Applied the series.
Thanks for your reviews and feedback.
Jim
On 06/19/2015 02:19 PM, James Carter wrote:
V3 fixes the following issues:
- Patch 02/10 added more detail to commit message.
- Patch 02/10 changed label from "out" to "oom".
- Patch 03/10 fixed whitespace problem.
- Patch 04/10 removed unused parameter in bounds_expand_parent_rules() and bounds_not_covered(), and added unused attribute to parameter in bounds_check_type_callback().
- Patch 06/10 fixed whitespace problem.
- Patch 07/10 initialize type_value_to_cil, class_value_to_cil, and perm_value_to_cil to NULL.
- Patch 07/10 check for NULL value after calloc for perm_value_to_cil[i].
- Patch 08/10 removed unused parameter in cil_classperms_from_sepol() and cil_avrule_from_sepol().
- Patch 08/10 use unsigned instead of int for loop index in cil_classperms_from_sepol().
V2 fixes the following issues:
- Patch 02/10 uses ebitmap_cpy() instead of individual ebitmap_set_bit() calls.
- Patch 03/10 just the offending permissions are reported during neverallow checking.
- Patch 03/10 checks and handles failure on ebitmap_and() calls.
- Patch 03/10 removes some of the duplicated logic between checking and reporting.
- Patch 05/10 uses the newly added ebitmap_match_any() function instead of its own.
- Patch 05/10 ignores macros and abstract blocks when walking the AST. If in the
future there are other users of cil_find.c, then we can make this functionality
configureable then.
This patch set refactors libsepol's neverallow and bounds checking, refactors CIL's
neverallow checking, and adds bounds checking to CIL.
It also results in improved memory usage and speed. With a test policy.conf derived
from Refpolicy with typebounds statements added (but no violations of neverallow
rules or type bounds) the following improvements are seen:
Before: 9,605M of memory and 22.5 sec.
Now : 125M of memory and 2.1 sec.
(Memory usage as reported by valgrind)
In addition to adding bounds checking to CIL. This patch set also improves the error
reporting for neverallow rule violations and CIL will now report all violations
instead of stopping at the first one.
James Carter (10):
libsepol: Add new ebitmap function named ebitmap_match_any()
libsepol: Treat types like an attribute in the attr_type_map.
libsepol: Refactored neverallow checking.
libsepol: Refactored bounds (hierarchy) checking code
libsepol/cil: Add function to search the CIL AST for an AV rule.
libsepol/cil: Refactored CIL neverallow checking and reporting.
libsepol/cil: Track number of classes and number of types and
attributes.
libsepol/cil: Add CIL bounds checking and reporting.
secilc: Add a CIL policy file to test neverallow checking.
secilc: Add a CIL policy file to test bounds checking.
libsepol/cil/src/cil.c | 3 +-
libsepol/cil/src/cil_binary.c | 700 ++++++++++++++-----
libsepol/cil/src/cil_binary.h | 8 +-
libsepol/cil/src/cil_find.c | 305 +++++++++
libsepol/cil/src/cil_find.h | 39 ++
libsepol/cil/src/cil_internal.h | 2 +
libsepol/cil/src/cil_post.c | 26 +-
libsepol/include/sepol/policydb/ebitmap.h | 1 +
libsepol/include/sepol/policydb/hierarchy.h | 11 +
libsepol/include/sepol/policydb/policydb.h | 2 +-
libsepol/src/assertion.c | 272 +++++---
libsepol/src/ebitmap.c | 22 +
libsepol/src/expand.c | 24 +-
libsepol/src/hierarchy.c | 996 +++++++++++++++++-----------
libsepol/src/policydb.c | 4 +
secilc/test/bounds.cil | 241 +++++++
secilc/test/neverallow.cil | 79 +++
17 files changed, 2077 insertions(+), 658 deletions(-)
create mode 100644 libsepol/cil/src/cil_find.c
create mode 100644 libsepol/cil/src/cil_find.h
create mode 100644 secilc/test/bounds.cil
create mode 100644 secilc/test/neverallow.cil
--
James Carter <jwcart2@xxxxxxxxxxxxx>
National Security Agency
_______________________________________________
Selinux mailing list
Selinux@xxxxxxxxxxxxx
To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx.
To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
