RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux/secilc/test/opt-expected.cil

61 lines
1.4 KiB
Plaintext
Raw Normal View History

secilc: add basic test for policy optimization Add a simple test for secilc -O to make sure that it produces the expected output. This might produce some false positives when the output of secilc/checkpolicy changes slightly, in which case the expected CIL will need to be updated along with the change. The test should normally work even with a checkpolicy built from an older tree, as long as it produces the same CIL output, so it uses the checkpolicy it finds in PATH by default. The test policy is taken from an e-mail from James Carter: https://lore.kernel.org/selinux/CAP+JOzTQQx6aM81QyVe0yoiPJeDU+7xE6nn=0UMAB1EZ_c9ryA@mail.gmail.com/T/ Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-03-16 09:55:23 +00:00
(handleunknown deny)
(class cl01 (p01a p01b p11a p11b))
(classorder (cl01))
(sid kernel)
(sidorder (kernel))
(mls true)
(sensitivity s01)
(sensitivityorder (s01))
(category c01)
(categoryorder (c01))
(sensitivitycategory s01 (c01))
secilc: Fix policy optimization test Commit 692716fc5fd5 ("libsepol/cil: raise default attrs_expand_size to 2") was reverted and attributes with one type are not expanded anymore. Fixes: ./secilc test/policy.cil ./secilc -c 32 -O -M 1 -f /dev/null -o opt-actual.bin test/opt-input.cil checkpolicy -b -C -M -o opt-actual.cil opt-actual.bin >/dev/null diff test/opt-expected.cil opt-actual.cil 11a12 > (typeattribute at01) 21a23 > (typeattributeset at01 (tp01)) 25c27,28 < (allow tp01 self (cl01 (p01a p01b p11a p11b))) --- > (allow tp01 at01 (cl01 (p11b))) > (allow tp01 self (cl01 (p01a p01b p11a))) Signed-off-by: Petr Lautrbach <plautrba@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-05-13 14:43:29 +00:00
(typeattribute at01)
secilc: add basic test for policy optimization Add a simple test for secilc -O to make sure that it produces the expected output. This might produce some false positives when the output of secilc/checkpolicy changes slightly, in which case the expected CIL will need to be updated along with the change. The test should normally work even with a checkpolicy built from an older tree, as long as it produces the same CIL output, so it uses the checkpolicy it finds in PATH by default. The test policy is taken from an e-mail from James Carter: https://lore.kernel.org/selinux/CAP+JOzTQQx6aM81QyVe0yoiPJeDU+7xE6nn=0UMAB1EZ_c9ryA@mail.gmail.com/T/ Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-03-16 09:55:23 +00:00
(typeattribute at02)
(boolean b01 false)
(type tp01)
(type tp02)
(type tp04)
(type tpr1)
(type tpr2)
(type tpr3)
(type tpr4)
(type tpr5)
secilc: Fix policy optimization test Commit 692716fc5fd5 ("libsepol/cil: raise default attrs_expand_size to 2") was reverted and attributes with one type are not expanded anymore. Fixes: ./secilc test/policy.cil ./secilc -c 32 -O -M 1 -f /dev/null -o opt-actual.bin test/opt-input.cil checkpolicy -b -C -M -o opt-actual.cil opt-actual.bin >/dev/null diff test/opt-expected.cil opt-actual.cil 11a12 > (typeattribute at01) 21a23 > (typeattributeset at01 (tp01)) 25c27,28 < (allow tp01 self (cl01 (p01a p01b p11a p11b))) --- > (allow tp01 at01 (cl01 (p11b))) > (allow tp01 self (cl01 (p01a p01b p11a))) Signed-off-by: Petr Lautrbach <plautrba@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-05-13 14:43:29 +00:00
(typeattributeset at01 (tp01))
secilc: add basic test for policy optimization Add a simple test for secilc -O to make sure that it produces the expected output. This might produce some false positives when the output of secilc/checkpolicy changes slightly, in which case the expected CIL will need to be updated along with the change. The test should normally work even with a checkpolicy built from an older tree, as long as it produces the same CIL output, so it uses the checkpolicy it finds in PATH by default. The test policy is taken from an e-mail from James Carter: https://lore.kernel.org/selinux/CAP+JOzTQQx6aM81QyVe0yoiPJeDU+7xE6nn=0UMAB1EZ_c9ryA@mail.gmail.com/T/ Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-03-16 09:55:23 +00:00
(typeattributeset at02 (tp01 tp02))
(allow at02 tpr1 (cl01 (p01a p01b p11a)))
(allow at02 tpr3 (cl01 (p01a p01b p11a)))
secilc: Fix policy optimization test Commit 692716fc5fd5 ("libsepol/cil: raise default attrs_expand_size to 2") was reverted and attributes with one type are not expanded anymore. Fixes: ./secilc test/policy.cil ./secilc -c 32 -O -M 1 -f /dev/null -o opt-actual.bin test/opt-input.cil checkpolicy -b -C -M -o opt-actual.cil opt-actual.bin >/dev/null diff test/opt-expected.cil opt-actual.cil 11a12 > (typeattribute at01) 21a23 > (typeattributeset at01 (tp01)) 25c27,28 < (allow tp01 self (cl01 (p01a p01b p11a p11b))) --- > (allow tp01 at01 (cl01 (p11b))) > (allow tp01 self (cl01 (p01a p01b p11a))) Signed-off-by: Petr Lautrbach <plautrba@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-05-13 14:43:29 +00:00
(allow tp01 at01 (cl01 (p11b)))
(allow tp01 self (cl01 (p01a p01b p11a)))
secilc: add basic test for policy optimization Add a simple test for secilc -O to make sure that it produces the expected output. This might produce some false positives when the output of secilc/checkpolicy changes slightly, in which case the expected CIL will need to be updated along with the change. The test should normally work even with a checkpolicy built from an older tree, as long as it produces the same CIL output, so it uses the checkpolicy it finds in PATH by default. The test policy is taken from an e-mail from James Carter: https://lore.kernel.org/selinux/CAP+JOzTQQx6aM81QyVe0yoiPJeDU+7xE6nn=0UMAB1EZ_c9ryA@mail.gmail.com/T/ Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Acked-by: James Carter <jwcart2@gmail.com>
2020-03-16 09:55:23 +00:00
(allow tp01 tpr1 (cl01 (p11b)))
(dontaudit at02 tpr2 (cl01 (p01a p01b p11a)))
(dontaudit at02 tpr4 (cl01 (p01a p01b p11a)))
(dontaudit tp01 tpr2 (cl01 (p11b)))
(booleanif b01
(true
(allow tp01 tpr3 (cl01 (p11b)))
(allow tp01 tpr5 (cl01 (p01a p01b p11a p11b)))
(allow tp02 tpr5 (cl01 (p01a p11a)))
(dontaudit tp01 tpr4 (cl01 (p11b)))
)
(false
(allow at02 tpr5 (cl01 (p01a p01b p11a)))
)
)
(role object_r)
(role rl01)
(roletype rl01 tp01)
(roletype object_r tp01)
(roletype object_r tp02)
(roletype object_r tp04)
(roletype object_r tpr1)
(roletype object_r tpr2)
(roletype object_r tpr3)
(roletype object_r tpr4)
(roletype object_r tpr5)
(user us01)
(userrole us01 object_r)
(userrole us01 rl01)
(userlevel us01 (s01))
(userrange us01 ((s01) (s01)))
(sidcontext kernel (us01 rl01 tp01 ((s01) (s01))))