RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-01-21 04:50:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

secilc: Add support for using qualified names to secilc

Browse Source 
Provide the option "-Q" or "--qualified-names" to indicate that the
policy is using qualified names.

Using qualified names means that declaration names can have "dots"
in them, but blocks, blockinherits, blockabstracts, and in-statements
are not allowed in the policy.

The libsepol function cil_set_qualified_names() is called with the
desired value for the CIL db's "qualified_names" field.

Signed-off-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
James Carter 2021-06-29 11:14:00 -04:00 committed by Nicolas Iooss
parent a0914acf2a
commit f7b8b5055f
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
secilc/secilc.8.xml
View File

@ -75,6 +75,11 @@
<listitem><para>Treat tunables as booleans.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>-Q, --qualified-names</option></term>
<listitem><para>Allow names containing dots (qualified names). Blocks, blockinherits, blockabstracts, and in-statements will not be allowed.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>-m, --multiple-decls</option></term>
<listitem><para>Allow some statements to be re-declared.</para></listitem>

11
secilc/secilc.c
View File

@ -63,6 +63,9 @@ static __attribute__((__noreturn__)) void usage(const char *prog)
printf(" statement if present in the policy\n");
printf(" -D, --disable-dontaudit do not add dontaudit rules to the binary policy\n");
printf(" -P, --preserve-tunables treat tunables as booleans\n");
printf(" -Q, --qualified-names Allow names containing dots (qualified names).\n");
printf(" Blocks, blockinherits, blockabstracts, and\n");
printf(" in-statements will not be allowed.\n");
printf(" -m, --multiple-decls allow some statements to be re-declared\n");
printf(" -N, --disable-neverallow do not check neverallow rules\n");
printf(" -G, --expand-generated Expand and remove auto-generated attributes\n");
@ -94,6 +97,7 @@ int main(int argc, char *argv[])
int multiple_decls = 0;
int disable_neverallow = 0;
int preserve_tunables = 0;
int qualified_names = 0;
int handle_unknown = -1;
int policyvers = POLICYDB_VERSION_MAX;
int attrs_expand_generated = 0;
@ -115,6 +119,7 @@ int main(int argc, char *argv[])
{"multiple-decls", no_argument, 0, 'm'},
{"disable-neverallow", no_argument, 0, 'N'},
{"preserve-tunables", no_argument, 0, 'P'},
{"qualified-names", no_argument, 0, 'Q'},
{"output", required_argument, 0, 'o'},
{"filecontexts", required_argument, 0, 'f'},
{"expand-generated", no_argument, 0, 'G'},
@ -125,7 +130,7 @@ int main(int argc, char *argv[])
int i;
while (1) {
opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PDmNOc:GX:n", long_opts, &opt_index);
opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PQDmNOc:GX:n", long_opts, &opt_index);
if (opt_char == -1) {
break;
}
@ -190,6 +195,9 @@ int main(int argc, char *argv[])
case 'P':
preserve_tunables = 1;
break;
case 'Q':
qualified_names = 1;
break;
case 'o':
output = strdup(optarg);
break;
@ -238,6 +246,7 @@ int main(int argc, char *argv[])
cil_set_multiple_decls(db, multiple_decls);
cil_set_disable_neverallow(db, disable_neverallow);
cil_set_preserve_tunables(db, preserve_tunables);
cil_set_qualified_names(db, qualified_names);
if (handle_unknown != -1) {
rc = cil_set_handle_unknown(db, handle_unknown);
if (rc != SEPOL_OK) {