Prepare trust DB read concurrency

Trust database decisions used a process-global LMDB read transaction and cursor guarded by update_lock. That made future decision readers share mutable cursor state and serialize all lookups behind the update mutex; LMDB was also capped at four readers with no metric when reader slots were full.

The fix opens private short-lived LMDB read transactions and cursors for trust lookups under a shared read lock, while trust DB rebuild and update paths keep exclusive writer ownership. The DBI is initialized with the environment, max readers are sized for the planned 32-worker cap plus maintenance readers, and resettable metrics report cheap lookup count and reader-slots-full counters. Lookup latency stays in the armed decision timing report through the existing trust_db_lookup total, lock_wait, and read stage rows instead of adding per-lookup clock reads to normal metrics collection.

Tests add concurrent trust DB lookup coverage and metrics reset/report checks in trustdb_lmdb_test, including assertions that lookup average/max timing fields are absent from the metrics report.

Author: stevegrubb

doc/fapolicyd.metrics.5

@@ -110,6 +110,19 @@ match the current event and therefore had to be evicted before reuse.
 .B Object evictions
 The number of object cache evictions and the eviction percentage relative to
 object cache hits.
+.SH Trust database lookups
+.TP
+.B Trust DB lookups
+The number of trust database lookup attempts since the last metrics reset.
+.TP
+.B Trust DB reader slots full
+The number of lookup attempts that could not open an LMDB read transaction
+because all LMDB reader slots were in use.
+.PP
+Trust database lookup latency is reported by
+.BR fapolicyd.timing (5)
+only while manual timing collection is armed, so normal metrics collection does
+not add per-lookup clock reads.
 .SH Rule hit counts
 .TP
 .B Hits/rule

doc/fapolicyd.state.5

@@ -89,6 +89,10 @@ The configured number of entries in the object cache.
 .TP
 .B Trust database max pages
 The configured maximum LMDB page count for the trust database.
+.TP
+.B Trust database max readers
+The configured LMDB reader-slot limit. This is sized for the planned decision
+worker cap plus maintenance readers.
 .SS Resource utilization
 .TP
 .B Trust database pages in use

doc/fapolicyd.timing.5

@@ -505,7 +505,7 @@ SHA-style file digest collection through
 .B *:trust_db_lookup:total
 Total trust database lookup through
 .BR check_trust_database ().
-This includes update-thread lock wait, long-term LMDB read setup, the primary
+This includes update-thread lock wait, per-lookup LMDB read setup, the primary
 LMDB lookup, optional hash work requested by trust lookup, and the top-level
 .I /usr
 symlink retry path.
@@ -516,8 +516,9 @@ setup. This is a future multi-decision-thread contention signal.
 .TP
 .B *:trust_db_lookup:read
 LMDB read setup and trust database read work after the update-thread lock is
-held. This currently includes the primary lookup, optional hash work requested
-by trust lookup, the top-level
+held. This currently includes per-lookup LMDB read transaction and cursor
+setup, the primary lookup, optional hash work requested by trust lookup, the
+top-level
 .I /usr
 symlink retry path, and read cleanup.
 .TP

src/daemon/fapolicyd.c

@@ -1012,6 +1012,7 @@ void do_metrics_report_reset(FILE *f, int reset)
 	decision_report_metrics_reset(f, reset);
 	fanotify_metrics_report_reset(f, reset);
 	do_cache_metrics_report_reset(f, reset);
+	database_metrics_report_reset(f, reset);
 	fputs("\n", f);
 	fputs("Rule hit counts:\n", f);
 	policy_rule_hits_report_reset(f, reset);