Re: [PATCH 1/2] libsepol: do not write empty class definitions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jan 10, 2023 at 10:27 AM James Carter <jwcart2@xxxxxxxxx> wrote:
>
> On Thu, Jan 5, 2023 at 12:27 PM Christian Göttsche
> <cgzones@xxxxxxxxxxxxxx> wrote:
> >
> > Do not write class definitions for classes without any permission and
> > any inherited common class.  The classes are already declared in
> > write_class_decl_rules_to_conf().  Skipping those empty definitions,
> > which are equal to the corresponding class declarations, will enable to
> > parse the generated policy conf file with checkpolicy, as checkpolicy
> > does not accept class declarations after initial sid declarations.
> >
> > This will enable simple round-trip tests with checkpolicy.
> >
> > Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
>
> Acked-by: James Carter <jwcart2@xxxxxxxxx>
>
Merged.
Thanks,
Jim

> > ---
> >  libsepol/src/kernel_to_conf.c | 21 +++++++++++++--------
> >  1 file changed, 13 insertions(+), 8 deletions(-)
> >
> > diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
> > index 63dffd9b..73b72b5d 100644
> > --- a/libsepol/src/kernel_to_conf.c
> > +++ b/libsepol/src/kernel_to_conf.c
> > @@ -591,16 +591,21 @@ static int write_class_and_common_rules_to_conf(FILE *out, struct policydb *pdb)
> >                 class = pdb->class_val_to_struct[i];
> >                 if (!class) continue;
> >                 name = pdb->p_class_val_to_name[i];
> > -               sepol_printf(out, "class %s", name);
> > -               if (class->comkey) {
> > -                       sepol_printf(out, " inherits %s", class->comkey);
> > -               }
> >                 perms = class_or_common_perms_to_str(&class->permissions);
> > -               if (perms) {
> > -                       sepol_printf(out, " { %s }", perms);
> > -                       free(perms);
> > +               /* Do not write empty classes, their declaration was alreedy
> > +                * printed in write_class_decl_rules_to_conf() */
> > +               if (perms || class->comkey) {
> > +                       sepol_printf(out, "class %s", name);
> > +                       if (class->comkey) {
> > +                               sepol_printf(out, " inherits %s", class->comkey);
> > +                       }
> > +
> > +                       if (perms) {
> > +                               sepol_printf(out, " { %s }", perms);
> > +                               free(perms);
> > +                       }
> > +                       sepol_printf(out, "\n");
> >                 }
> > -               sepol_printf(out, "\n");
> >         }
> >
> >  exit:
> > --
> > 2.39.0
> >




[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux