On 06/11/2015 04:03 PM, Stephen Smalley wrote:
On 06/11/2015 02:26 PM, James Carter wrote:Types are treated as attributes that contain only themselves. This is how types are already treated in the type_attr_map. Treating types this way makes finding rules that apply to a given type much easier. Signed-off-by: James Carter <jwcart2@xxxxxxxxxxxxx> --- libsepol/src/expand.c | 26 +++++++++++++++++--------- libsepol/src/policydb.c | 4 ++++ 2 files changed, 21 insertions(+), 9 deletions(-) diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c index b999890..cbd39df 100644 --- a/libsepol/src/expand.c +++ b/libsepol/src/expand.c @@ -2317,25 +2317,33 @@ static int type_attr_map(hashtab_key_t key policydb_t *p = state->out; unsigned int i; ebitmap_node_t *tnode; + int value; type = (type_datum_t *) datum; + value = type->s.value; + if (type->flavor == TYPE_ATTRIB) { - if (ebitmap_cpy(&p->attr_type_map[type->s.value - 1], - &type->types)) { - ERR(state->handle, "Out of memory!"); - return -1; - } ebitmap_for_each_bit(&type->types, tnode, i) { if (!ebitmap_node_get_bit(tnode, i)) continue; - if (ebitmap_set_bit(&p->type_attr_map[i], - type->s.value - 1, 1)) { - ERR(state->handle, "Out of memory!"); - return -1; + if (ebitmap_set_bit(&p->type_attr_map[i], value - 1, 1)) { + goto out; } + if (ebitmap_set_bit(&p->attr_type_map[value - 1], i, 1)) { + goto out;Why populate attr_type_map here via individual ebitmap_set_bit() calls rather than just a single ebitmap_cpy() as above?
I was conflicted on what was the best way to do this. The ebitmap_cpy() does an ebitmap_init() and I thought that it might be clearer to leave the ebitmap_init() close to where the attr_type_map is malloc'd.
I could use ebitmap_union() here if you would prefer.
+ } + } + } else { + if (ebitmap_set_bit(&p->attr_type_map[value - 1], value - 1, 1)) { + goto out; } } + return 0; + +out: + ERR(state->handle, "Out of memory!"); + return -1; } /* converts typeset using typemap and expands into ebitmap_t types using the attributes in the passed in policy. diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c index 8c3c7ac..be0c701 100644 --- a/libsepol/src/policydb.c +++ b/libsepol/src/policydb.c @@ -3936,6 +3936,10 @@ int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose) /* add the type itself as the degenerate case */ if (ebitmap_set_bit(&p->type_attr_map[i], i, 1)) goto bad; + if (p->type_val_to_struct[i]->flavor != TYPE_ATTRIB) { + if (ebitmap_set_bit(&p->attr_type_map[i], i, 1)) + goto bad; + } } }
-- James Carter <jwcart2@xxxxxxxxxxxxx> National Security Agency _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
