From: Stephen Smalley <sds@tycho.nsa.gov>
To: selinux@tycho.nsa.gov
Subject: Re: [PATCH 0/2 v2] Enable direct compare of policy file with kernel policy
Date: Mon, 28 Nov 2016 14:11:41 -0500 [thread overview]
Message-ID: <296348c7-1024-abb7-fad3-d7074bd3bcfd@tycho.nsa.gov> (raw)
In-Reply-To: <1480357758-7025-1-git-send-email-sds@tycho.nsa.gov>
On 11/28/2016 01:29 PM, Stephen Smalley wrote:
> To date we have been unable to directly compare a policy file,
> e.g. /etc/selinux/targeted/policy/policy.30, with the kernel policy,
> i.e. /sys/fs/selinux/policy, due to non-semantic differences in
> the two policy images (e.g. ordering issues). sediff can be used
> to compare the two, but sediff is incomplete in its coverage and
> is necessarily less efficient than a simple cmp of two files.
> These two commits make it possible to directly compare a policy
> file with a kernel policy after normalizing them both through
> checkpolicy, ala:
>
> checkpolicy -M -b /etc/selinux/targeted/policy/policy.30 -o policy.1
> checkpolicy -M -b /sys/fs/selinux/policy -o policy.2
> cmp policy.1 policy.2
>
> Caveat: Un-tested with Android policy; might still differ on xperms
> ordering issues.
Looks like you have to run the Android policy through checkpolicy a
couple of times to get it directly comparable this way:
adb pull /sepolicy
adb pull /sys/fs/selinux/policy
checkpolicy -M -b policy -o policy.1
checkpolicy -M -b sepolicy -o sepolicy.1
checkpolicy -M -b sepolicy.1 -o sepolicy.2
cmp policy.1 sepolicy.2
Likely avtab xperms entries just reversing their ordering through a
policydb_read();policydb_write() cycle.
>
> Stephen Smalley (2):
> libsepol: do not write object_r types to policy file
> libsepol,checkpolicy: convert rangetrans and filenametrans to hashtabs
>
> checkpolicy/policy_define.c | 57 ++---
> checkpolicy/test/dispol.c | 36 +++-
> libsepol/cil/src/cil_binary.c | 79 ++++---
> libsepol/include/sepol/policydb/context.h | 40 ++++
> libsepol/include/sepol/policydb/policydb.h | 18 +-
> libsepol/src/expand.c | 152 +++++++-------
> libsepol/src/mls.c | 52 +++--
> libsepol/src/policydb.c | 321 +++++++++++++++++++----------
> libsepol/src/write.c | 198 ++++++++++++------
> 9 files changed, 623 insertions(+), 330 deletions(-)
>
prev parent reply other threads:[~2016-11-28 19:08 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-28 18:29 [PATCH 0/2 v2] Enable direct compare of policy file with kernel policy Stephen Smalley
2016-11-28 18:29 ` [PATCH 1/2 v2] libsepol: do not write object_r types to policy file Stephen Smalley
2016-11-28 18:29 ` [PATCH 2/2 v2] libsepol, checkpolicy: convert rangetrans and filenametrans to hashtabs Stephen Smalley
2016-12-12 15:35 ` Stephen Smalley
2016-11-28 19:11 ` Stephen Smalley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=296348c7-1024-abb7-fad3-d7074bd3bcfd@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.