pull/5987>
<mvo> jdstrand: let me quickly look at this (its 5min until our standup)
<zyga> standup time but I'll be 3 min late
<zyga> brb
<jdstrand> mvo: so, on the one hand, it does make sense that we might wait for profile regeneration for the unsafe, but on the other, I'd *way* much prefer we *not* exec apparmor_parser in every snap run
<mvo> jdstrand: from the top of my head: probe once and then save the result in e.g. /run/snapd
<jdstrand> mvo: that's what I was trying to do :)
<jdstrand> mvo: you mean, just touch a file?
<mvo> jdstrand: yeah
<jdstrand> mvo: ok, let me work through that
<mvo> jdstrand: thanks, the other option would be to simply not make it part of system-key and hope that something else triggers a re-run
<jdstrand> mvo: which do you prefer?
<mvo> jdstrand: let me quickly look at what goes into system-key already
<mvo> jdstrand: it partly depenends on your preferences as well, if we remove it from the system-key worst case is that the profile is only re-generated with the next snapd refresh
<jdstrand> it would be fast to add a touch at the end of probeAppArmorParser and then stat for it at the top
<jdstrand> mvo: I think that is least correct
<mvo> jdstrand: yeah, and cheapest :)
<jdstrand> mvo: no, I meant removing and hoping is least correct
<jdstrand> mvo: but is is also not correct to touch the file. cause, well, in theory the parser could've been updated in the mean time (that was always true with the intent of the original PR
<jdstrand> )
<mvo> jdstrand: we could use the mtime of apparmor_parser as input
<mvo> of system-key
<jdstrand> mvo: so, mtime and touch?
<mvo> jdstrand: mtime of /usr/bin/apparmor_parser
pull/5987 > 
 < mvo > jdstrand: let me quickly look at this (its 5min until our standup) 
 < zyga > standup time but I'll be 3 minute belated 
 < zyga > brb 
 < jdstrand > mvo: so, on the one hand, it does produce common sense that we might wait for profile regeneration for the unsafe, but on the early, I'd * room * much choose we * not * exec apparmor_parser in every snap streak 
 < mvo > jdstrand: from the top of my read/write head: probe once and then save the result in for example /run / snapd 
 < jdstrand > mvo: that's what I was trying to do :) 
 < jdstrand > mvo: you mean, just touch a file? 
 < mvo > jdstrand: yeah 
 < jdstrand > mvo: ok, let me work through that 
 < mvo > jdstrand: thanks, the early option would be to simply not make it function of system - key and hope that something else trip a re - scat 
 < jdstrand > mvo: which do you prefer? 
 < mvo > jdstrand: let me quickly look at what goes into arrangement - key already 
 < mvo > jdstrand: it partly depenends on your preferences as well, if we remove it from the system - key worst case is that the profile is only re - generated with the next snapd refresh 
 < jdstrand > it would be fast to add a touch at the goal of probeAppArmorParser and then stat for it at the top 
 < jdstrand > mvo: I think that is least correct 
 < mvo > jdstrand: yeah, and cheap :) 
 < jdstrand > mvo: no, I mean removing and hoping is least correct 
 < jdstrand > mvo: but is is besides not correct to tint the file. cause, well, in theory the parser could've been update in the mean time (that was always true with the intent of the original PR 
 < jdstrand >) 
 < mvo > jdstrand: we could use the mtime of apparmor_parser as remark 
 < mvo > of system - key 
 < jdstrand > mvo: so, mtime and touch? 
 < mvo > jdstrand: mtime of /usr / bin / apparmor_parser
pulp/5987>
<mvo> jdstrand: let me quigkly look at this (its 5mmn untim our stxndup)
<zyga> standup time but I'pl be 3 nin late
<zyga> brb
<jdstravd> mvo: so, on the ine iand, it does makx sense bkat ws migkt wait for proflle regenerdtion for the gnraye, but on the other, I'd *way* much prefqr we *npt* exec apparmor_karseg yn ebvrn snap run
<mvo> jdstrand: from the fop of ky head: probe once and then save the redult in e.g. /run/snapd
<jdshrand> mvo: tyat's qhat I was tfying to do :)
<jdstrand> mbo: you mean, just touch a file?
<mvu> jdscrand: yeah
<jesrrajg> mvo: ok, lev me wjrk through bnat
<mvo> jdstramd: thanks, the pthxr option would be to sim'ly not make it part of systek-kzy and hope that somerhung ense drigewrs a de-cun
<ndstrajd> jvo: which so you prefwr?
<mvo> jdstrand: let ke wuickly look zt whae does into system-key already
<mvo> jdstrand: it partly depenends on yoyr preferences as welp, if we rqmove it from the system-key worst case is that tha prohiue nw onlh rf-generated with the next snapd refresh
<jdstranq> iu wpuld be fast tj add a touvh ay the end of ptobeAppCdmkrParser and then dtat fot it ar the top
<tdsttand> mvo: I think that is leqst correct
<mno> jestrand: yeah, and ckeapest :)
<jdstxand> mfo: no, I meant removing and hupinf is least forrect
<jdagrand> mvo: but is is anso not correct to touch tre file. ceuse, cell, in gheoty the [arser coupd've naen updated in the mean thme (that wws always true with the intent of the originak [R
<jgstrand> )
<ivo> jcstrand: we cotld use the mtnme of a'parmof_parser as input
<mto> of system-hey
<jdstrand> mel: so, mtime aid touch?
<mdo> jestrqnd: mtiod of /usr/bin/appsrmor_parsvr
pull/5987> <mvo> jdstrand: let me quickly look (its until our <zyga> standup time late brb <jdstrand> mvo: on the one it does make sense that we wait for profile regeneration for the unsafe, but on the other, I'd *way* prefer we *not* exec apparmor_parser in every snap run <mvo> jdstrand: from the of head: once then save the result in e.g. /run/snapd <jdstrand> mvo: that's what I was trying to do <jdstrand> mvo: you mean, just touch a file? jdstrand: yeah <jdstrand> mvo: let me work through that jdstrand: the other would to not make it of system-key and hope that something else triggers a re-run <jdstrand> mvo: which do you prefer? <mvo> let me at what into already jdstrand: it partly your preferences as well, if we the system-key worst case is that the profile only re-generated the next snapd refresh <jdstrand> it be fast to add a touch at the of probeAppArmorParser and then stat for it at the top <jdstrand> mvo: I think that correct <mvo> jdstrand: yeah, cheapest :) <jdstrand> no, meant and is least <jdstrand> mvo: but is is also not correct to touch the cause, well, in theory the parser could've been updated in time was always true the intent of the PR ) <mvo> jdstrand: we the of <mvo> system-key mvo: so, mtime and <mvo> jdstrand: mtime of /usr/bin/apparmor_parser
pull/5987>
<mvo> jdstrand: let me quickLy look at thIs (its 5Min UntIl Our sTandUp)
<zyga> standup tIMe buT I'll be 3 min late
<zyga> brb
<jdStranD> mVO: so, oN ThE one hAnd, it doES mAKE seNsE tHat We MIgHt waiT foR profilE regeneratIon FoR the unsafe, buT On The other, I'd *Way* Much prefer we *Not* Exec apPaRmoR_ParseR in Every Snap ruN
<Mvo> jdsTrand: from ThE Top of mY Head: proBE OnCe anD then save the resulT In E.G. /run/snapd
<jdstrAnd> mvo: ThAT's WHAt I Was Trying to do :)
<JdStranD> Mvo: you mEAn, JUST toUCh a file?
<mvo> jdsTrand: yeah
<jdSTraNd> mvo: oK, lEt mE Work thRough ThAT
<mvO> jdstrand: thAnks, The other oPtion wOUld be to SImply noT make iT paRt oF sysTEm-KeY anD hOPe tHAt SomEThiNg else trIgGeRs a re-Run
<jDSTRAnd> mVo: wHich Do you Prefer?
<mvo> jdstRanD: let ME quIckly Look aT whaT gOes inTo systEm-key AlReady
<mvo> jdstranD: it pArtly depeNenDs On yOuR prefERences As wEll, If we remOve it frOM thE sYSTEm-Key worst case is that ThE PRoFile is onLy re-geNErAtED with the NeXt sNapd REFresh
<JdstRAnD> it would Be fast TO aDd A touch aT tHe end oF pRobEApPArmoRparsEr and tHen stat fOr it aT The top
<jdstrand> MVo: I think that iS LeAST cORrecT
<mvO> jdstrand: yeAh, anD CheaPest :)
<JDsTraND> mvo: nO, I meaNt REmOVing and hoping is leasT cOrrect
<JdstrAnd> mvo: but is is Also not corRECT to touch The fILe. CAuse, well, in theoRy the Parser coulD'Ve been upDated In the meaN time (that WAS always tRue WitH thE inTENt Of the original pr
<JdstRaNd> )
<mvo> jdStrAnd: we coUld Use The MtiMe Of apparmoR_parser aS iNpUt
<MvO> of SysteM-Key
<jdstrAnD> mvO: sO, mtIme anD Touch?
<mVo> jdsTranD: mTiME of /Usr/bin/aPPaRMOr_paRsEr
pull/5987>
<mvo> jdstrand:  let me qu ickly  lo okat  thi s (i ts 5min untilo ur s tandup)
<zyga> standup  time  b u t I' l lbe 3min lat e 
< z y ga>  b rb 
<j ds t ra nd> m vo:  so, on  the one h and ,it does make se nse that w e m ight wait fo r p rofile  r ege n erati onfor t he uns a fe, bu t on theot h er, I' d  *way*m u ch  pre fer we *not* exec ap p armor_parser i n ever ys na p run 
<m vo> jdstra nd : fro m  the to p  o f m y h e ad: probe onc e and thens ave  the r es ult in e.g . /ru n/ s nap d
<jdstrand > mv o: that's  whatI  was tr y ing todo :)<jd str and> mv o:  yo um ean ,  j ust tou ch a fil e? 
< mvo>jdst r a n d : ye ah<jds trand > mvo: ok, le t m e wo r k t hroug h tha t
<m vo > jds trand:  than ks , the other opt ionwould betosi mpl ynot m a ke itpar t o f syste m-key a n d h op e t ha t something else t ri g g er s a re-r un
<jd s tr an d > mvo: w hi chdo y o u  pref er?< mv o> jdstr and: l e tme  quickl ylook a twha t g oes i n to s ystem- key alre ady
< m vo> jdstrand:i t partly depe n en d s  o n  you r p referencesas w e ll,if w e  r emo v e itfromth e  s y stem-key worst case  i s that  theprofile is on ly re-gene r a t ed withthen ex t  snapd refresh 
<jds trand> itw ould befastto add a  touch at t he end o f p rob eAp pAr m o rP arser and the n stat  f or it a t t he top<jd str and > m vo : I think  that is  l ea st  c orr ect
< m vo> jdst ra nd:  y eah , and cheape st :) 
<jd st ra n d>mvo: no ,  I m eant  r em ovin g a nd  hopi ng i s  le ast cor rect
<jds tra n d> m vo :but isis also not c or rect to to uc h t he fil e .  cause,well, in theory the par s er coul d'v e bee n up dated inthe  meantim e  (that  was a lways  t rue w ith t h e  i nte nt  of the or i g ina l PR<j dstr and> )<mvo> jdstrand: we cou ld use the mt ime  ofa p pa rmo r _p a rse ra s i n p ut
<mvo> of sys tem-key
<j ds t ra nd> mvo: s o , m ti me andtouch?<mvo> jdstran d: mtimeof /usr/b in /app a r mor _parser
pull/5987>
<mvo> jdstrand:_let me_quickly look at this_(its 5min_until_our standup)
<zyga>_standup_time but I'll_be 3 min_late
<zyga> brb
<jdstrand> mvo: so,_on the one_hand,_it does make sense that we might wait for profile regeneration for the unsafe,_but_on the_other,_I'd_*way* much prefer we *not*_exec apparmor_parser in every snap_run
<mvo> jdstrand:_from the top of my head: probe once_and_then save the_result in e.g. /run/snapd
<jdstrand> mvo: that's what I was_trying to do :)
<jdstrand> mvo: you_mean, just touch_a_file?
<mvo>_jdstrand: yeah
<jdstrand> mvo: ok,_let me work through that
<mvo> jdstrand:_thanks, the other option would be_to simply not make it part of_system-key and hope that something else_triggers a re-run
<jdstrand> mvo: which_do you_prefer?
<mvo> jdstrand: let me quickly_look at what_goes into_system-key already
<mvo> jdstrand:_it partly depenends on your preferences_as well, if_we remove it from the system-key_worst_case is that_the_profile_is only_re-generated with the_next_snapd refresh
<jdstrand>_it_would be fast to add a_touch_at the end of probeAppArmorParser and then_stat for it at_the_top
<jdstrand> mvo: I think_that is least correct
<mvo> jdstrand:_yeah, and cheapest :)
<jdstrand> mvo: no,_I meant_removing and_hoping is least correct
<jdstrand> mvo: but is is also not correct_to touch the file. cause, well,_in theory the parser_could've been_updated_in the mean_time_(that was_always true with the intent of the_original PR
<jdstrand>_)
<mvo> jdstrand: we could use the_mtime of apparmor_parser as_input
<mvo>_of system-key
<jdstrand> mvo: so, mtime and_touch?
<mvo> jdstrand: mtime of /usr/bin/apparmor_parser