Comment 8 for bug 1499544

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

To expand on comment #6, this is a comment from the review tools:
        # There are quite a few kernel interfaces that can cause problems with
        # long profile names. These are outlined in
        # https://launchpad.net/bugs/1499544. The big issue is that the audit
        # message must fit within PAGE_SIZE (at least 4096 on supported archs),
        # so long names could push the audit message to be too big, which would
        # result in a denial for that rule (but, only if the rule would've
        # allowed it). Giving a hard-error on maxlen since we know that this
        # will be a problem. The advisory length is what it is since we know
        # that compound labels are sometimes logged and so a snappy system
        # running an app in a snappy container or a QA testbed running apps
        # under LXC
        maxlen = 230 # 245 minus a bit for child profiles
        advlen = 100

maxlen gives an error and advlen a warning in the review tools. There is a corresponding error message to explain how to shorten and in the case of advlen, briefly why. Importantly, exceeding advlen will cause the app to not pass automated reviews so people will be motivated to keep it under this.

We aren't in a position to redefine the APP_ID for snappy and click now, but considering these changes to the review tools, we should be fine when stacking is implemented for the most common scenarios (apps in global namespace, apps running in a container on LXD on snappy or apps running in a container in a QA container test environment).

After evaluating the stacking work and its implications on profile name lengths, we can determine if we should do more than the above (eg, adjusting logging in the kernel, adjusting the APP_ID, etc, etc).