From: James Carter <jwcart2@xxxxxxxxxxxxx>
Add the command-line option 'O' to checkpolicy to cause kernel policies
to be optimized by calling policydb_optimize() before being written out.
This option can be used on conf files and binary kernel policies, but
not when converting a conf file to CIL.
Signed-off-by: James Carter <jwcart2@xxxxxxxxxxxxx>
[omosnace: make commit desc more consistent with the other patches]
[omosnace: fix a typo in the commit message]
[omosnace: directly use policydb_optimize() as also the rest of code already uses
other policydb_*() functions...]
Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
---
checkpolicy/checkpolicy.c | 16 ++++++++++++++--
secilc/secilc.c | 12 ++++++------
2 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c
index e0a00f7c..f928ec06 100644
--- a/checkpolicy/checkpolicy.c
+++ b/checkpolicy/checkpolicy.c
@@ -394,7 +394,7 @@ int main(int argc, char **argv)
size_t scontext_len, pathlen;
unsigned int i;
unsigned int protocol, port;
- unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0;
+ unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0;
struct val_to_name v;
int ret, ch, fd, target = SEPOL_TARGET_SELINUX;
unsigned int nel, uret;
@@ -419,11 +419,12 @@ int main(int argc, char **argv)
{"cil", no_argument, NULL, 'C'},
{"conf",no_argument, NULL, 'F'},
{"sort", no_argument, NULL, 'S'},
+ {"optimize", no_argument, NULL, 'O'},
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0}
};
- while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:h", long_options, NULL)) != -1) {
+ while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:Oh", long_options, NULL)) != -1) {
switch (ch) {
case 'o':
outfile = optarg;
@@ -466,6 +467,9 @@ int main(int argc, char **argv)
case 'S':
sort = 1;
break;
+ case 'O':
+ optimize = 1;
+ break;
case 'M':
mlspol = 1;
break;
@@ -625,6 +629,14 @@ int main(int argc, char **argv)
if (policydb_load_isids(&policydb, &sidtab))
exit(1);
+ if (optimize && policydbp->policy_type == POLICY_KERN) {
+ ret = policydb_optimize(policydbp);
+ if (ret) {
+ fprintf(stderr, "%s: error optimizing policy\n", argv[0]);
+ exit(1);
+ }
+ }
+
if (outfile) {
outfp = fopen(outfile, "w");
if (!outfp) {
diff --git a/secilc/secilc.c b/secilc/secilc.c
index 26996ef9..9bea3a58 100644
--- a/secilc/secilc.c
+++ b/secilc/secilc.c
@@ -68,7 +68,7 @@ static __attribute__((__noreturn__)) void usage(const char *prog)
printf(" -G, --expand-generated Expand and remove auto-generated attributes\n");
printf(" -X, --expand-size <SIZE> Expand type attributes with fewer than <SIZE>\n");
printf(" members.\n");
- printf(" -n, --no-optimize do not optimize final policy\n");
+ printf(" -O, --optimize-policy optimize final policy\n");
printf(" -v, --verbose increment verbosity level\n");
printf(" -h, --help display usage information\n");
exit(1);
@@ -98,7 +98,7 @@ int main(int argc, char *argv[])
int policyvers = POLICYDB_VERSION_MAX;
int attrs_expand_generated = 0;
int attrs_expand_size = -1;
- int optimize_policy = 1;
+ int optimize_policy = 0;
int opt_char;
int opt_index = 0;
char *fc_buf = NULL;
@@ -119,13 +119,13 @@ int main(int argc, char *argv[])
{"filecontexts", required_argument, 0, 'f'},
{"expand-generated", no_argument, 0, 'G'},
{"expand-size", required_argument, 0, 'X'},
- {"no-optimize", no_argument, 0, 'n'},
+ {"optimize-policy", no_argument, 0, 'O'},
{0, 0, 0, 0}
};
int i;
while (1) {
- opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PDmNc:GX:n", long_opts, &opt_index);
+ opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PDmNOc:GX:n", long_opts, &opt_index);
if (opt_char == -1) {
break;
}
@@ -214,8 +214,8 @@ int main(int argc, char *argv[])
}
break;
}
- case 'n':
- optimize_policy = 0;
+ case 'O':
+ optimize_policy = 1;
break;
case 'h':
usage(argv[0]);
--
2.20.1
