A while back we started authenticating users on our Linux servers against Active Directory. As far as the actual authentication part goes, things are working great.
However, one of the side effects is that Linux thinks (sort of correctly) that it has several thousands (~15-20k) of users. We've seen several issues that seem to be SELinux related (one of which is https://serverfault.com/questions/236419/usr-bin-install-hangs-apparently-due-to-selinux). Some other issues include:
- dmesg repeatedly reports that restorcon gets killed by oom-killer
- booting on some servers take a very long time - this happens after kernel load, apparently during while reading the volume groups, but also while running the restorecon startup script.
- yum updates hang (similar behavior to my SELinux/GNU 'install' question regarding the mmap/munmap)
We see these issues with SELinux in permissive mode. They go away when we disable SELinux completely. Disabling SELinux is an option. I'm also looking at ways to limit the number of users AD presents to Linux using an OU or group. But nerd in me always wants to know more.
So this is a pretty broad question - but anyone have any advice for dealing with SELinux with a large number of users? I'm not particularly familiar with SELinux - but this could be the learning opportunity.