| 1 |
On Tue, 31 Jul 2012 15:16:34 -0400 |
| 2 |
Rich Freeman <rich0@g.o> wrote: |
| 3 |
|
| 4 |
> On Tue, Jul 31, 2012 at 10:56 AM, Ian Stakenvicius <axs@g.o> |
| 5 |
> wrote: |
| 6 |
> > |
| 7 |
> > Although that is true, it would be -WAY- too slow to generate said |
| 8 |
> > list via equery/q* helpers; I think that's where the |
| 9 |
> > extended-attributes and/or cache idea comes into play. |
| 10 |
> |
| 11 |
> I agree. This needs to be high-performance when it comes to |
| 12 |
> individual file access. If it takes 10 seconds per build to populate |
| 13 |
> some database or set up a bazillion bind mounts that isn't the end of |
| 14 |
> the world, but if it takes an extra 0.1 seconds every time a file is |
| 15 |
> read that could add up VERY fast on a large build. |
| 16 |
|
| 17 |
I'd be more afraid about resources, and whether the kernel will be |
| 18 |
actually able to handle bazillion bind mounts. And if, whether it won't |
| 19 |
actually cause more overhead than copying the whole system to some kind |
| 20 |
of tmpfs. |
| 21 |
|
| 22 |
> |
| 23 |
> Ideally I'd like to see the same thing extended to run-time, and short |
| 24 |
> of writing some entirely new security model into the kernel or taking |
| 25 |
> namespaces to a whole new level, part of me thinks that |
| 26 |
> auto-generating SELinux policies might be the solution, so that the |
| 27 |
> existing mechanism can be extended. |
| 28 |
> |
| 29 |
> The mad scientist in me keeps thinking up crazy schemes so that |
| 30 |
> package collisions can be handled by each package just seeing whatever |
| 31 |
> it wants to see - maybe the entire filesystem looks different |
| 32 |
> depending on what app you use. Then I realize that bash is an |
| 33 |
> application, and how on earth would a human make sense of a system |
| 34 |
> where no file has any stable identifier other than maybe a |
| 35 |
> content-hashed key. Then that makes me wonder why we link to |
| 36 |
> libraries by filename anyway, when we could just give each library a |
| 37 |
> GUID and version, and maybe a more general identifier for cases where |
| 38 |
> you have alternate implementations. |
| 39 |
> |
| 40 |
> But, as long as we're still just running Gentoo on Unix-like OSes |
| 41 |
> maybe tweaking the jail is a good place to start... |
| 42 |
> |
| 43 |
> Rich |
| 44 |
> |
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
-- |
| 49 |
Best regards, |
| 50 |
Michał Górny |
Archives