Re: [RFC PATCH v2] libsepol/cil: raise default attrs_expand_size to 2

[James Carter <jwcart2@gmail.com>]

On Thu, Mar 5, 2020 at 8:53 AM Ondrej Mosnacek <omosnace@redhat.com> wrote:
>
> The value attrs_expand_size == 1 removes all empty attributes, but it
> also makes sense to expand all attributes that have only one type. This
> removes some redundant rules (there is sometimes the same rule for the
> type and the attribute) and reduces the number of attributes that the
> kernel has to go through when looking up rules.
>
> Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>
> v2: fix typos (Tne -> The; cointains -> contains)
>
>  libsepol/cil/src/cil.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> index d222ad3a..c010ca2a 100644
> --- a/libsepol/cil/src/cil.c
> +++ b/libsepol/cil/src/cil.c
> @@ -452,7 +452,8 @@ void cil_db_init(struct cil_db **db)
>         (*db)->disable_dontaudit = CIL_FALSE;
>         (*db)->disable_neverallow = CIL_FALSE;
>         (*db)->attrs_expand_generated = CIL_FALSE;
> -       (*db)->attrs_expand_size = 1;
> +       /* 2 == remove attributes that contain none or just 1 type */
> +       (*db)->attrs_expand_size = 2;
>         (*db)->preserve_tunables = CIL_FALSE;
>         (*db)->handle_unknown = -1;
>         (*db)->mls = -1;
> --
> 2.24.1
>