From: James Carter <jwcart2@tycho.nsa.gov>
To: selinux@vger.kernel.org
Subject: [PATCH 0/2] libsepol: Add ability to sort ocontexts in libsepol and add option to use it in checkpolicy
Date: Fri, 5 Oct 2018 09:57:18 -0400 [thread overview]
Message-ID: <20181005135720.13943-1-jwcart2@tycho.nsa.gov> (raw)
ocontexts (initial sids, fs_use_*, genfscon, portcon, etc) are sorted by libsemanage when using policy modules and by libsepol when using CIL, but they are not sorted by checkpolicy when creating a policy from a policy.conf.
Checkpolicy's behavior allows control over the ordering which determines the matching order for portcons and other ocontext rules, but there are times when that specific control is not desired.
This patch set exposes an internal ocontext sorting function and adds a command line option to checkpolicy to sort ocontexts.
James Carter (2):
libsepol: Create policydb_sort_ocontexts()
checkpolicy: Add option to sort ocontexts when creating a binary
policy
checkpolicy/checkpolicy.c | 22 +++++++++++++++++-----
libsepol/include/sepol/policydb/policydb.h | 2 ++
libsepol/src/policydb.c | 5 +++++
3 files changed, 24 insertions(+), 5 deletions(-)
--
2.17.1
next reply other threads:[~2018-10-05 14:06 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-05 13:57 James Carter [this message]
2018-10-05 13:57 ` [PATCH 1/2] libsepol: Create policydb_sort_ocontexts() James Carter
2018-10-05 13:57 ` [PATCH 2/2] checkpolicy: Add option to sort ocontexts when creating a binary policy James Carter
2018-10-11 12:35 [PATCH 0/2] libsepol: Add ability to sort ocontexts in libsepol and add option to use it in checkpolicy James Carter
2018-10-12 17:38 ` William Roberts
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181005135720.13943-1-jwcart2@tycho.nsa.gov \
--to=jwcart2@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.