Re: Portage FEATURE suggestion - limited-visibility builds
2012-07-31 23:57:08 GMT
Il 31/07/2012 21:27, Michał Górny ha scritto: > On Tue, 31 Jul 2012 15:16:34 -0400 > Rich Freeman<rich0 <at> gentoo.org> wrote: > >> On Tue, Jul 31, 2012 at 10:56 AM, Ian Stakenvicius<axs <at> gentoo.org> >> wrote: >>> Although that is true, it would be -(Continue reading)WAY- too slow to generate said >>> list via equery/q* helpers; I think that's where the >>> extended-attributes and/or cache idea comes into play. >> I agree. This needs to be high-performance when it comes to >> individual file access. If it takes 10 seconds per build to populate >> some database or set up a bazillion bind mounts that isn't the end of >> the world, but if it takes an extra 0.1 seconds every time a file is >> read that could add up VERY fast on a large build. > I'd be more afraid about resources, and whether the kernel will be > actually able to handle bazillion bind mounts. And if, whether it won't > actually cause more overhead than copying the whole system to some kind > of tmpfs. If testing show that bind mounts are too heavy we could resort to LD_PRELOAD a library that filter the acces to the disk, or to rework sandbox to also hide w/o errors some files, with an appropriate database (sys-apps/mlocate come to mind) every access will have negligible additional cost compared to that of rotational disks. >> Ideally I'd like to see the same thing extended to run-time, and short >> of writing some entirely new security model into the kernel or taking >> namespaces to a whole new level, part of me thinks that >> auto-generating SELinux policies might be the solution, so that the >> existing mechanism can be extended. >>
RSS Feed