RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

checkpolicy: add flag to enable policy optimization 

Add the command-line option 'O' to checkpolicy to cause kernel policies
to be optimized by calling policydb_optimize() before being written out.

This option can be used on conf files and binary kernel policies, but
not when converting a conf file to CIL.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
[omosnace: make commit desc more consistent with the other patches]
[omosnace: fix a typo in the commit message]
[omosnace: directly use policydb_optimize() as also the rest of code already uses
 other policydb_*() functions...]
[omosnace: update man page]
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This commit is contained in:
James Carter 2019-06-13 13:45:58 +02:00
parent f7cb5901f1
commit 071247e8f4
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
checkpolicy/checkpolicy.8
View File

@ -48,6 +48,9 @@ Sort ocontexts before writing out the binary policy. This option makes output of
.B \-t,\-\-target
Specify the target platform (selinux or xen).
.TP
.B \-O,\-\-optimize
Optimize the final kernel policy (remove redundant rules).
.TP
.B \-V,\-\-version
Show version information.
.TP

16
checkpolicy/checkpolicy.c
View File

@ -394,7 +394,7 @@ int main(int argc, char **argv)
size_t scontext_len, pathlen;
unsigned int i;
unsigned int protocol, port;
unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0;
unsigned int binary = 0, debug = 0, sort = 0, cil = 0, conf = 0, optimize = 0;
struct val_to_name v;
int ret, ch, fd, target = SEPOL_TARGET_SELINUX;
unsigned int nel, uret;
@ -419,11 +419,12 @@ int main(int argc, char **argv)
{"cil", no_argument, NULL, 'C'},
{"conf",no_argument, NULL, 'F'},
{"sort", no_argument, NULL, 'S'},
{"optimize", no_argument, NULL, 'O'},
{"help", no_argument, NULL, 'h'},
{NULL, 0, NULL, 0}
};
while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:h", long_options, NULL)) != -1) {
while ((ch = getopt_long(argc, argv, "o:t:dbU:MCFSVc:Oh", long_options, NULL)) != -1) {
switch (ch) {
case 'o':
outfile = optarg;
@ -466,6 +467,9 @@ int main(int argc, char **argv)
case 'S':
sort = 1;
break;
case 'O':
optimize = 1;
break;
case 'M':
mlspol = 1;
break;
@ -625,6 +629,14 @@ int main(int argc, char **argv)
if (policydb_load_isids(&policydb, &sidtab))
exit(1);
if (optimize && policydbp->policy_type == POLICY_KERN) {
ret = policydb_optimize(policydbp);
if (ret) {
fprintf(stderr, "%s: error optimizing policy\n", argv[0]);
exit(1);
}
}
if (outfile) {
outfp = fopen(outfile, "w");
if (!outfp) {