RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libsepol/cil: Add support for using qualified names to secil2conf 

Provide the option "-Q" or "--qualified-names" to indicate that the
policy is using qualified names.

Using qualified names means that declaration names can have "dots"
in them, but blocks, blockinherits, blockabstracts, and in-statements
are not allowed in the policy.

The libsepol function cil_set_qualified_names() is called with the
desired value for the CIL db's "qualified_names" field.

Signed-off-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
James Carter 2021-06-29 11:14:02 -04:00 committed by Nicolas Iooss
parent 74c06d763f
commit 532a4cc336
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
secilc/secil2conf.8.xml
View File

@ -50,6 +50,11 @@
<listitem><para>Treat tunables as booleans.</para></listitem> <listitem><para>Treat tunables as booleans.</para></listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term><option>-Q, --qualified-names</option></term>
<listitem><para>Allow names containing dots (qualified names). Blocks, blockinherits, blockabstracts, and in-statements will not be allowed.</para></listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><option>-v, --verbose</option></term> <term><option>-v, --verbose</option></term>
<listitem><para>Increment verbosity level.</para></listitem> <listitem><para>Increment verbosity level.</para></listitem>

11
secilc/secil2conf.c
View File

@ -52,6 +52,9 @@ static __attribute__((__noreturn__)) void usage(const char *prog)
printf(" This will override the (mls boolean) statement\n"); printf(" This will override the (mls boolean) statement\n");
printf(" if present in the policy\n"); printf(" if present in the policy\n");
printf(" -P, --preserve-tunables treat tunables as booleans\n"); printf(" -P, --preserve-tunables treat tunables as booleans\n");
printf(" -Q, --qualified-names Allow names containing dots (qualified names).\n");
printf(" Blocks, blockinherits, blockabstracts, and\n");
printf(" in-statements will not be allowed.\n");
printf(" -v, --verbose increment verbosity level\n"); printf(" -v, --verbose increment verbosity level\n");
printf(" -h, --help display usage information\n"); printf(" -h, --help display usage information\n");
exit(1); exit(1);
@ -68,6 +71,7 @@ int main(int argc, char *argv[])
struct cil_db *db = NULL; struct cil_db *db = NULL;
int mls = -1; int mls = -1;
int preserve_tunables = 0; int preserve_tunables = 0;
int qualified_names = 0;
int opt_char; int opt_char;
int opt_index = 0; int opt_index = 0;
enum cil_log_level log_level = CIL_ERR; enum cil_log_level log_level = CIL_ERR;
@ -76,13 +80,14 @@ int main(int argc, char *argv[])
{"verbose", no_argument, 0, 'v'}, {"verbose", no_argument, 0, 'v'},
{"mls", required_argument, 0, 'M'}, {"mls", required_argument, 0, 'M'},
{"preserve-tunables", no_argument, 0, 'P'}, {"preserve-tunables", no_argument, 0, 'P'},
{"qualified-names", no_argument, 0, 'Q'},
{"output", required_argument, 0, 'o'}, {"output", required_argument, 0, 'o'},
{0, 0, 0, 0} {0, 0, 0, 0}
}; };
int i; int i;
while (1) { while (1) {
opt_char = getopt_long(argc, argv, "o:hvM:P", long_opts, &opt_index); opt_char = getopt_long(argc, argv, "o:hvM:PQ", long_opts, &opt_index);
if (opt_char == -1) { if (opt_char == -1) {
break; break;
} }
@ -102,6 +107,9 @@ int main(int argc, char *argv[])
case 'P': case 'P':
preserve_tunables = 1; preserve_tunables = 1;
break; break;
case 'Q':
qualified_names = 1;
break;
case 'o': case 'o':
output = strdup(optarg); output = strdup(optarg);
break; break;
@ -123,6 +131,7 @@ int main(int argc, char *argv[])
cil_db_init(&db); cil_db_init(&db);
cil_set_preserve_tunables(db, preserve_tunables); cil_set_preserve_tunables(db, preserve_tunables);
cil_set_qualified_names(db, qualified_names);
cil_set_mls(db, mls); cil_set_mls(db, mls);
cil_set_attrs_expand_generated(db, 0); cil_set_attrs_expand_generated(db, 0);
cil_set_attrs_expand_size(db, 0); cil_set_attrs_expand_size(db, 0);