On Mon, Mar 9, 2020 at 9:17 AM James Carter <jwcart2@xxxxxxxxx> wrote: > > On Thu, Mar 5, 2020 at 8:53 AM Ondrej Mosnacek <omosnace@xxxxxxxxxx> wrote: > > > > The value attrs_expand_size == 1 removes all empty attributes, but it > > also makes sense to expand all attributes that have only one type. This > > removes some redundant rules (there is sometimes the same rule for the > > type and the attribute) and reduces the number of attributes that the > > kernel has to go through when looking up rules. > > > > Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx> > > Acked-by: James Carter <jwcart2@xxxxxxxxx> > Thanks, applied. Jim > > --- > > > > v2: fix typos (Tne -> The; cointains -> contains) > > > > libsepol/cil/src/cil.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c > > index d222ad3a..c010ca2a 100644 > > --- a/libsepol/cil/src/cil.c > > +++ b/libsepol/cil/src/cil.c > > @@ -452,7 +452,8 @@ void cil_db_init(struct cil_db **db) > > (*db)->disable_dontaudit = CIL_FALSE; > > (*db)->disable_neverallow = CIL_FALSE; > > (*db)->attrs_expand_generated = CIL_FALSE; > > - (*db)->attrs_expand_size = 1; > > + /* 2 == remove attributes that contain none or just 1 type */ > > + (*db)->attrs_expand_size = 2; > > (*db)->preserve_tunables = CIL_FALSE; > > (*db)->handle_unknown = -1; > > (*db)->mls = -1; > > -- > > 2.24.1 > >
