Gentoo Archives: gentoo-hardened

From: Michael Orlitzky <michael@××××××××.com>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] die() required on pax-mark?
Date: Tue, 22 Oct 2013 13:30:22
Message-Id: 52667DDC.8060402@orlitzky.com
In Reply to: Re: [gentoo-hardened] die() required on pax-mark? by Allan Wegan
1 -----BEGIN PGP SIGNED MESSAGE-----
2 Hash: SHA1
3
4 On 10/22/2013 08:38 AM, Allan Wegan wrote:
5 >
6 > Has the bottleneck already been identified? Python should not be
7 > much slower than other languages for solving mostly IO-based
8 > problems.
9
10 When you emerge something with a bazillion files, the install wrapper
11 (and thus the python interpreter) get launched that many times. It's
12 the startup time that kills it.
13
14 I tried to write a 'cp' wrapper once for a similar reason (it doesn't
15 preserve posix ACLs), and it's not as easy as it sounds to just
16 "rewrite it in C" or do the PAX markings after 'install'. The problem
17 you run into is that it's very difficult to figure out where 'install'
18 put the file without reimplementing all of 'install'.
19
20 But we do have an advantage in portage: we sandbox things before
21 moving them to the real filesystem, so portage actually knows all of
22 the files that will got 'install'ed and where they'll wind up. If we
23 sandbox the PAX markings as well, it should be possible to hit those
24 files with paxctl-ng after they've been moved to the real root.
25
26 I believe the sandbox option is what Anthony listed here as option #4:
27
28 https://bugs.gentoo.org/show_bug.cgi?id=465000
29
30 -----BEGIN PGP SIGNATURE-----
31 Version: GnuPG v2.0.20 (GNU/Linux)
32
33 iQIcBAEBAgAGBQJSZn3cAAoJEBxJck0inpOi/bQP/2w8+bDmVA6eFLa7Tc35vyxY
34 8B/N2Ya0Nu1VLG2mbmnEFUKiQxK6I3QNbYckeRqB3g5/6tp4Pp83s0xWQQbcygH+
35 NhOjCme92JVloYA+Ux8XgC1DF6Ys5cgMFhGpWN4ZH7lsufk21p4CPz5v0yODH32Z
36 lFKqqokeh0EVfHKQYNa/nI65iW/Nz5Dbj1cKqhInZQM7z01fi7Dpy6ZLaQQ3hZyj
37 2GM8zXPqjGEgVmXf8oHDIbTOnD6//P5n3mWQb1thmb8wIXL7Uyx8lBNa2LkaoA86
38 q86GxcV6YYed5AEVDdwm+4IWF3bILrsaP4Vm5S5lpUvmfEZqoECwtfxoU2CUHcjO
39 KK2+py10msyV4JUEGxGZCK/u3NJ9h1aQ4e/KvwTa9JBzVwzcaSS7fyHlGpkRFlgh
40 7vh7Ju91sWz0xH+Uwpt3mwGBPcYoG9LBndCGAgzKRF/uVPZoItX+X4mWo3/2DcEq
41 FqnS6UeWQhew175jRD0TyV2sFODL9isfy37o36ZGLc6LxDShB9v1XQ5aF3VfrlhJ
42 le8u3dC8PoFg4nTy3tL30gf3J65Ms4itdi9MoYrDAL0oNktPXx97erje1QobiViN
43 rQYm4ZKPinEQDDFNP3d2OTXuk6hJclzYgfFxm+uz2EW+NRZn955IbkKmCIQq00I8
44 e7XMKUgkBOR5L/l5wra6
45 =kbgW
46 -----END PGP SIGNATURE-----

Replies

Subject Author
Re: [gentoo-hardened] die() required on pax-mark? Allan Wegan <allanwegan@××××××××××.de>