Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Hi I am new to the SELINUX and I have noticed the command setsebool take longer time than other linux commands. Such as:

setsebool -P ftp_home_dir ON

Out of curiosity I want to know why "setsebool" command needs such a long time to complete the task?

share|improve this question
1  
time setsebool -P ftp_home_dir ON. How long do you consider a long time? –  jordanm Mar 13 '13 at 5:05
    
tried the command as above and "real" time is about 30 sec. Usually a normal linux command time setenforce 0will give about 0.011 sec "real" time. I feel 30 sec is a bit long and wondering what is happening at the backend? –  Xianlin Mar 13 '13 at 8:59
    
strace -f setsebool -P ftp_home_dir ON and see where exactly it's taking its sweet time. –  Flup Mar 13 '13 at 15:14
    
I think I need more programming knowledge to understand the strace output..I guess it is because selinux involves too many "deep" level changes on the linux system and that is why it takes so much time to complete one command. –  Xianlin Mar 15 '13 at 7:15
    
Does SELinux need to re-compile it's rules when you make a change? I thought I recall reading that somewhere. –  hyphen this Aug 17 '13 at 14:21
add comment

1 Answer

The reason it is so slow is because it is performing a full compile of the policy when you run the command. (See this BZ: https://bugzilla.redhat.com/show_bug.cgi?id=811656, Dan Walsh is one of the maintainers of the SELinux policy on RHEL and Fedora). It has been fixed in later versions of Fedora, which means it'll probably end up fixed in EL7 and possibly in later releases of EL6.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.