James Carter 9d8fd6e9b9 libsepol: Further improve binary policy optimization ... This improves commit b8213acf (libsepol: add a function to optimize kernel policy) by Ondrej Mosnacek <omosnace@redhat.com> by always removing redundant conditional rules which have an identical rule in the unconditional policy. Add a flag called not_cond to is_avrule_redundant(). When checking unconditional rules against the avtab (which stores the unconditional rules) we need to skip the actual rule that we are checking (otherwise a rule would be determined to be redundant with itself and bad things would happen), but when checking a conditional rule against the avtab we do not want to skip an identical rule (which is what currently happens), we want to remove the redundant permissions in the conditional rule. A couple of examples to illustrate when redundant condtional rules are not removed. Example 1 allow t1 t2:class1 perm1; if (bool1) { allow t1 t2:class1 perm1; } The conditional rule is clearly redundant, but without this change it will not be removed, because of the check for an identical rule. Example 2 typeattribute t1 a1; allow t1 t2:class1 perm1; allow a1 t2:class1 perm1; if (bool1) { allow t1 t2:class1 perm1; } The conditional rule is again clearly redundant, but now the order of processing during the optimization will determine whether or not the rule is removed. Because a1 contains only t1, a1 and t1 are considered to be supersets of each other. If the rule with the attribute is processed first, then it will be determined to be redundant and removed, so the conditional rule will not be removed. But if the rule with the type is processed first, then it will be removed and the conditional rule will be determined to be redundant with the rule with the attribute and removed as well. The change reduces the size of policy a bit more than the original optimization. Looking at the change in number of allow rules, there is about a 10% improvement over the old optimization. orig old new Refpolicy 113284 82467 78053 Fedora 106410 64015 60008 Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>		2019-09-30 15:13:17 -04:00
..
cil	Fix many misspellings	2019-09-18 22:47:35 +02:00
include	Fix many misspellings	2019-09-18 22:47:35 +02:00
man	selinux: Update manpages after removing legacy boolean and user code	2019-07-29 23:46:47 +02:00
src	libsepol: Further improve binary policy optimization	2019-09-30 15:13:17 -04:00
tests	libsepol, libsemanage: add a macro to silence static analyzer warnings in tests	2019-09-30 08:43:41 -04:00
utils	libsepol: build: follow standard semantics for DESTDIR and PREFIX	2018-02-14 15:59:36 +01:00
.gitignore	libsepol: build cil into libsepol	2014-08-26 08:03:31 -04:00
COPYING	initial import from svn trunk revision 2950	2008-08-19 15:30:36 -04:00
Makefile	libsepol: build cil into libsepol	2014-08-26 08:03:31 -04:00
VERSION	Update VERSIONs to 2.9 for release.	2019-03-15 11:32:30 +01:00