syntax-check: Add warning about implications of G_REGEX_OPTIMIZE

glib's G_REGEX_OPTIMIZE flag for regex operations implies the use of
pcre's JIT optimizer for regexes which requires writable executable
memory for the optimized code.

Security frameworks such as SELinux can restrict program's access to
writable executable memory to harden the code.

glib's implementation of the regex functions handles downgrade to
interpreted evaluation of regexes gracefully if writable executable
memory is unavailable, but that is non-obvious and has a performance
penalty.

Add a syntax check which requires all uses of G_REGEX_OPTIMIZE to be
annotated so that the reader of the code can be hinted to why
G_REGEX_OPTIMIZE should perhaps be avoided.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>

build-aux/syntax-check.mk

@@ -1387,6 +1387,15 @@ sc_prohibit_inline_functions:
 	halt='avoid inline functions in .c files' \
 	  $(_sc_search_regexp)
 
+# glib's G_REGEX_OPTIMIZE instructs the PCRE library to use JIT optimization
+# of the regexes, which requires executable memory to work. Security mechanisms
+# such as SELinux may disallow it. glib gracefully falls back to un-optimized
+# code. This check serves as a warning to not rely on G_REGEX_OPTIMIZE:
+sc_G_REGEX_OPTIMIZE:
+	@prohibit='G_REGEX_OPTIMIZE' \
+	exclude='see sc_G_REGEX_OPTIMIZE' \
+	halt='Optimizations may not work everywhere. Read the warning in build-aux/syntax-check.mk' \
+	  $(_sc_search_regexp)
 
 ## ---------- ##
 ## Exceptions ##
@@ -1550,6 +1559,9 @@ exclude_file_name_regexp--sc_spacing-check = \
 exclude_file_name_regexp--sc_prohibit_inline_functions = \
   ^src/storage_file/storage_source.*.c$$
 
+exclude_file_name_regexp--sc_G_REGEX_OPTIMIZE = \
+	^build-aux/syntax-check\.mk$$
+
 ## -------------- ##
 ## Implementation ##
 ## -------------- ##

src/conf/domain_event.c

@@ -2643,7 +2643,7 @@ virDomainQemuMonitorEventStateRegisterID(virConnectPtr conn,
     data->flags = flags;
     if (event && flags != -1) {
         if (flags & VIR_CONNECT_DOMAIN_QEMU_MONITOR_EVENT_REGISTER_REGEX) {
-            int cflags = G_REGEX_OPTIMIZE;
+            int cflags = G_REGEX_OPTIMIZE; /* see sc_G_REGEX_OPTIMIZE */
             g_autoptr(GError) err = NULL;
 
             if (flags & VIR_CONNECT_DOMAIN_QEMU_MONITOR_EVENT_REGISTER_NOCASE)

src/util/vircommand.c

@@ -3270,7 +3270,7 @@ virCommandRunRegex(virCommand *cmd,
 
     for (i = 0; i < nregex; i++) {
         g_autoptr(GError) err = NULL;
-        reg[i] = g_regex_new(regex[i], G_REGEX_OPTIMIZE, 0, &err);
+        reg[i] = g_regex_new(regex[i], G_REGEX_OPTIMIZE, 0, &err); /* see sc_G_REGEX_OPTIMIZE */
         if (!reg[i]) {
             virReportError(VIR_ERR_INTERNAL_ERROR,
                            _("Failed to compile regex %1$s"), err->message);

src/util/virlog.c

@@ -253,7 +253,7 @@ virLogOnceInit(void)
     virLogLock();
     virLogDefaultPriority = VIR_LOG_DEFAULT;
 
-    virLogRegex = g_regex_new(VIR_LOG_REGEX, G_REGEX_OPTIMIZE, 0, NULL);
+    virLogRegex = g_regex_new(VIR_LOG_REGEX, G_REGEX_OPTIMIZE, 0, NULL); /* see sc_G_REGEX_OPTIMIZE */
 
     /* GLib caches the hostname using a one time thread initializer.
      * We want to prime this cache early though, because at later time