initialization of the library on ubuntu and other selinux-absent distros looks like this:
statfs("/sys/fs/selinux", 0x7ffd5ce7e790) = -1 ENOENT (No such file or directory)
statfs("/selinux", 0x7ffd5ce7e790) = -1 ENOENT (No such file or directory)
getrandom("\xdf\xe2\x1c\xf5\x4d\x44\x77\xb8", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55841e57a000
brk(0x55841e59b000) = 0x55841e59b000
openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "nodev\tsysfs\nnodev\ttmpfs\nnodev\tbd"..., 1024) = 393
read(3, "", 1024) = 0
close(3) = 0
access("/etc/selinux/config", F_OK) = -1 ENOENT (No such file or directory)
All this work happens in libselinux/src/init.c:init_selinuxmnt
While this is not the end of the world, it is wasteful and preferably avoided, notably the /proc/filesystems read.
For example maybe there is a cheaper check which can be done or the entire thing can be done lazily instead?
Even sed is linked with libselinux and executes the above unconditionally, notably when spawned without any fs ops (e.g., merely sed 's/foo/bar/').
Other utils are also showing up (ls, find, mkdir) and preferably would skip all of it as well if possible (or at least do something cheaper, maybe there is /proc file whose existence can be merely checked to confirm selinux?)
initialization of the library on ubuntu and other selinux-absent distros looks like this:
All this work happens in libselinux/src/init.c:init_selinuxmnt
While this is not the end of the world, it is wasteful and preferably avoided, notably the /proc/filesystems read.
For example maybe there is a cheaper check which can be done or the entire thing can be done lazily instead?
Even sed is linked with libselinux and executes the above unconditionally, notably when spawned without any fs ops (e.g., merely
sed 's/foo/bar/').Other utils are also showing up (ls, find, mkdir) and preferably would skip all of it as well if possible (or at least do something cheaper, maybe there is /proc file whose existence can be merely checked to confirm selinux?)