James Carter a0914acf2a libsepol/cil: Provide option to allow qualified names in declarations ... Qualified names have "dots" in them. They are generated when a CIL policy is compiled and come from declarations in blocks. If a kernel policy is decompiled into a CIL policy, the resulting policy could have declarations that use qualified names. Compiling this policy would result in an error because "dots" in declarations are not allowed. Qualified names in a policy are normally used to refer to the name of identifiers, blocks, macros, or optionals that are declared in a different block (that is not a parent). Name resolution is based on splitting a name based on the "dots", searching the parents up to the global namespace for the first block using the first part of the name, using the second part of the name to lookup the next block using the first block's symbol tables, looking up the third block in the second's symbol tables, and so on. To allow the option of using qualified names in declarations: 1) Create a field in the struct cil_db called "qualified_names" which is set to CIL_TRUE when qualified names are to be used. This field is checked in cil_verify_name() and "dots" are allowed if qualified names are being allowed. 2) Only allow the direct lookup of the whole name in the global symbol table. This means that blocks, blockinherits, blockabstracts, and in- statements cannot be allowed. Use the "qualified_names" field of the cil_db to know when using one of these should result in an error. 3) Create the function cil_set_qualified_names() that is used to set the "qualified_names" field. Export the function in libsepol. Signed-off-by: James Carter <jwcart2@gmail.com>		2021-07-03 16:00:26 +02:00
..
cil.h	libsepol/cil: Provide option to allow qualified names in declarations	2021-07-03 16:00:26 +02:00