RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libsepol/cil: Limit the neverallow violations reported 

When there is a neverallow violation, a search is made for all of
the rules that violate the neverallow. The violating rules as well
as their parents are written out to make it easier to find these
rules.

If there is a lot of rules that violate a neverallow, then this
amount of reporting is too much. Instead, only print out the first
four rules (with their parents) that match the violated neverallow
rule along with the total number of rules that violate the
neverallow at the default log level. Report all the violations when
at a higher verbosity level.

Signed-off-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
James Carter 2022-01-18 16:24:07 -05:00
parent 3c45d91cd0
commit c964fe14f4
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libsepol/cil/src/cil_binary.c
View File

@ -4640,6 +4640,9 @@ static int __cil_print_neverallow_failure(const struct cil_db *db, struct cil_tr
char *neverallow_str;
char *allow_str;
enum cil_flavor avrule_flavor;
int num_matching = 0;
int count_matching = 0;
enum cil_log_level log_level = cil_get_log_level();
target.rule_kind = CIL_AVRULE_ALLOWED;
target.is_extended = cil_rule->is_extended;
@ -4666,11 +4669,19 @@ static int __cil_print_neverallow_failure(const struct cil_db *db, struct cil_tr
goto exit;
}
cil_list_for_each(i2, matching) {
num_matching++;
}
cil_list_for_each(i2, matching) {
n2 = i2->data;
r2 = n2->data;
__cil_print_parents(" ", n2);
__cil_print_rule(" ", allow_str, r2);
count_matching++;
if (count_matching >= 4 && num_matching > 4 && log_level == CIL_ERR) {
cil_log(CIL_ERR, " Only first 4 of %d matching rules shown (use \"-v\" to show all)\n", num_matching);
break;
}
}
cil_log(CIL_ERR,"\n");
cil_list_destroy(&matching, CIL_FALSE);