mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
2809060bec
Expr tree simplification makes multiple passes at simplifying the expression tree trying to use fatoring rules and heuristics to achieve the minimum tree, so that dfa construction has fewer nodes to deal with. Unfortunately expr tree simplification can slow some policy compiles, dependent on the type of expressions generated, down, and even worse is currently subject to never terminating on some expressions as the left and right passes keep undoing each others work. Limiting the number of passes that expr tree simplification does can provide most of its benefits (later passes generally have diminishing returns), reduces the overhead it has on simple policy where it is of little benefit, and insures that simplifications can not get stuck in an infinite loop due to the left and right passes ping-ponging on each others factoring. Note: This also results in a performance improvement in evince compiles, and general policy compiles because it achieves a better balance between time spent on simplifying the tree to remove nodes and time the dfa build requires to build with extra nodes and then eliminate with minimization. $ time apparmor_parser -QT /etc/apparmor.d/usr.bin.evince real 0m2.744s user 0m2.714s sys 0m0.028s vs. $ time apparmor_parser -QT /etc/apparmor.d/usr.bin.evince real 0m2.992s user 0m2.979s sys 0m0.012s and $ time apparmor_parser -QT /etc/apparmor.d/ real 0m3.568s user 0m14.529s sys 0m0.152s vs. $ time apparmor_parser -QT /etc/apparmor.d/ real 0m3.741s user 0m15.400s sys 0m0.179s PR: https://gitlab.com/apparmor/apparmor/merge_requests/246 Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com> |
||
|---|---|---|
| .. | ||
| libapparmor_re | ||
| po | ||
| tst | ||
| aa-teardown | ||
| aa-teardown.pod | ||
| af_rule.cc | ||
| af_rule.h | ||
| af_unix.cc | ||
| af_unix.h | ||
| apparmor.d.pod | ||
| apparmor.pod | ||
| apparmor.service | ||
| apparmor.systemd | ||
| apparmor_parser.pod | ||
| common_optarg.c | ||
| common_optarg.h | ||
| COPYING.GPL | ||
| dbus.cc | ||
| dbus.h | ||
| frob_slack_rc | ||
| immunix.h | ||
| lib.c | ||
| lib.h | ||
| Makefile | ||
| mount.cc | ||
| mount.h | ||
| network.c | ||
| network.h | ||
| parser.conf | ||
| parser.h | ||
| parser_alias.c | ||
| parser_common.c | ||
| parser_include.c | ||
| parser_include.h | ||
| parser_interface.c | ||
| parser_lex.l | ||
| parser_main.c | ||
| parser_merge.c | ||
| parser_misc.c | ||
| parser_policy.c | ||
| parser_regex.c | ||
| parser_symtab.c | ||
| parser_variable.c | ||
| parser_yacc.y | ||
| policy_cache.c | ||
| policy_cache.h | ||
| policydb.h | ||
| profile.cc | ||
| profile.h | ||
| ptrace.cc | ||
| ptrace.h | ||
| rc.apparmor.debian | ||
| rc.apparmor.functions | ||
| rc.apparmor.redhat | ||
| rc.apparmor.slackware | ||
| README | ||
| README.devel | ||
| rule.cc | ||
| rule.h | ||
| signal.cc | ||
| signal.h | ||
| techdoc.tex | ||
| unit_test.h | ||
The apparmor_parser allows you to add, replace, and remove AppArmor policy through the use of command line options. The default is to add. `apparmor_parser --help` shows what the command line options are. You can also find more information at https://wiki.apparmor.net -- The AppArmor development team