apparmor_parser -O no-expr-simplify problematic
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
snapd |
Fix Released
|
Critical
|
Unassigned |
Bug Description
There was a recent issue with a core refresh that caused breakage. Upon further investigation it turns out that the apparmor_parser uses an substantial of memory.
Upon some more investigation it turns out that that -O no-expr-simplify makes both time to compile and memory usage increase 10x. Tested with 22.04 but I see the same ballpark results with 16.04:
$ /usr/bin/time --verbose apparmor_parser -S 2.59/profiles/
Command being timed: "apparmor_parser -S 2.59/profiles/
User time (seconds): 4.32
Maximum resident set size (kbytes): 117392
$ /usr/bin/time --verbose apparmor_parser -O no-expr-simplify -S 2.59/profiles/
Command being timed: "apparmor_parser -O no-expr-simplify -S 2.59/profiles/
User time (seconds): 40.64
Maximum resident set size (kbytes): 1015816
Profile is attached.
It seems like we seriously need to consider dropping "-O no-expr-simplify".
For context:
https:/
is why it was added in the first place
And some recent work to make things faster:
https:/
information type: | Private → Public |
Changed in snapd: | |
status: | New → In Progress |
Changed in snapd: | |
status: | In Progress → Fix Released |
importance: | Undecided → Critical |
Just another data point, it seems some expressions are quite pathological, e.g. removing
/sys/devices/ {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/config r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/revision r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/resource r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/irq r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/boot_ vga r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/{,subsystem_ }class r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/{,subsystem_ }device r, {,*pcie- controller/ ,platform/ {soc,scb} /*.pcie/ }pci[0- 9a-f]*/ **/{,subsystem_ }vendor r, **/drm{ ,_dp_aux_ dev}/** r,
/sys/devices/
/sys/devices/
/sys/devices/
/sys/devices/
/sys/devices/
/sys/devices/
/sys/devices/
/sys/devices/
makes the profile generation go down from 44s -> 10s so it seems some specific lines are most likly causing this issue.