On Thu, Mar 5, 2020 at 8:53 AM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote: > > The value attrs_expand_size == 1 removes all empty attributes, but it > also makes sense to expand all attributes that have only one type. This > removes some redundant rules (there is sometimes the same rule for the > type and the attribute) and reduces the number of attributes that the > kernel has to go through when looking up rules. > > Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> Acked-by: James Carter <jwcart2@xxxxxxxxx> > --- > > v2: fix typos (Tne -> The; cointains -> contains) > > libsepol/cil/src/cil.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c > index d222ad3a..c010ca2a 100644 > --- a/libsepol/cil/src/cil.c > +++ b/libsepol/cil/src/cil.c > @@ -452,7 +452,8 @@ void cil_db_init(struct cil_db **db) > (*db)->disable_dontaudit = CIL_FALSE; > (*db)->disable_neverallow = CIL_FALSE; > (*db)->attrs_expand_generated = CIL_FALSE; > - (*db)->attrs_expand_size = 1; > + /* 2 == remove attributes that contain none or just 1 type */ > + (*db)->attrs_expand_size = 2; > (*db)->preserve_tunables = CIL_FALSE; > (*db)->handle_unknown = -1; > (*db)->mls = -1; > -- > 2.24.1 >
