rc.apparmor.functions: take benefit from the parser's automatic parallelization.

parser/rc.apparmor.functions

@@ -169,26 +169,40 @@ parse_profiles() {
 		return 1
 	fi
 
-	for profile in $PROFILE_DIR/*; do
+	# Note: the parser automatically skips files that match skip_profile()
-		skip_profile "${profile}"
+	# when we pass it a directory, but not when we pass it an individual
-		skip=$?
+	# profile. So we need to use skip_profile only in the latter case,
-		# Ignore skip status == 2 (silent skip)
+	# as long as the parser is in sync' with skip_profile().
-		if [ "$skip" -eq 1 ] ; then
+	"$PARSER" $PARSER_ARGS -- "$PROFILE_DIR" || {
-			aa_log_skipped_msg "$profile"
+		# FIXME: once the parser properly handles broken profiles
-			logger -t "AppArmor(init)" -p daemon.warn "Skipping profile $profile"
+		# (LP: #1377338), remove the following code and the
-			STATUS=2
+		# skip_profile() function. For now, if the parser returns
-			continue
+		# an error, just run it again separately on each profile.
-		elif [ "$skip" -ne 0 ]; then
+		for profile in $PROFILE_DIR/*; do
-			continue
+			skip_profile "${profile}"
-		fi
+			skip=$?
-		if [ -f "${profile}" ] ; then
+			# Ignore skip status == 2 (silent skip)
-			$PARSER $PARSER_ARGS "$profile" > /dev/null
+			if [ "$skip" -eq 1 ] ; then
-			if [ $? -ne 0 ]; then
+				aa_log_skipped_msg "$profile"
-				aa_log_failure_msg "$profile failed to load"
+				logger -t "AppArmor(init)" -p daemon.warn \
-				STATUS=1
+					"Skipping profile $profile"
+				continue
+			elif [ "$skip" -ne 0 ]; then
+				continue
 			fi
+			if [ ! -f "${profile}" ] ; then
+				continue
+			fi
+			echo "$profile"
+		done | \
+		# Use xargs to parallelize calls to the parser over all CPUs
+		xargs -n1 -d"\n" --max-procs=$(getconf _NPROCESSORS_ONLN) \
+			"$PARSER" $PARSER_ARGS --
+		if [ $? -ne 0 ]; then
+			STATUS=1
+			aa_log_failure_msg "At least one profile failed to load"
 		fi
-	done
+	}
 	if [ $STATUS -eq 2 ]; then
 		STATUS=0
 	fi