |
|
Jamie Strandboge (jdstrand) |
|
| 2014-10-22 15:38:54 |
Jamie Strandboge |
tags |
rtm14 |
application-confinement rtm14 |
|
| 2014-10-22 16:03:23 |
Jamie Strandboge |
branch linked |
|
lp:~jdstrand/click-apparmor/lp1383858 |
|
| 2014-10-22 19:07:34 |
Launchpad Janitor |
branch linked |
|
lp:ubuntu/utopic-proposed/click-apparmor |
|
| 2014-10-22 19:42:42 |
Launchpad Janitor |
click-apparmor (Ubuntu): status |
Triaged |
Fix Released |
|
| 2014-10-22 19:52:02 |
Jamie Strandboge |
click-apparmor (Ubuntu): milestone |
ubuntu-15.01 |
lucid-updates |
|
| 2014-10-22 19:52:11 |
Jamie Strandboge |
click-apparmor (Ubuntu): milestone |
lucid-updates |
ubuntu-14.10 |
|
| 2014-10-23 17:54:13 |
Jamie Strandboge |
tags |
application-confinement rtm14 |
aa-parser application-confinement rtm14 |
|
| 2014-10-26 19:42:59 |
Jamie Strandboge |
description |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
On Krillin, the difference is even more substantial: 636 vs 233 seconds (63%).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
On Krillin, the difference is even more substantial: 636 vs 233 seconds (63%).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
5. run 'sudo start apparmor' and make sure it finishes in a few seconds
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
|
| 2014-10-28 15:12:27 |
Jamie Strandboge |
tags |
aa-parser application-confinement rtm14 |
aa-parser application-confinement rtm14 touch-2014-10-30 |
|
| 2014-10-28 20:42:32 |
Jamie Strandboge |
attachment added |
|
apparmor_2.8.96~2652-0ubuntu5.3.debdiff https://bugs.launchpad.net/ubuntu-rtm/+source/apparmor/+bug/1383858/+attachment/4247539/+files/apparmor_2.8.96%7E2652-0ubuntu5.3.debdiff |
|
| 2014-10-28 23:37:47 |
Jamie Strandboge |
apparmor (Ubuntu): status |
Triaged |
Fix Committed |
|
| 2014-10-29 00:29:30 |
Ubuntu Foundations Team Bug Bot |
tags |
aa-parser application-confinement rtm14 touch-2014-10-30 |
aa-parser application-confinement patch rtm14 touch-2014-10-30 |
|
| 2014-10-29 00:54:59 |
Launchpad Janitor |
apparmor (Ubuntu): status |
Fix Committed |
Fix Released |
|
| 2014-10-29 02:19:18 |
Jamie Strandboge |
description |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
On Krillin, the difference is even more substantial: 636 vs 233 seconds (63%).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
5. run 'sudo start apparmor' and make sure it finishes in a few seconds
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
AppArmor has several optimization options that can be used to help speed up policy compiles for certain types of policy. Currently, we are using expr tree simplification option by default, which has dramatic affects on policy compiles for the evince profile. However, with click profiles not using expr tree simplification (ie, adding the '-O no-expr-simplify' option) can improve click policy generation by 44% (375 vs 210 seconds).
On Krillin, the difference is even more substantial: 636 vs 233 seconds (63%).
Short term for rtm is to to use '-O no-expr-simplify' when compiling policy in /var/lib/apparmor/profiles but leave /etc/apparmor.d alone. We can do the same with click-apparmor. Note: the fix for bug #1385947 must be included with this fix.
The long term fix is to adjust expr tree simplification to be more efficient (at least as fast as without) and drop the '-O no-expr-simplify' option.
Justification: apparmor policy recompilation is not expected to happen as part of the normal user experience (see bug #1350598 for a lot of detail) and it is expected to only happen on upgrades from 14.10 to 15.04 or to fix very serious apparmor or apparmor policy bugs. None of these bugs are currently scheduled for OTA. However, *if* we ever need to fix one of these, policy will have to be recompiled.
Choices:
1. do nothing for RTM since policy recompiles are expected to be rare, but do apply this change to 15.04. Policy is expected to be recompiled on upgrades to 15.04 and upgrades would use the new option
2. apply this change in OTA. This is problematic because this change alone will trigger a policy recompilation that would not otherwise be needed. Optionally, this change could accompany a severe bug fix
Risk:
The change consists of a small modification to the apparmor upstart job and a change to the arguments click-apparmor gives to apparmor_parser. The risk assessment is considered low because of the size of the change and the simple test case will immediately indicate if either were applied incorrectly.
Test case:
1. run aa-status | wc -l and note the result
2. install the new apparmor and click-apparmor packages and verify there are no errors during installation
3. reboot
4. run aa-status | wc -l and compare to '1'
5. run 'sudo start apparmor' and make sure it finishes in a few seconds
If they are the same, it indicates the upstart job is properly loading the profiles generated by click apparmor.
While these changes may occur separately, landing them at the same time along with a regenerated custom tarball (for preinstalled policy) will reduce policy recompiles. |
|
| 2014-10-29 14:46:30 |
Launchpad Janitor |
apparmor (Ubuntu RTM): status |
In Progress |
Fix Released |
|
| 2014-10-29 14:52:11 |
Launchpad Janitor |
click-apparmor (Ubuntu RTM): status |
In Progress |
Fix Released |
|
| 2014-10-30 01:50:15 |
Launchpad Janitor |
branch linked |
|
lp:ubuntu/apparmor |
|
| 2018-11-13 13:33:16 |
Jamie Strandboge |
summary |
expr-simplify optimization slows click policy compilation |
expr-simplify optimization slows click/snap policy compilation |
|
| 2019-10-22 20:43:21 |
Ivan Baldo |
bug |
|
|
added subscriber Ivan Baldo |
| 2021-02-15 19:14:46 |
Alfonso Sanchez-Beato |
bug |
|
|
added subscriber Alfonso Sanchez-Beato |
