Comment 9 for bug 1830502

Revision history for this message
John Johansen (jjohansen) wrote : Re: apparmor fails to start with no parser errors

So yes that does appear to be part of it. I pulled your profile and tested just a compile

time apparmor_parser -QT -D dfa-stats /tmp/layouts-test-1.txt

Created dfa: states 16780 proto { cache: size=16780 dups=36386 longest=1244 avg=6 }, nnodes { cache: size=16761 dups=36405 longest=1243 avg=5 }, anodes { cache: size=11 dups=35437 longest=2 avg=1 }
Minimized dfa: final partitions 699 (accept 73) init 8 (accept 7)
Created dfa: states 34473 proto { cache: size=34473 dups=21674 longest=598 avg=7 }, nnodes { cache: size=34468 dups=21679 longest=598 avg=7 }, anodes { cache: size=6 dups=4992 longest=2 avg=1 }
Minimized dfa: final partitions 27273 (accept 2095) init 4 (accept 3)

real 0m27.084s
user 0m26.735s
sys 0m0.348s

which is quite slow, but can happen for big profiles. With Valgrind --tool=massif reporting a peak heap usage of 884.5MB

However Ubuntu defaults to using -O no-expr-simplify because it can speed up small profiles. With that I get

time apparmor_parser -QT -D dfa-stats -O no-expr-simplify /tmp/layouts-test-1.txt

Created dfa: states 40915 proto { cache: size=40915 dups=83997 longest=4870 avg=9 }, nnodes { cache: size=40633 dups=84279 longest=4869 avg=8 }, anodes { cache: size=11 dups=82787 longest=2 avg=1 }
Minimized dfa: final partitions 699 (accept 73) init 8 (accept 7)
Created dfa: states 44769 proto { cache: size=44769 dups=28309 longest=33583 avg=226 }, nnodes { cache: size=44495 dups=28583 longest=33583 avg=226 }, anodes { cache: size=6 dups=8500 longest=2 avg=1 }
Minimized dfa: final partitions 27273 (accept 2095) init 4 (accept 3)

real 0m45.947s
user 0m39.770s
sys 0m6.166s

with valgrind --tool=massif reporting a peak usage of 15.4 GB

ouch

and that isn't the worst of it, because the initscripts run multiple compiles in parallel. Mind you most compiles only take a few MB, but still all of that happening at the same time puts a lot of pressure on the system.