Introduce decision context

The decision path kept mutable hot-path state spread across file-static globals: subject/object caches and their eviction counters in event.c, the syslog working buffer in policy.c, decision counters in policy-metrics.c, and the defer queue in notify.c. That made the single decision thread behavior implicit and blocked the later per-worker ownership boundary.

Add a decision_context that owns those caches, counters, working buffer, and defer queue, allocate one active instance from init_event_system(), and route existing users through that active context. Move decision-defer into the library so the context can own it while preserving the current single-context behavior.

Author: stevegrubb

src/Makefile.am

@@ -42,6 +42,9 @@ libfapolicyd_la_SOURCES = \
 	library/database.h \
 	library/daemon-config.c \
 	library/daemon-config.h \
+	library/decision-context.h \
+	library/decision-defer.c \
+	library/decision-defer.h \
 	library/decision-event.h \
 	library/decision-timing.c \
 	library/decision-timing.h \
@@ -126,8 +129,6 @@ libfapolicyd_la_CFLAGS = $(fapolicyd_CFLAGS)
 libfapolicyd_la_LDFLAGS = $(fapolicyd_LDFLAGS) -lpthread
 
 fapolicyd_SOURCES = \
-	daemon/decision-defer.c \
-	daemon/decision-defer.h \
 	daemon/fanotify-fs-error.c \
 	daemon/fanotify-fs-error.h \
 	daemon/fapolicyd.c \

src/daemon/notify.c

@@ -41,6 +41,7 @@
 #include <time.h>
 #include "attr-lookup-metrics.h"
 #include "conf.h"
+#include "decision-context.h"
 #include "decision-defer.h"
 #include "decision-timing.h"
 #include "failure-action.h"
@@ -65,8 +66,6 @@ extern conf_t config;
 static pid_t our_pid;
 static struct queue *q = NULL;
 static struct queue_metrics last_queue_metrics;
-static struct decision_defer_queue defer_queue;
-static struct decision_defer_metrics last_defer_metrics;
 static pthread_t decision_thread;
 static pthread_t deadmans_switch_thread;
 static atomic_bool alive = true;
@@ -78,6 +77,9 @@ static unsigned int rpt_interval;
 static struct message_rate_limit kernel_queue_overflow_log =
 	MESSAGE_RATE_LIMIT_INIT(KERNEL_OVERFLOW_LOG_INTERVAL);
 
+#define defer_queue (decision_context_current()->defer_queue)
+#define last_defer_metrics (decision_context_current()->last_defer_metrics)
+
 // Local functions
 static void *decision_thread_main(void *arg);
 static void *deadmans_switch_thread_main(void *arg);
@@ -203,7 +205,8 @@ int init_fanotify(const conf_t *conf, mlist *m)
 		exit(1);
 	}
 	q_metrics_snapshot(q, &last_queue_metrics);
-	if (decision_defer_init(&defer_queue, conf->subj_cache_size)) {
+	if (defer_queue.entries == NULL &&
+	    decision_defer_init(&defer_queue, conf->subj_cache_size)) {
 		msg(LOG_ERR, "Failed setting up subject defer array (%s)",
 			strerror(errno));
 		q_close(q);
@@ -239,7 +242,6 @@ int init_fanotify(const conf_t *conf, mlist *m)
 	if (fd < 0) {
 		msg(LOG_ERR, "Failed opening fanotify fd (%s)",
 			strerror(errno));
-		decision_defer_destroy(&defer_queue);
 		q_close(q);
 		q = NULL;
 		exit(1);
@@ -253,7 +255,6 @@ int init_fanotify(const conf_t *conf, mlist *m)
 		msg(LOG_ERR, "Failed to create decision thread (%s)",
 			strerror(rc));
 		close(fd);
-		decision_defer_destroy(&defer_queue);
 		q_close(q);
 		exit(1);
 	}
@@ -269,7 +270,6 @@ int init_fanotify(const conf_t *conf, mlist *m)
 		if (rpt_timer_fd != -1)
 			close(rpt_timer_fd);
 		close(fd);
-		decision_defer_destroy(&defer_queue);
 		q_close(q);
 		exit(1);
 	}
@@ -422,7 +422,6 @@ void shutdown_fanotify(mlist *m)
 	decision_defer_metrics_snapshot_reset(&defer_queue,
 					      &last_defer_metrics, 0);
 	decision_timing_set_queue_depth_hooks(NULL, NULL, NULL);
-	decision_defer_destroy(&defer_queue);
 	q_close(q);
 	q = NULL;
 	close(rpt_timer_fd);

src/library/decision-context.h

@@ -0,0 +1,70 @@
+/*
+ * decision-context.h - per-decision mutable state
+ *
+ * Copyright (c) 2026 Red Hat Inc.
+ * All Rights Reserved.
+ *
+ * This software may be freely redistributed and/or modified under the
+ * terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ */
+
+#ifndef DECISION_CONTEXT_HEADER
+#define DECISION_CONTEXT_HEADER
+
+#include <stdbool.h>
+#include <stdatomic.h>
+#include "decision-defer.h"
+#include "lru.h"
+#include "message.h"
+
+/*
+ * decision_policy_counters - policy metrics updated by decision processing.
+ *
+ * Ruleset generation is deliberately not part of this block because rules can
+ * be published before the daemon allocates the runtime decision context.
+ */
+struct decision_policy_counters {
+	atomic_ulong allowed;
+	atomic_ulong denied;
+	atomic_ulong allowed_by_rule;
+	atomic_ulong allowed_by_fallthrough;
+	atomic_ulong fallthrough_open;
+	atomic_ulong fallthrough_execute;
+	atomic_ulong fallthrough_trusted;
+	atomic_ulong fallthrough_untrusted;
+	atomic_ulong fallthrough_trust_unknown;
+	atomic_ulong fallthrough_executable;
+	atomic_ulong fallthrough_programmatic;
+	atomic_ulong fallthrough_sharedlib;
+	atomic_ulong fallthrough_unknown_ftype;
+	atomic_ulong fallthrough_other_ftype;
+};
+
+/*
+ * decision_context - mutable state owned by one decision processor.
+ *
+ * There is only one active instance today. Keeping the hot-path caches,
+ * logging buffer, counters, and defer queue behind this object makes the
+ * ownership boundary explicit before multiple decision workers are added.
+ */
+struct decision_context {
+	Queue *subject_cache;
+	Queue *object_cache;
+	char *working_buffer;
+	bool object_cache_warned;
+	unsigned int early_subject_cache_evictions;
+	unsigned int building_tracer_evict_count;
+	unsigned int building_stale_evict_count;
+	struct message_rate_limit building_tracer_rate_limit;
+	struct message_rate_limit building_stale_rate_limit;
+	struct decision_defer_queue defer_queue;
+	struct decision_defer_metrics last_defer_metrics;
+	struct decision_policy_counters policy_counters;
+};
+
+struct decision_context *decision_context_current(void);
+void decision_context_set_current(struct decision_context *ctx);
+
+#endif

src/daemon/decision-defer.c src/library/decision-defer.csrc/daemon/decision-defer.c renamed to src/library/decision-defer.c

@@ -36,6 +36,7 @@
 #include <errno.h>
 
 #include "attr-lookup-metrics.h"
+#include "decision-context.h"
 #include "event.h"
 #include "database.h"
 #include "decision-timing.h"
@@ -61,16 +62,28 @@
 	(SUBJECT_BUILDING_STALE_MS * NSEC_PER_MSEC)
 #define SUBJECT_BUILDING_LOG_INTERVAL 60
 
-static Queue *subj_cache = NULL;
-static Queue *obj_cache = NULL;
-static bool obj_cache_warned = false;
-static unsigned int early_subj_cache_evictions = 0;
-static unsigned int building_tracer_evictions = 0;
-static unsigned int building_stale_evictions = 0;
-static struct message_rate_limit building_tracer_log =
-	MESSAGE_RATE_LIMIT_INIT(SUBJECT_BUILDING_LOG_INTERVAL);
-static struct message_rate_limit building_stale_log =
-	MESSAGE_RATE_LIMIT_INIT(SUBJECT_BUILDING_LOG_INTERVAL);
+static struct decision_context default_decision_context = {
+	.building_tracer_rate_limit =
+		MESSAGE_RATE_LIMIT_INIT(SUBJECT_BUILDING_LOG_INTERVAL),
+	.building_stale_rate_limit =
+		MESSAGE_RATE_LIMIT_INIT(SUBJECT_BUILDING_LOG_INTERVAL),
+};
+static struct decision_context *current_decision_context =
+	&default_decision_context;
+
+#define subj_cache (current_decision_context->subject_cache)
+#define obj_cache (current_decision_context->object_cache)
+#define obj_cache_warned (current_decision_context->object_cache_warned)
+#define early_subj_cache_evictions \
+	(current_decision_context->early_subject_cache_evictions)
+#define building_tracer_evictions \
+	(current_decision_context->building_tracer_evict_count)
+#define building_stale_evictions \
+	(current_decision_context->building_stale_evict_count)
+#define building_tracer_log \
+	(current_decision_context->building_tracer_rate_limit)
+#define building_stale_log \
+	(current_decision_context->building_stale_rate_limit)
 
 atomic_bool needs_flush = false;
 
@@ -88,6 +101,68 @@ struct building_evict_context {
 	unsigned int event_count;
 };
 
+/*
+ * decision_context_current - return active mutable decision state.
+ *
+ * A default empty context is available before the daemon initializes the real
+ * caches so policy-only tests can still use the logging buffer.
+ */
+struct decision_context *decision_context_current(void)
+{
+	return current_decision_context;
+}
+
+/*
+ * decision_context_set_current - publish the active decision context.
+ * @ctx: context to use, or NULL to restore the default empty context.
+ * Returns nothing.
+ */
+void decision_context_set_current(struct decision_context *ctx)
+{
+	if (ctx == NULL)
+		current_decision_context = &default_decision_context;
+	else
+		current_decision_context = ctx;
+}
+
+/*
+ * decision_context_init_rate_limits - initialize per-context log throttles.
+ * @ctx: context to initialize.
+ * Returns nothing.
+ */
+static void decision_context_init_rate_limits(struct decision_context *ctx)
+{
+	atomic_init(&ctx->building_tracer_rate_limit.last_log, 0);
+	ctx->building_tracer_rate_limit.interval =
+		SUBJECT_BUILDING_LOG_INTERVAL;
+	atomic_init(&ctx->building_stale_rate_limit.last_log, 0);
+	ctx->building_stale_rate_limit.interval = SUBJECT_BUILDING_LOG_INTERVAL;
+}
+
+/*
+ * decision_context_init_policy_counters - initialize policy metric counters.
+ * @counters: policy counter block to initialize.
+ * Returns nothing.
+ */
+static void decision_context_init_policy_counters(
+		struct decision_policy_counters *counters)
+{
+	atomic_init(&counters->allowed, 0);
+	atomic_init(&counters->denied, 0);
+	atomic_init(&counters->allowed_by_rule, 0);
+	atomic_init(&counters->allowed_by_fallthrough, 0);
+	atomic_init(&counters->fallthrough_open, 0);
+	atomic_init(&counters->fallthrough_execute, 0);
+	atomic_init(&counters->fallthrough_trusted, 0);
+	atomic_init(&counters->fallthrough_untrusted, 0);
+	atomic_init(&counters->fallthrough_trust_unknown, 0);
+	atomic_init(&counters->fallthrough_executable, 0);
+	atomic_init(&counters->fallthrough_programmatic, 0);
+	atomic_init(&counters->fallthrough_sharedlib, 0);
+	atomic_init(&counters->fallthrough_unknown_ftype, 0);
+	atomic_init(&counters->fallthrough_other_ftype, 0);
+}
+
 /*
  * event_now_ns - read monotonic time for BUILDING age checks.
  *
@@ -302,27 +377,47 @@ static void obj_evict_warn(void *unused)
 // Return 0 on success and 1 on error
 int init_event_system(const conf_t *config)
 {
+	struct decision_context *ctx;
+
+	ctx = calloc(1, sizeof(*ctx));
+	if (ctx == NULL)
+		return 1;
+	decision_context_init_rate_limits(ctx);
+	decision_context_init_policy_counters(&ctx->policy_counters);
+
 	/*
 	 * Attach subject_evict_warn so we can see when fast PID turnover
 	 * drops a subject before classification completes.  Without all the
 	 * paths collected ld.so can report spurious access denials.  A larger
 	 * subj_cache_size lengthens the window and avoids this condition.
 	 */
-	subj_cache=init_lru(config->subj_cache_size,
+	ctx->subject_cache = init_lru(config->subj_cache_size,
 				(void (*)(void *))subject_clear, "Subject",
 				(void (*)(void *))subject_evict_warn);
-	if (!subj_cache)
+	if (!ctx->subject_cache) {
+		free(ctx);
 		return 1;
+	}
 
-	obj_cache = init_lru(config->obj_cache_size,
+	ctx->object_cache = init_lru(config->obj_cache_size,
 				(void (*)(void *))object_clear, "Object",
 				obj_evict_warn);
-	if (!obj_cache) {
-		destroy_lru(subj_cache);
-		subj_cache = NULL;
+	if (!ctx->object_cache) {
+		destroy_lru(ctx->subject_cache);
+		free(ctx);
 		return 1;
 	}
 
+	if (decision_defer_init(&ctx->defer_queue, config->subj_cache_size)) {
+		destroy_lru(ctx->subject_cache);
+		destroy_lru(ctx->object_cache);
+		free(ctx);
+		return 1;
+	}
+	decision_defer_metrics_snapshot_reset(&ctx->defer_queue,
+					      &ctx->last_defer_metrics, 0);
+
+	decision_context_set_current(ctx);
 	return 0;
 }
 
@@ -350,23 +445,31 @@ static int flush_cache(void)
 
 void destroy_event_system(void)
 {
+	struct decision_context *ctx = current_decision_context;
+
+	if (ctx == &default_decision_context)
+		return;
+
 	/* We're intentionally clearing the caches; disable warnings */
-	if (subj_cache)
-		subj_cache->evict_cb = NULL;
-	if (early_subj_cache_evictions)
+	if (ctx->subject_cache)
+		ctx->subject_cache->evict_cb = NULL;
+	if (ctx->early_subject_cache_evictions)
 		msg(LOG_WARNING,
 		   "Processes are being evicted from the subject cache before "
 		   "pattern detection completes: increase subj_cache_size "
-		   "(total early evictions: %u)", early_subj_cache_evictions);
-	if (obj_cache)
-		obj_cache->evict_cb = NULL;
-	if (obj_cache_warned)
+		   "(total early evictions: %u)",
+		   ctx->early_subject_cache_evictions);
+	if (ctx->object_cache)
+		ctx->object_cache->evict_cb = NULL;
+	if (ctx->object_cache_warned)
 		msg(LOG_WARNING,
 		  "object cache eviction ratios high: increase obj_cache_size");
-	destroy_lru(subj_cache);
-	destroy_lru(obj_cache);
-	subj_cache = NULL;
-	obj_cache = NULL;
+	destroy_lru(ctx->subject_cache);
+	destroy_lru(ctx->object_cache);
+	decision_defer_destroy(&ctx->defer_queue);
+	free(ctx->working_buffer);
+	decision_context_set_current(NULL);
+	free(ctx);
 }
 
 static inline void reset_subject_attributes(s_array *s)