Add decision_threads configuration

The worker-pool roadmap needs a decision_threads setting before the dispatcher and worker activation changes land. Without the knob, LMDB reader sizing and resource validation still used a fixed planned reader cap instead of the administrator-selected future worker count.

Add decision_threads to daemon configuration with a default of one, validate it against online CPU count, the internal worker cap, LMDB reader reservations, estimated fixed worker memory, and file descriptor capacity, and use the value when sizing LMDB max readers. Report the configured value in state output and leave a TODO for a separate active-worker field if the future worker pool cannot resize on SIGHUP.

Add daemon_config_test coverage for default normalization, invalid bounds, and LMDB reader limit calculation.

Author: stevegrubb

doc/fapolicyd.conf.5

@@ -18,6 +18,18 @@ This option gives fapolicyd a scheduler boost. The number can be from 0 to 20. T
 .B q_size
 This option is used to control how big of an internal queue that fapolicyd will use. If requests come in faster than fapolicyd can answer, the queue holds the pending requests. If the do_stat_report is enabled, when fapolicyd shutsdown it will provide some statistics which includes maximum queue depth used. This information can be used to help tune performance. The default value is 800. Also note, this value means that fapolicyd gets a file descriptor for that entry. There is an rlimit cap controlled by systemd's LimitNOFILE setting for the service. You may also need to adjust it if the q_size exceeds it's value.
 
+.TP
+.B decision_threads
+This option controls how many decision worker threads fapolicyd is configured
+to use. The default value is 1. The value must be at least 1, no larger than
+the number of online CPU cores, and no larger than the daemon's supported
+maximum. Startup validation also checks that the configured worker count fits
+the LMDB reader-slot reservation, estimated fixed worker memory budget, and
+file descriptor budget implied by
+.BR q_size .
+This setting is applied when the daemon starts; restart fapolicyd after
+changing it.
+
 .TP
 .B uid
 This can be a number or an account name which fapolicyd should switch to during startup. The default value is 0 because it is guaranteed to exist. But it is recommended to use the fapolicyd account if that exists.
@@ -188,8 +200,8 @@ The following settings require a daemon restart because they are consumed when
 long-lived runtime objects are created:
 .RS
 .IP \[bu] 2
-\fBq_size\fP, \fBsubj_cache_size\fP, and \fBobj_cache_size\fP size the event
-queue and caches.
+\fBq_size\fP, \fBdecision_threads\fP, \fBsubj_cache_size\fP, and
+\fBobj_cache_size\fP size the event queue, worker count, and caches.
 .IP \[bu]
 \fBuid\fP and \fBgid\fP control the daemon identity selected during startup.
 .IP \[bu]

doc/fapolicyd.state.5

@@ -91,6 +91,10 @@ access.
 .B CPU cores
 The number of online processor cores reported by the system.
 .TP
+.B decision_threads
+The configured decision worker count from
+.BR fapolicyd.conf .
+.TP
 .B q_size
 The configured size of the internal event queue.
 .TP
@@ -109,8 +113,9 @@ This reflects the map size currently opened by the daemon, including any
 automatic resize applied for reload headroom.
 .TP
 .B Trust database max readers
-The configured LMDB reader-slot limit. This is sized for the planned decision
-worker cap plus maintenance readers.
+The configured LMDB reader-slot limit. This is sized for
+.B decision_threads
+plus maintenance readers.
 .SS Resource utilization
 .TP
 .B Trust database pages in use

init/fapolicyd.conf

@@ -6,6 +6,7 @@
 permissive = 0
 nice_val = 14
 q_size = 800
+decision_threads = 1
 uid = fapolicyd
 gid = fapolicyd
 do_stat_report = 1

src/daemon/fapolicyd.c

@@ -461,12 +461,12 @@ static int reload_configuration(void)
 
 	/*
 	 * Remaining daemon_config fields require restart-time changes:
-	 * q_size, subj_cache_size, and obj_cache_size are consumed when the
-	 * event queue and caches are created. uid/gid, allow_filesystem_mark,
-	 * watch_fs, and ignore_mounts are applied while fanotify marks are
-	 * installed. db_max_size fixes the LMDB map when the database opens,
-	 * and report_interval is bound to the decision thread's timer. None
-	 * of these components support resizing in-place yet, so their
+	 * q_size, decision_threads, subj_cache_size, and obj_cache_size are
+	 * consumed when the event queue and caches are created. uid/gid,
+	 * allow_filesystem_mark, watch_fs, and ignore_mounts are applied while
+	 * fanotify marks are installed. db_max_size fixes the LMDB map when the
+	 * database opens, and report_interval is bound to the decision thread's
+	 * timer. None of these components support resizing in-place yet, so their
 	 * configuration stays static.
 	 */
 
@@ -957,6 +957,11 @@ void do_state_report(FILE *f, int shutdown)
 
 	fprintf(f, "\nResource configuration:\n");
 	fprintf(f, "CPU cores: %ld\n", sysconf(_SC_NPROCESSORS_ONLN));
+	fprintf(f, "decision_threads: %u\n", config.decision_threads);
+	/*
+	 * TODO: If worker-pool activation cannot resize decision threads on
+	 * SIGHUP, add a separate active worker count here.
+	 */
 	fprintf(f, "q_size: %u\n", config.q_size);
 	fanotify_defer_config_report(f);
 	do_cache_config_report(f);
@@ -1219,10 +1224,10 @@ int main(int argc, const char *argv[])
 	limit.rlim_max = RLIM_INFINITY;
 	setrlimit(RLIMIT_FSIZE, &limit);
 	getrlimit(RLIMIT_NOFILE, &limit);
-	if (limit.rlim_max >= 16384)
+	if (limit.rlim_max >= DAEMON_CONFIG_MIN_NOFILE)
 		limit.rlim_cur = limit.rlim_max;
 	else
-		limit.rlim_max = limit.rlim_cur = 16384;
+		limit.rlim_max = limit.rlim_cur = DAEMON_CONFIG_MIN_NOFILE;
 
 	if (setrlimit(RLIMIT_NOFILE, &limit))
 		msg(LOG_WARNING, "Can't increase file number rlimit - %s",

src/library/conf.h

@@ -46,6 +46,7 @@ typedef struct conf
 	unsigned int permissive;
 	unsigned int nice_val;
 	unsigned int q_size;
+	unsigned int decision_threads;
 	uid_t uid;
 	gid_t gid;
 	unsigned int do_stat_report;