All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel Burgener <dburgener@linux.microsoft.com>
To: James Carter <jwcart2@gmail.com>, selinux@vger.kernel.org
Subject: Re: [PATCH 0/9 v3] Add CIL Deny Rule
Date: Wed, 26 Jul 2023 11:56:34 -0400	[thread overview]
Message-ID: <3eda4dfc-d489-5cc4-ca99-1d0c06ea62aa@linux.microsoft.com> (raw)
In-Reply-To: <20230413193445.588395-1-jwcart2@gmail.com>

On 4/13/2023 3:34 PM, James Carter wrote:
> This patch series depends on the "Add support for notself and other to
> CIL" patch series from April 12th.
> 
> These patches add a deny rule to CIL. Deny rules will be processed after
> everything except for neverallow rules. Unlike neverallow rules, they
> remove the permissions in the deny rule rather than reporting an error.
> 
> See the individual patches for an explanation of what they do.
> 
> Patches 2, 5, 6, and 7 are unchanged from v2. For the other patches, see
> the patch for a list of the changes from v2.
> 
> James Carter (9):
>    libsepol/cil: Parse and add deny rule to AST, but do not process
>    libsepol/cil: Add cil_list_is_empty macro
>    libsepol/cil: Add cil_tree_node_remove function
>    libsepol/cil: Process deny rules
>    libsepol/cil: Add cil_write_post_ast function
>    libsepol: Export the cil_write_post_ast function
>    secilc/secil2tree: Add option to write CIL AST after post processing
>    secilc/test: Add deny rule tests
>    secilc/docs: Add deny rule to CIL documentation
> 
>   libsepol/cil/include/cil/cil.h         |    1 +
>   libsepol/cil/src/cil.c                 |   68 ++
>   libsepol/cil/src/cil_build_ast.c       |   56 +
>   libsepol/cil/src/cil_build_ast.h       |    2 +
>   libsepol/cil/src/cil_copy_ast.c        |   19 +
>   libsepol/cil/src/cil_copy_ast.h        |    1 +
>   libsepol/cil/src/cil_deny.c            | 1413 ++++++++++++++++++++++++
>   libsepol/cil/src/cil_deny.h            |   36 +
>   libsepol/cil/src/cil_flavor.h          |    1 +
>   libsepol/cil/src/cil_internal.h        |   10 +
>   libsepol/cil/src/cil_list.h            |    3 +
>   libsepol/cil/src/cil_post.c            |    7 +
>   libsepol/cil/src/cil_reset_ast.c       |    8 +
>   libsepol/cil/src/cil_resolve_ast.c     |   48 +
>   libsepol/cil/src/cil_resolve_ast.h     |    1 +
>   libsepol/cil/src/cil_tree.c            |   35 +
>   libsepol/cil/src/cil_tree.h            |    1 +
>   libsepol/cil/src/cil_verify.c          |    9 +
>   libsepol/cil/src/cil_write_ast.c       |   10 +
>   libsepol/cil/src/cil_write_ast.h       |    1 +
>   libsepol/src/libsepol.map.in           |    5 +
>   secilc/docs/cil_access_vector_rules.md |   67 ++
>   secilc/secil2tree.c                    |    8 +-
>   secilc/test/deny_rule_test1.cil        |  580 ++++++++++
>   secilc/test/deny_rule_test2.cil        |  418 +++++++
>   25 files changed, 2807 insertions(+), 1 deletion(-)
>   create mode 100644 libsepol/cil/src/cil_deny.c
>   create mode 100644 libsepol/cil/src/cil_deny.h
>   create mode 100644 secilc/test/deny_rule_test1.cil
>   create mode 100644 secilc/test/deny_rule_test2.cil

For patches 1-8:

Reviewed-by: Daniel Burgener <dburgener@linux.microsoft.com>


      parent reply	other threads:[~2023-07-26 15:56 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-04-13 19:34 [PATCH 0/9 v3] Add CIL Deny Rule James Carter
2023-04-13 19:34 ` [PATCH 1/9 v3] libsepol/cil: Parse and add deny rule to AST, but do not process James Carter
2023-04-13 19:34 ` [PATCH 2/9 v3] libsepol/cil: Add cil_list_is_empty macro James Carter
2023-04-13 19:34 ` [PATCH 3/9 v3] libsepol/cil: Add cil_tree_node_remove function James Carter
2023-04-13 19:34 ` [PATCH 4/9 v3] libsepol/cil: Process deny rules James Carter
2023-04-13 19:34 ` [PATCH 5/9 v3] libsepol/cil: Add cil_write_post_ast function James Carter
2023-04-13 19:34 ` [PATCH 6/9 v3] libsepol: Export the " James Carter
2023-04-13 19:34 ` [PATCH 7/9 v3] secilc/secil2tree: Add option to write CIL AST after post processing James Carter
2023-04-13 19:34 ` [PATCH 8/9 v3] secilc/test: Add deny rule tests James Carter
2023-04-13 19:34 ` [PATCH 9/9 v3] secilc/docs: Add deny rule to CIL documentation James Carter
2023-07-26 15:55   ` Daniel Burgener
2023-07-26 15:56 ` Daniel Burgener [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3eda4dfc-d489-5cc4-ca99-1d0c06ea62aa@linux.microsoft.com \
    --to=dburgener@linux.microsoft.com \
    --cc=jwcart2@gmail.com \
    --cc=selinux@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.