On Wed, Mar 4, 2020 at 4:50 AM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote: > > Tne value attrs_expand_size == 1 removes all empty attributes, but it > also makes sense to expand all attributes that have only one type. This > removes some redundant rules (there is sometimes the same rule for the > type and the attribute) and reduces the number of attributes that the > kernel has to go through when looking up rules. > > Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> > --- > libsepol/cil/src/cil.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c > index d222ad3a..31380e8b 100644 > --- a/libsepol/cil/src/cil.c > +++ b/libsepol/cil/src/cil.c > @@ -452,7 +452,8 @@ void cil_db_init(struct cil_db **db) > (*db)->disable_dontaudit = CIL_FALSE; > (*db)->disable_neverallow = CIL_FALSE; > (*db)->attrs_expand_generated = CIL_FALSE; > - (*db)->attrs_expand_size = 1; > + /* 2 == remove attributes that cointain none or just 1 type */ s/cointain/contain/
