fix: uniqMcs use all cpu#246
Conversation
ningmingxiao
requested review from
cyphar,
kolyshkin,
mrunalp,
rhatdan,
runcom and
thaJeztah
as code owners
ningmingxiao
force-pushed
the
dev03
branch
4 times, most recently
from
931123f to
c28240d
Compare
ningmingxiao
force-pushed
the
dev03
branch
2 times, most recently
from
d083957 to
4567cb2
Compare
|
LGTM |
kolyshkin
left a comment
kolyshkin
left a comment
There was a problem hiding this comment.
Maybe we need to change the public API to add error reporting to, say, selinux.ContainerLabels (and similar functions using addMcs/uniqMcs)?
Keep the old functions for backward compatibility but deprecate those?
I afraid user have to adapt to the new interface and we can't let user know old interface is deprecate. @kolyshkin |
|
Needs a rebase. @ningmingxiao still working on this one? |
ningmingxiao
force-pushed
the
dev03
branch
2 times, most recently
from
c63efca to
a76e7fe
Compare
|
done thanks @rhatdan |
kolyshkin
left a comment
kolyshkin
left a comment
There was a problem hiding this comment.
So, what we need to do here is move selinux.ContainerLabels (and selinux.ContainerLabelsSize) into an internal package. It looks like no one is using selinux.ContainerLabels -- the only user is `label.InitLabels. Means we can move it to internal and then do whatever we want to. See #247 (comment) for details.
ningmingxiao
force-pushed
the
dev03
branch
10 times, most recently
from
ae0f8db to
936fe01
Compare
|
done @kolyshkin |
ningmingxiao
force-pushed
the
dev03
branch
11 times, most recently
from
fed9a1b to
946445b
Compare
| if i == 19 { | ||
| if err == nil { | ||
| t.Fatal("err should not be nil") | ||
| } else if !strings.Contains(err.Error(), "SELinux label exhaustion") { |
There was a problem hiding this comment.
Should you do if !errors.Is(err, ErrMCSExhausted)?
| xattrNameSelinux = "security.selinux" | ||
| ) | ||
|
|
||
| var maxSelinuxLabelSize = int(CategoryRange * (CategoryRange - 1) / 2) |
There was a problem hiding this comment.
Alas, CategoryRange can be (and is) changed by any other package.
I'm fixing this issue in #262 by introducing SetCategoryRange and deprecating CategoryRange.
There was a problem hiding this comment.
you can merge 262 into main I will rebase it @kolyshkin
| // ReserveLabel reserves the MLS/MCS level component of the specified label | ||
| // | ||
| // Deprecated: Use ReserveLabelV2 instead. | ||
| func ReserveLabel(label string) { |
There was a problem hiding this comment.
Do we have any external users?
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
3 participants
fix #247