On building a smaller 'strict' policy.

[Valdis.Kletnieks at vt.edu]

OK, so I finally got fed up with having the 'strict' policy take up
4,821 or so *pages* of slab entries for avc_node, and decided to see how
much I could pare it down.  Moving stuff I didn't actually have or use
from domains/program/foo.te into unused/foo.te more or less worked, and
only using up 2,230 pages of slab (a noticable difference on a 256M laptop).

Nits:  In an effort to minimize the size even *more*, I tried nuking the
corresponding macros/program/foo_macros.te files, since much of the bulk of
the policy.conf is created by FOO_macros.te expanding a whole bunch of
USER_FOO_t for all user types (cdrecord chunks out some 100 per role, as
near as I can tell).

The resmgrd, kerberos, and ypbind entries in macros/programs end up getting
referenced in ways that fail gloriously when you try to build policy, so
obviously, wholesale skipping over macros the way the .tc files get skipped
over for unused .te isn't going to work.  Fortunately, the four I had problems
with are defined in such a way that there's little real growth in the policy
because they're wrapped in a "ifdef(`foo.te')"

Would it be a Good Idea to be more agressive in wrapping the other FOO_macros.te
with such an ifdef?  Or does this become a *total* non-issue with the soon-to-arrive
'loadable policy module' stuff?

For what it's worth:

[/etc/selinux/strict/src/policy]3 egrep -v '^#|^$' policy.conf | wc
  28831  218148 1768137

A major savings. ;)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-selinux-list/attachments/20050529/1bc6f11b/attachment.sig>