* [PATCH] Add attribute expansion options
@ 2017-05-04 21:36 Jeff Vander Stoep
2017-05-05 20:29 ` James Carter
2017-05-09 16:56 ` James Carter
0 siblings, 2 replies; 4+ messages in thread
From: Jeff Vander Stoep @ 2017-05-04 21:36 UTC (permalink / raw)
To: selinux
This commit adds attribute expansion statements to the policy
language allowing compiler defaults to be overridden.
Always expands an attribute example:
expandattribute { foo } true;
CIL example:
(expandtypeattribute (foo) true)
Never expand an attribute example:
expandattribute { bar } false;
CIL example:
(expandtypeattribute (bar) false)
Adding the annotations directly to policy was chosen over other
methods as it is consistent with how targeted runtime optimizations
are specified in other languages. For example, in C the "inline"
command.
Motivation
expandattribute true:
Android has been moving away from a monolithic policy binary to
a two part split policy representing the Android platform and the
underlying vendor-provided hardware interface. The goal is a stable
API allowing these two parts to be updated independently of each
other. Attributes provide an important mechanism for compatibility.
For example, when the vendor provides a HAL for the platform,
permissions needed by clients of the HAL can be granted to an
attribute. Clients need only be assigned the attribute and do not
need to be aware of the underlying types and permissions being
granted.
Inheriting permissions via attribute creates a convenient mechanism
for independence between vendor and platform policy, but results
in the creation of many attributes, and the potential for performance
issues when processes are clients of many HALs. [1] Annotating these
attributes for expansion at compile time allows us to retain the
compatibility benefits of using attributes without the performance
costs. [2]
expandattribute false:
Commit 0be23c3f15fd added the capability to aggresively remove unused
attributes. This is generally useful as too many attributes assigned
to a type results in lengthy policy look up times when there is a
cache miss. However, removing attributes can also result in loss of
information used in external tests. On Android, we're considering
stripping neverallow rules from on-device policy. This is consistent
with the kernel policy binary which also did not contain neverallows.
Removing neverallow rules results in a 5-10% decrease in on-device
policy build and load and a policy size decrease of ~250k. Neverallow
rules are still asserted at build time and during device
certification (CTS). If neverallow rules are absent when secilc is
run, some attributes are being stripped from policy and neverallow
tests in CTS may be violated. [3] This change retains the aggressive
attribute stripping behavior but adds an override mechanism to
preserve attributes marked as necessary.
[1] https://github.com/SELinuxProject/cil/issues/9
[2] Annotating all HAL client attributes for expansion resulted in
system_server's dropping from 19 attributes to 8. Because these
attributes were not widely applied to other types, the final
policy size change was negligible.
[3] data_file_type and service_manager_type are stripped from AOSP
policy when using secilc's -G option. This impacts 11 neverallow
tests in CTS.
Test: Build and boot Marlin with all hal_*_client attributes marked
for expansion. Verify (using seinfo and sesearch) that permissions
are correctly expanded from attributes to types.
Test: Mark types being stripped by secilc with "preserve" and verify
that they are retained in policy and applied to the same types.
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
---
checkpolicy/policy_define.c | 82 ++++++++++++++++++++++++++++++
checkpolicy/policy_define.h | 1 +
checkpolicy/policy_parse.y | 5 ++
checkpolicy/policy_scan.l | 2 +
libsepol/cil/src/cil.c | 15 ++++++
libsepol/cil/src/cil_build_ast.c | 72 ++++++++++++++++++++++++++
libsepol/cil/src/cil_build_ast.h | 2 +
libsepol/cil/src/cil_copy_ast.c | 26 ++++++++++
libsepol/cil/src/cil_flavor.h | 1 +
libsepol/cil/src/cil_internal.h | 16 ++++--
libsepol/cil/src/cil_post.c | 8 +++
libsepol/cil/src/cil_reset_ast.c | 1 +
libsepol/cil/src/cil_resolve_ast.c | 53 ++++++++++++++++++-
libsepol/cil/src/cil_tree.c | 11 ++++
libsepol/include/sepol/policydb/policydb.h | 6 ++-
libsepol/src/module_to_cil.c | 11 ++++
16 files changed, 307 insertions(+), 5 deletions(-)
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 949ca711..63e3c53f 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -1139,6 +1139,88 @@ int define_attrib(void)
return 0;
}
+int expand_attrib(void)
+{
+ char *id;
+ ebitmap_t attrs;
+ type_datum_t *attr;
+ ebitmap_node_t *node;
+ uint32_t i;
+ int rc = -1;
+ int flags = 0;
+
+ if (pass == 1) {
+ for (i = 0; i < 2; i++) {
+ while ((id = queue_remove(id_queue))) {
+ free(id);
+ }
+ }
+ return 0;
+ }
+
+ ebitmap_init(&attrs);
+ while ((id = queue_remove(id_queue))) {
+ if (!id) {
+ yyerror("No attribute name for expandattribute statement?");
+ goto exit;
+ }
+
+ if (!is_id_in_scope(SYM_TYPES, id)) {
+ yyerror2("attribute %s is not within scope", id);
+ goto exit;
+ }
+
+ attr = hashtab_search(policydbp->p_types.table, id);
+ if (!attr) {
+ yyerror2("attribute %s is not declared", id);
+ goto exit;
+ }
+
+ if (attr->flavor != TYPE_ATTRIB) {
+ yyerror2("%s is a type, not an attribute", id);
+ goto exit;
+ }
+
+ if (attr->flags & TYPE_FLAGS_EXPAND_ATTR) {
+ yyerror2("%s already has the expandattribute option specified", id);
+ goto exit;
+ }
+ if (ebitmap_set_bit(&attrs, attr->s.value - 1, TRUE)) {
+ yyerror("Out of memory!");
+ goto exit;
+ }
+
+ free(id);
+ }
+
+ id = (char *) queue_remove(id_queue);
+ if (!id) {
+ yyerror("No option specified for attribute expansion.");
+ goto exit;
+ }
+
+ if (!strcmp(id, "T")) {
+ flags = TYPE_FLAGS_EXPAND_ATTR_TRUE;
+ } else {
+ flags = TYPE_FLAGS_EXPAND_ATTR_FALSE;
+ }
+
+ ebitmap_for_each_bit(&attrs, node, i) {
+ if (!ebitmap_node_get_bit(node, i)){
+ continue;
+ }
+ attr = hashtab_search(policydbp->p_types.table,
+ policydbp->sym_val_to_name[SYM_TYPES][i]);
+ attr->flags |= flags;
+ }
+
+ rc = 0;
+exit:
+ ebitmap_destroy(&attrs);
+ free(id);
+ return rc;
+}
+
static int add_aliases_to_type(type_datum_t * type)
{
char *id;
diff --git a/checkpolicy/policy_define.h b/checkpolicy/policy_define.h
index 964baae0..9f4b6d0d 100644
--- a/checkpolicy/policy_define.h
+++ b/checkpolicy/policy_define.h
@@ -65,6 +65,7 @@ int define_typebounds(void);
int define_type(int alias);
int define_user(void);
int define_validatetrans(constraint_expr_t *expr);
+int expand_attrib(void);
int insert_id(const char *id,int push);
int insert_separator(int push);
role_datum_t *define_role_dom(role_datum_t *r);
diff --git a/checkpolicy/policy_parse.y b/checkpolicy/policy_parse.y
index 3b6a2f86..1ac1c96b 100644
--- a/checkpolicy/policy_parse.y
+++ b/checkpolicy/policy_parse.y
@@ -103,6 +103,7 @@ typedef int (* require_func_t)(int pass);
%token TYPES
%token ALIAS
%token ATTRIBUTE
+%token EXPANDATTRIBUTE
%token BOOL
%token TUNABLE
%token IF
@@ -314,6 +315,7 @@ rbac_decl : attribute_role_def
| role_attr_def
;
te_decl : attribute_def
+ | expandattribute_def
| type_def
| typealias_def
| typeattribute_def
@@ -328,6 +330,9 @@ te_decl : attribute_def
attribute_def : ATTRIBUTE identifier ';'
{ if (define_attrib()) return -1;}
;
+expandattribute_def : EXPANDATTRIBUTE names bool_val ';'
+ { if (expand_attrib()) return -1;}
+ ;
type_def : TYPE identifier alias_def opt_attr_list ';'
{if (define_type(1)) return -1;}
| TYPE identifier opt_attr_list ';'
diff --git a/checkpolicy/policy_scan.l b/checkpolicy/policy_scan.l
index 2f7f2216..028bd25e 100644
--- a/checkpolicy/policy_scan.l
+++ b/checkpolicy/policy_scan.l
@@ -106,6 +106,8 @@ ALIAS |
alias { return(ALIAS); }
ATTRIBUTE |
attribute { return(ATTRIBUTE); }
+EXPANDATTRIBUTE |
+expandattribute { return(EXPANDATTRIBUTE); }
TYPE_TRANSITION |
type_transition { return(TYPE_TRANSITION); }
TYPE_MEMBER |
diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
index a64c5284..9b9ccc36 100644
--- a/libsepol/cil/src/cil.c
+++ b/libsepol/cil/src/cil.c
@@ -159,6 +159,7 @@ static void cil_init_keys(void)
CIL_KEY_SELINUXUSERDEFAULT = cil_strpool_add("selinuxuserdefault");
CIL_KEY_TYPEATTRIBUTE = cil_strpool_add("typeattribute");
CIL_KEY_TYPEATTRIBUTESET = cil_strpool_add("typeattributeset");
+ CIL_KEY_EXPANDTYPEATTRIBUTE = cil_strpool_add("expandtypeattribute");
CIL_KEY_TYPEALIAS = cil_strpool_add("typealias");
CIL_KEY_TYPEALIASACTUAL = cil_strpool_add("typealiasactual");
CIL_KEY_TYPEBOUNDS = cil_strpool_add("typebounds");
@@ -623,6 +624,9 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
case CIL_TYPEATTRIBUTESET:
cil_destroy_typeattributeset(*data);
break;
+ case CIL_EXPANDTYPEATTRIBUTE:
+ cil_destroy_expandtypeattribute(*data);
+ break;
case CIL_TYPEALIASACTUAL:
cil_destroy_aliasactual(*data);
break;
@@ -987,6 +991,8 @@ const char * cil_node_to_string(struct cil_tree_node *node)
return CIL_KEY_TYPEALIAS;
case CIL_TYPEATTRIBUTESET:
return CIL_KEY_TYPEATTRIBUTESET;
+ case CIL_EXPANDTYPEATTRIBUTE:
+ return CIL_KEY_EXPANDTYPEATTRIBUTE;
case CIL_TYPEALIASACTUAL:
return CIL_KEY_TYPEALIASACTUAL;
case CIL_TYPEBOUNDS:
@@ -2038,6 +2044,15 @@ void cil_typeattributeset_init(struct cil_typeattributeset **attrset)
(*attrset)->datum_expr = NULL;
}
+void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr)
+{
+ *expandattr = cil_malloc(sizeof(**expandattr));
+
+ (*expandattr)->attr_strs = NULL;
+ (*expandattr)->attr_datums = NULL;
+ (*expandattr)->expand = 0;
+}
+
void cil_alias_init(struct cil_alias **alias)
{
*alias = cil_malloc(sizeof(**alias));
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
index 4b03dc35..36cc6735 100644
--- a/libsepol/cil/src/cil_build_ast.c
+++ b/libsepol/cil/src/cil_build_ast.c
@@ -3176,6 +3176,75 @@ void cil_destroy_typeattributeset(struct cil_typeattributeset *attrset)
free(attrset);
}
+int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
+{
+ enum cil_syntax syntax[] = {
+ CIL_SYN_STRING,
+ CIL_SYN_STRING | CIL_SYN_LIST,
+ CIL_SYN_STRING,
+ CIL_SYN_END
+ };
+ char *expand_str;
+ int syntax_len = sizeof(syntax)/sizeof(*syntax);
+ struct cil_expandtypeattribute *expandattr = NULL;
+ int rc = SEPOL_ERR;
+
+ if (db == NULL || parse_current == NULL || ast_node == NULL) {
+ goto exit;
+ }
+
+ rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ cil_expandtypeattribute_init(&expandattr);
+
+ if (parse_current->next->cl_head == NULL) {
+ cil_list_init(&expandattr->attr_strs, CIL_TYPE);
+ cil_list_append(expandattr->attr_strs, CIL_STRING, parse_current->next->data);
+ } else {
+ rc = cil_fill_list(parse_current->next->cl_head, CIL_TYPE, &expandattr->attr_strs);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+ }
+
+ expand_str = parse_current->next->next->data;
+
+ if (expand_str == CIL_KEY_CONDTRUE) {
+ expandattr->expand = CIL_TRUE;
+ } else if (expand_str == CIL_KEY_CONDFALSE) {
+ expandattr->expand = CIL_FALSE;
+ } else {
+ cil_log(CIL_ERR, "Value must be either \'true\' or \'false\'");
+ goto exit;
+ }
+
+ ast_node->data = expandattr;
+ ast_node->flavor = CIL_EXPANDTYPEATTRIBUTE;
+
+ return SEPOL_OK;
+
+exit:
+ cil_tree_log(parse_current, CIL_ERR, "Bad expandtypeattribute statement");
+ cil_destroy_expandtypeattribute(expandattr);
+ return rc;
+}
+
+void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr)
+{
+ if (expandattr == NULL) {
+ return;
+ }
+
+ cil_list_destroy(&expandattr->attr_strs, CIL_TRUE);
+
+ cil_list_destroy(&expandattr->attr_datums, CIL_FALSE);
+
+ free(expandattr);
+}
+
int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
{
enum cil_syntax syntax[] = {
@@ -6013,6 +6082,9 @@ int __cil_build_ast_node_helper(struct cil_tree_node *parse_current, uint32_t *f
} else if (parse_current->data == CIL_KEY_TYPEATTRIBUTESET) {
rc = cil_gen_typeattributeset(db, parse_current, ast_node);
*finished = CIL_TREE_SKIP_NEXT;
+ } else if (parse_current->data == CIL_KEY_EXPANDTYPEATTRIBUTE) {
+ rc = cil_gen_expandtypeattribute(db, parse_current, ast_node);
+ *finished = CIL_TREE_SKIP_NEXT;
} else if (parse_current->data == CIL_KEY_TYPEALIAS) {
rc = cil_gen_alias(db, parse_current, ast_node, CIL_TYPEALIAS);
} else if (parse_current->data == CIL_KEY_TYPEALIASACTUAL) {
diff --git a/libsepol/cil/src/cil_build_ast.h b/libsepol/cil/src/cil_build_ast.h
index 54662035..33bae997 100644
--- a/libsepol/cil/src/cil_build_ast.h
+++ b/libsepol/cil/src/cil_build_ast.h
@@ -138,6 +138,8 @@ int cil_gen_aliasactual(struct cil_db *db, struct cil_tree_node *parse_current,
void cil_destroy_aliasactual(struct cil_aliasactual *aliasactual);
int cil_gen_typeattributeset(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
void cil_destroy_typeattributeset(struct cil_typeattributeset *attrtypes);
+int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
+void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr);
int cil_gen_typebounds(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
void cil_destroy_typepermissive(struct cil_typepermissive *typeperm);
diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c
index 2d085dd7..d6685050 100644
--- a/libsepol/cil/src/cil_copy_ast.c
+++ b/libsepol/cil/src/cil_copy_ast.c
@@ -648,6 +648,29 @@ int cil_copy_typeattributeset(struct cil_db *db, void *data, void **copy, __attr
return SEPOL_OK;
}
+int cil_copy_expandtypeattribute(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
+{
+ struct cil_expandtypeattribute *orig = data;
+ struct cil_expandtypeattribute *new = NULL;
+
+ fprintf(stderr, "%s %u\n", __func__, __LINE__);
+ cil_expandtypeattribute_init(&new);
+
+ if (orig->attr_strs != NULL) {
+ cil_copy_list(orig->attr_strs, &new->attr_strs);
+ }
+
+ if (orig->attr_datums != NULL) {
+ cil_copy_list(orig->attr_datums, &new->attr_datums);
+ }
+
+ new->expand = orig->expand;
+
+ *copy = new;
+
+ return SEPOL_OK;
+}
+
int cil_copy_alias(__attribute__((unused)) struct cil_db *db, void *data, void **copy, symtab_t *symtab)
{
struct cil_alias *orig = data;
@@ -1808,6 +1831,9 @@ int __cil_copy_node_helper(struct cil_tree_node *orig, __attribute__((unused)) u
case CIL_TYPEATTRIBUTESET:
copy_func = &cil_copy_typeattributeset;
break;
+ case CIL_EXPANDTYPEATTRIBUTE:
+ copy_func = &cil_copy_expandtypeattribute;
+ break;
case CIL_TYPEALIAS:
copy_func = &cil_copy_alias;
break;
diff --git a/libsepol/cil/src/cil_flavor.h b/libsepol/cil/src/cil_flavor.h
index cd08b972..c01f967a 100644
--- a/libsepol/cil/src/cil_flavor.h
+++ b/libsepol/cil/src/cil_flavor.h
@@ -73,6 +73,7 @@ enum cil_flavor {
CIL_ROLETYPE,
CIL_ROLEBOUNDS,
CIL_TYPEATTRIBUTESET,
+ CIL_EXPANDTYPEATTRIBUTE,
CIL_TYPEALIASACTUAL,
CIL_TYPEBOUNDS,
CIL_TYPEPERMISSIVE,
diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h
index efa2cd6e..aee3f00c 100644
--- a/libsepol/cil/src/cil_internal.h
+++ b/libsepol/cil/src/cil_internal.h
@@ -174,6 +174,7 @@ char *CIL_KEY_SELINUXUSER;
char *CIL_KEY_SELINUXUSERDEFAULT;
char *CIL_KEY_TYPEATTRIBUTE;
char *CIL_KEY_TYPEATTRIBUTESET;
+char *CIL_KEY_EXPANDTYPEATTRIBUTE;
char *CIL_KEY_TYPEALIAS;
char *CIL_KEY_TYPEALIASACTUAL;
char *CIL_KEY_TYPEBOUNDS;
@@ -515,9 +516,11 @@ struct cil_type {
int value;
};
-#define CIL_ATTR_AVRULE 0x01
-#define CIL_ATTR_NEVERALLOW 0x02
-#define CIL_ATTR_CONSTRAINT 0x04
+#define CIL_ATTR_AVRULE (1 << 0)
+#define CIL_ATTR_NEVERALLOW (1 << 1)
+#define CIL_ATTR_CONSTRAINT (1 << 2)
+#define CIL_ATTR_EXPAND_TRUE (1 << 3)
+#define CIL_ATTR_EXPAND_FALSE (1 << 4)
struct cil_typeattribute {
struct cil_symtab_datum datum;
struct cil_list *expr_list;
@@ -531,6 +534,12 @@ struct cil_typeattributeset {
struct cil_list *datum_expr;
};
+struct cil_expandtypeattribute {
+ struct cil_list *attr_strs;
+ struct cil_list *attr_datums;
+ int expand;
+};
+
struct cil_typepermissive {
char *type_str;
void *type; /* type or alias */
@@ -977,6 +986,7 @@ void cil_roleattributeset_init(struct cil_roleattributeset **attrset);
void cil_roletype_init(struct cil_roletype **roletype);
void cil_typeattribute_init(struct cil_typeattribute **attribute);
void cil_typeattributeset_init(struct cil_typeattributeset **attrset);
+void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr);
void cil_alias_init(struct cil_alias **alias);
void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
void cil_typepermissive_init(struct cil_typepermissive **typeperm);
diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
index e32a8fc9..1941fab3 100644
--- a/libsepol/cil/src/cil_post.c
+++ b/libsepol/cil/src/cil_post.c
@@ -1194,6 +1194,14 @@ static int cil_typeattribute_used(struct cil_typeattribute *attr, struct cil_db
return CIL_FALSE;
}
+ if (attr->used & CIL_ATTR_EXPAND_FALSE) {
+ return CIL_TRUE;
+ }
+
+ if (attr->used & CIL_ATTR_EXPAND_TRUE) {
+ return CIL_FALSE;
+ }
+
if (attr->used & CIL_ATTR_CONSTRAINT) {
return CIL_TRUE;
}
diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
index de00679e..676e156e 100644
--- a/libsepol/cil/src/cil_reset_ast.c
+++ b/libsepol/cil/src/cil_reset_ast.c
@@ -549,6 +549,7 @@ int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused)) uint32
case CIL_CLASSORDER:
case CIL_CATORDER:
case CIL_SENSITIVITYORDER:
+ case CIL_EXPANDTYPEATTRIBUTE:
break; /* Nothing to reset */
default:
break;
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index 6da44ba1..8925b271 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -271,14 +271,24 @@ exit:
int cil_type_used(struct cil_symtab_datum *datum, int used)
{
+ int rc = SEPOL_ERR;
struct cil_typeattribute *attr = NULL;
if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
attr = (struct cil_typeattribute*)datum;
attr->used |= used;
+ if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
+ (attr->used & CIL_ATTR_EXPAND_FALSE)) {
+ cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
+ "Expandtypeattribute may be set to true or false "
+ "but not both. \n");
+ goto exit;
+ }
}
- return 0;
+ return SEPOL_OK;
+exit:
+ return rc;
}
int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
@@ -453,6 +463,44 @@ exit:
return rc;
}
+int cil_resolve_expandtypeattribute(struct cil_tree_node *current, void *extra_args)
+{
+ struct cil_expandtypeattribute *expandattr = current->data;
+ struct cil_symtab_datum *attr_datum = NULL;
+ struct cil_tree_node *attr_node = NULL;
+ struct cil_list_item *curr;
+ int used;
+ int rc = SEPOL_ERR;
+
+ cil_list_init(&expandattr->attr_datums, CIL_TYPE);
+
+ cil_list_for_each(curr, expandattr->attr_strs) {
+ rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_TYPES, extra_args, &attr_datum);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ attr_node = attr_datum->nodes->head->data;
+
+ if (attr_node->flavor != CIL_TYPEATTRIBUTE) {
+ rc = SEPOL_ERR;
+ cil_log(CIL_ERR, "Attribute type not an attribute\n");
+ goto exit;
+ }
+ used = expandattr->expand ? CIL_ATTR_EXPAND_TRUE : CIL_ATTR_EXPAND_FALSE;
+ rc = cil_type_used(attr_datum, used);
+ if (rc != SEPOL_OK) {
+ goto exit;
+ }
+
+ cil_list_append(expandattr->attr_datums, CIL_TYPE, attr_datum);
+ }
+
+ return SEPOL_OK;
+exit:
+ return rc;
+}
+
int cil_resolve_aliasactual(struct cil_tree_node *current, void *extra_args, enum cil_flavor flavor, enum cil_flavor alias_flavor)
{
int rc = SEPOL_ERR;
@@ -3432,6 +3480,9 @@ int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
case CIL_TYPEATTRIBUTESET:
rc = cil_resolve_typeattributeset(node, args);
break;
+ case CIL_EXPANDTYPEATTRIBUTE:
+ rc = cil_resolve_expandtypeattribute(node, args);
+ break;
case CIL_TYPEBOUNDS:
rc = cil_resolve_bounds(node, args, CIL_TYPE, CIL_TYPEATTRIBUTE);
break;
diff --git a/libsepol/cil/src/cil_tree.c b/libsepol/cil/src/cil_tree.c
index 9ff9d4b4..2cc2744a 100644
--- a/libsepol/cil/src/cil_tree.c
+++ b/libsepol/cil/src/cil_tree.c
@@ -703,6 +703,17 @@ void cil_tree_print_node(struct cil_tree_node *node)
cil_log(CIL_INFO, "TYPE: %s\n", type->datum.name);
return;
}
+ case CIL_EXPANDTYPEATTRIBUTE: {
+ struct cil_expandtypeattribute *attr = node->data;
+
+ fprintf(stderr, "%s %u\n", __func__, __LINE__);
+ cil_log(CIL_INFO, "(EXPANDTYPEATTRIBUTE ");
+ cil_tree_print_expr(attr->attr_datums, attr->attr_strs);
+ cil_log(CIL_INFO, "%s)\n",attr->expand ?
+ CIL_KEY_CONDTRUE : CIL_KEY_CONDFALSE);
+
+ return;
+ }
case CIL_TYPEATTRIBUTESET: {
struct cil_typeattributeset *attr = node->data;
diff --git a/libsepol/include/sepol/policydb/policydb.h b/libsepol/include/sepol/policydb/policydb.h
index 4336a3f2..37e0c9e5 100644
--- a/libsepol/include/sepol/policydb/policydb.h
+++ b/libsepol/include/sepol/policydb/policydb.h
@@ -178,7 +178,11 @@ typedef struct type_datum {
#define TYPE_ALIAS 2 /* alias in modular policy */
uint32_t flavor;
ebitmap_t types; /* types with this attribute */
-#define TYPE_FLAGS_PERMISSIVE 0x01
+#define TYPE_FLAGS_PERMISSIVE (1 << 0)
+#define TYPE_FLAGS_EXPAND_ATTR_TRUE (1 << 1)
+#define TYPE_FLAGS_EXPAND_ATTR_FALSE (1 << 2)
+#define TYPE_FLAGS_EXPAND_ATTR (TYPE_FLAGS_EXPAND_ATTR_TRUE | \
+ TYPE_FLAGS_EXPAND_ATTR_FALSE)
uint32_t flags;
uint32_t bounds; /* bounds type, if exist */
} type_datum_t;
diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index ac095c30..7d8eb204 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -2244,6 +2244,17 @@ static int type_to_cil(int indent, struct policydb *pdb, struct avrule_block *UN
cil_println(indent, "(typeattribute %s)", key);
}
+ if (type->flags & TYPE_FLAGS_EXPAND_ATTR) {
+ cil_indent(indent);
+ cil_printf("(expandtypeattribute (%s) ", key);
+ if (type->flags & TYPE_FLAGS_EXPAND_ATTR_TRUE) {
+ cil_printf("true");
+ } else if (type->flags & TYPE_FLAGS_EXPAND_ATTR_FALSE) {
+ cil_printf("false");
+ }
+ cil_printf(")\n");
+ }
+
if (ebitmap_cardinality(&type->types) > 0) {
cil_indent(indent);
cil_printf("(typeattributeset %s (", key);
--
2.13.0.rc1.294.g07d810a77f-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] Add attribute expansion options
2017-05-04 21:36 [PATCH] Add attribute expansion options Jeff Vander Stoep
@ 2017-05-05 20:29 ` James Carter
2017-05-05 21:02 ` Jeffrey Vander Stoep
2017-05-09 16:56 ` James Carter
1 sibling, 1 reply; 4+ messages in thread
From: James Carter @ 2017-05-05 20:29 UTC (permalink / raw)
To: Jeff Vander Stoep, selinux
On 05/04/2017 05:36 PM, Jeff Vander Stoep wrote:
> This commit adds attribute expansion statements to the policy
> language allowing compiler defaults to be overridden.
>
> Always expands an attribute example:
> expandattribute { foo } true;
> CIL example:
> (expandtypeattribute (foo) true)
>
> Never expand an attribute example:
> expandattribute { bar } false;
> CIL example:
> (expandtypeattribute (bar) false)
>
It works for secilc and for checkpolicy -C (which outputs CIL), but the
expandattribute rules are ignored when building the kernel policy from a
policy.conf. Are you generating CIL from policy.conf files? If not, then it
might make sense to only have this feature in CIL.
Jim
> Adding the annotations directly to policy was chosen over other
> methods as it is consistent with how targeted runtime optimizations
> are specified in other languages. For example, in C the "inline"
> command.
>
> Motivation
>
> expandattribute true:
> Android has been moving away from a monolithic policy binary to
> a two part split policy representing the Android platform and the
> underlying vendor-provided hardware interface. The goal is a stable
> API allowing these two parts to be updated independently of each
> other. Attributes provide an important mechanism for compatibility.
> For example, when the vendor provides a HAL for the platform,
> permissions needed by clients of the HAL can be granted to an
> attribute. Clients need only be assigned the attribute and do not
> need to be aware of the underlying types and permissions being
> granted.
>
> Inheriting permissions via attribute creates a convenient mechanism
> for independence between vendor and platform policy, but results
> in the creation of many attributes, and the potential for performance
> issues when processes are clients of many HALs. [1] Annotating these
> attributes for expansion at compile time allows us to retain the
> compatibility benefits of using attributes without the performance
> costs. [2]
>
> expandattribute false:
> Commit 0be23c3f15fd added the capability to aggresively remove unused
> attributes. This is generally useful as too many attributes assigned
> to a type results in lengthy policy look up times when there is a
> cache miss. However, removing attributes can also result in loss of
> information used in external tests. On Android, we're considering
> stripping neverallow rules from on-device policy. This is consistent
> with the kernel policy binary which also did not contain neverallows.
> Removing neverallow rules results in a 5-10% decrease in on-device
> policy build and load and a policy size decrease of ~250k. Neverallow
> rules are still asserted at build time and during device
> certification (CTS). If neverallow rules are absent when secilc is
> run, some attributes are being stripped from policy and neverallow
> tests in CTS may be violated. [3] This change retains the aggressive
> attribute stripping behavior but adds an override mechanism to
> preserve attributes marked as necessary.
>
> [1] https://github.com/SELinuxProject/cil/issues/9
> [2] Annotating all HAL client attributes for expansion resulted in
> system_server's dropping from 19 attributes to 8. Because these
> attributes were not widely applied to other types, the final
> policy size change was negligible.
> [3] data_file_type and service_manager_type are stripped from AOSP
> policy when using secilc's -G option. This impacts 11 neverallow
> tests in CTS.
>
> Test: Build and boot Marlin with all hal_*_client attributes marked
> for expansion. Verify (using seinfo and sesearch) that permissions
> are correctly expanded from attributes to types.
> Test: Mark types being stripped by secilc with "preserve" and verify
> that they are retained in policy and applied to the same types.
>
> Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
> ---
> checkpolicy/policy_define.c | 82 ++++++++++++++++++++++++++++++
> checkpolicy/policy_define.h | 1 +
> checkpolicy/policy_parse.y | 5 ++
> checkpolicy/policy_scan.l | 2 +
> libsepol/cil/src/cil.c | 15 ++++++
> libsepol/cil/src/cil_build_ast.c | 72 ++++++++++++++++++++++++++
> libsepol/cil/src/cil_build_ast.h | 2 +
> libsepol/cil/src/cil_copy_ast.c | 26 ++++++++++
> libsepol/cil/src/cil_flavor.h | 1 +
> libsepol/cil/src/cil_internal.h | 16 ++++--
> libsepol/cil/src/cil_post.c | 8 +++
> libsepol/cil/src/cil_reset_ast.c | 1 +
> libsepol/cil/src/cil_resolve_ast.c | 53 ++++++++++++++++++-
> libsepol/cil/src/cil_tree.c | 11 ++++
> libsepol/include/sepol/policydb/policydb.h | 6 ++-
> libsepol/src/module_to_cil.c | 11 ++++
> 16 files changed, 307 insertions(+), 5 deletions(-)
>
> diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> index 949ca711..63e3c53f 100644
> --- a/checkpolicy/policy_define.c
> +++ b/checkpolicy/policy_define.c
> @@ -1139,6 +1139,88 @@ int define_attrib(void)
> return 0;
> }
>
> +int expand_attrib(void)
> +{
> + char *id;
> + ebitmap_t attrs;
> + type_datum_t *attr;
> + ebitmap_node_t *node;
> + uint32_t i;
> + int rc = -1;
> + int flags = 0;
> +
> + if (pass == 1) {
> + for (i = 0; i < 2; i++) {
> + while ((id = queue_remove(id_queue))) {
> + free(id);
> + }
> + }
> + return 0;
> + }
> +
> + ebitmap_init(&attrs);
> + while ((id = queue_remove(id_queue))) {
> + if (!id) {
> + yyerror("No attribute name for expandattribute statement?");
> + goto exit;
> + }
> +
> + if (!is_id_in_scope(SYM_TYPES, id)) {
> + yyerror2("attribute %s is not within scope", id);
> + goto exit;
> + }
> +
> + attr = hashtab_search(policydbp->p_types.table, id);
> + if (!attr) {
> + yyerror2("attribute %s is not declared", id);
> + goto exit;
> + }
> +
> + if (attr->flavor != TYPE_ATTRIB) {
> + yyerror2("%s is a type, not an attribute", id);
> + goto exit;
> + }
> +
> + if (attr->flags & TYPE_FLAGS_EXPAND_ATTR) {
> + yyerror2("%s already has the expandattribute option specified", id);
> + goto exit;
> + }
> + if (ebitmap_set_bit(&attrs, attr->s.value - 1, TRUE)) {
> + yyerror("Out of memory!");
> + goto exit;
> + }
> +
> + free(id);
> + }
> +
> + id = (char *) queue_remove(id_queue);
> + if (!id) {
> + yyerror("No option specified for attribute expansion.");
> + goto exit;
> + }
> +
> + if (!strcmp(id, "T")) {
> + flags = TYPE_FLAGS_EXPAND_ATTR_TRUE;
> + } else {
> + flags = TYPE_FLAGS_EXPAND_ATTR_FALSE;
> + }
> +
> + ebitmap_for_each_bit(&attrs, node, i) {
> + if (!ebitmap_node_get_bit(node, i)){
> + continue;
> + }
> + attr = hashtab_search(policydbp->p_types.table,
> + policydbp->sym_val_to_name[SYM_TYPES][i]);
> + attr->flags |= flags;
> + }
> +
> + rc = 0;
> +exit:
> + ebitmap_destroy(&attrs);
> + free(id);
> + return rc;
> +}
> +
> static int add_aliases_to_type(type_datum_t * type)
> {
> char *id;
> diff --git a/checkpolicy/policy_define.h b/checkpolicy/policy_define.h
> index 964baae0..9f4b6d0d 100644
> --- a/checkpolicy/policy_define.h
> +++ b/checkpolicy/policy_define.h
> @@ -65,6 +65,7 @@ int define_typebounds(void);
> int define_type(int alias);
> int define_user(void);
> int define_validatetrans(constraint_expr_t *expr);
> +int expand_attrib(void);
> int insert_id(const char *id,int push);
> int insert_separator(int push);
> role_datum_t *define_role_dom(role_datum_t *r);
> diff --git a/checkpolicy/policy_parse.y b/checkpolicy/policy_parse.y
> index 3b6a2f86..1ac1c96b 100644
> --- a/checkpolicy/policy_parse.y
> +++ b/checkpolicy/policy_parse.y
> @@ -103,6 +103,7 @@ typedef int (* require_func_t)(int pass);
> %token TYPES
> %token ALIAS
> %token ATTRIBUTE
> +%token EXPANDATTRIBUTE
> %token BOOL
> %token TUNABLE
> %token IF
> @@ -314,6 +315,7 @@ rbac_decl : attribute_role_def
> | role_attr_def
> ;
> te_decl : attribute_def
> + | expandattribute_def
> | type_def
> | typealias_def
> | typeattribute_def
> @@ -328,6 +330,9 @@ te_decl : attribute_def
> attribute_def : ATTRIBUTE identifier ';'
> { if (define_attrib()) return -1;}
> ;
> +expandattribute_def : EXPANDATTRIBUTE names bool_val ';'
> + { if (expand_attrib()) return -1;}
> + ;
> type_def : TYPE identifier alias_def opt_attr_list ';'
> {if (define_type(1)) return -1;}
> | TYPE identifier opt_attr_list ';'
> diff --git a/checkpolicy/policy_scan.l b/checkpolicy/policy_scan.l
> index 2f7f2216..028bd25e 100644
> --- a/checkpolicy/policy_scan.l
> +++ b/checkpolicy/policy_scan.l
> @@ -106,6 +106,8 @@ ALIAS |
> alias { return(ALIAS); }
> ATTRIBUTE |
> attribute { return(ATTRIBUTE); }
> +EXPANDATTRIBUTE |
> +expandattribute { return(EXPANDATTRIBUTE); }
> TYPE_TRANSITION |
> type_transition { return(TYPE_TRANSITION); }
> TYPE_MEMBER |
> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> index a64c5284..9b9ccc36 100644
> --- a/libsepol/cil/src/cil.c
> +++ b/libsepol/cil/src/cil.c
> @@ -159,6 +159,7 @@ static void cil_init_keys(void)
> CIL_KEY_SELINUXUSERDEFAULT = cil_strpool_add("selinuxuserdefault");
> CIL_KEY_TYPEATTRIBUTE = cil_strpool_add("typeattribute");
> CIL_KEY_TYPEATTRIBUTESET = cil_strpool_add("typeattributeset");
> + CIL_KEY_EXPANDTYPEATTRIBUTE = cil_strpool_add("expandtypeattribute");
> CIL_KEY_TYPEALIAS = cil_strpool_add("typealias");
> CIL_KEY_TYPEALIASACTUAL = cil_strpool_add("typealiasactual");
> CIL_KEY_TYPEBOUNDS = cil_strpool_add("typebounds");
> @@ -623,6 +624,9 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
> case CIL_TYPEATTRIBUTESET:
> cil_destroy_typeattributeset(*data);
> break;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + cil_destroy_expandtypeattribute(*data);
> + break;
> case CIL_TYPEALIASACTUAL:
> cil_destroy_aliasactual(*data);
> break;
> @@ -987,6 +991,8 @@ const char * cil_node_to_string(struct cil_tree_node *node)
> return CIL_KEY_TYPEALIAS;
> case CIL_TYPEATTRIBUTESET:
> return CIL_KEY_TYPEATTRIBUTESET;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + return CIL_KEY_EXPANDTYPEATTRIBUTE;
> case CIL_TYPEALIASACTUAL:
> return CIL_KEY_TYPEALIASACTUAL;
> case CIL_TYPEBOUNDS:
> @@ -2038,6 +2044,15 @@ void cil_typeattributeset_init(struct cil_typeattributeset **attrset)
> (*attrset)->datum_expr = NULL;
> }
>
> +void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr)
> +{
> + *expandattr = cil_malloc(sizeof(**expandattr));
> +
> + (*expandattr)->attr_strs = NULL;
> + (*expandattr)->attr_datums = NULL;
> + (*expandattr)->expand = 0;
> +}
> +
> void cil_alias_init(struct cil_alias **alias)
> {
> *alias = cil_malloc(sizeof(**alias));
> diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
> index 4b03dc35..36cc6735 100644
> --- a/libsepol/cil/src/cil_build_ast.c
> +++ b/libsepol/cil/src/cil_build_ast.c
> @@ -3176,6 +3176,75 @@ void cil_destroy_typeattributeset(struct cil_typeattributeset *attrset)
> free(attrset);
> }
>
> +int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
> +{
> + enum cil_syntax syntax[] = {
> + CIL_SYN_STRING,
> + CIL_SYN_STRING | CIL_SYN_LIST,
> + CIL_SYN_STRING,
> + CIL_SYN_END
> + };
> + char *expand_str;
> + int syntax_len = sizeof(syntax)/sizeof(*syntax);
> + struct cil_expandtypeattribute *expandattr = NULL;
> + int rc = SEPOL_ERR;
> +
> + if (db == NULL || parse_current == NULL || ast_node == NULL) {
> + goto exit;
> + }
> +
> + rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + cil_expandtypeattribute_init(&expandattr);
> +
> + if (parse_current->next->cl_head == NULL) {
> + cil_list_init(&expandattr->attr_strs, CIL_TYPE);
> + cil_list_append(expandattr->attr_strs, CIL_STRING, parse_current->next->data);
> + } else {
> + rc = cil_fill_list(parse_current->next->cl_head, CIL_TYPE, &expandattr->attr_strs);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> + }
> +
> + expand_str = parse_current->next->next->data;
> +
> + if (expand_str == CIL_KEY_CONDTRUE) {
> + expandattr->expand = CIL_TRUE;
> + } else if (expand_str == CIL_KEY_CONDFALSE) {
> + expandattr->expand = CIL_FALSE;
> + } else {
> + cil_log(CIL_ERR, "Value must be either \'true\' or \'false\'");
> + goto exit;
> + }
> +
> + ast_node->data = expandattr;
> + ast_node->flavor = CIL_EXPANDTYPEATTRIBUTE;
> +
> + return SEPOL_OK;
> +
> +exit:
> + cil_tree_log(parse_current, CIL_ERR, "Bad expandtypeattribute statement");
> + cil_destroy_expandtypeattribute(expandattr);
> + return rc;
> +}
> +
> +void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr)
> +{
> + if (expandattr == NULL) {
> + return;
> + }
> +
> + cil_list_destroy(&expandattr->attr_strs, CIL_TRUE);
> +
> + cil_list_destroy(&expandattr->attr_datums, CIL_FALSE);
> +
> + free(expandattr);
> +}
> +
> int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
> {
> enum cil_syntax syntax[] = {
> @@ -6013,6 +6082,9 @@ int __cil_build_ast_node_helper(struct cil_tree_node *parse_current, uint32_t *f
> } else if (parse_current->data == CIL_KEY_TYPEATTRIBUTESET) {
> rc = cil_gen_typeattributeset(db, parse_current, ast_node);
> *finished = CIL_TREE_SKIP_NEXT;
> + } else if (parse_current->data == CIL_KEY_EXPANDTYPEATTRIBUTE) {
> + rc = cil_gen_expandtypeattribute(db, parse_current, ast_node);
> + *finished = CIL_TREE_SKIP_NEXT;
> } else if (parse_current->data == CIL_KEY_TYPEALIAS) {
> rc = cil_gen_alias(db, parse_current, ast_node, CIL_TYPEALIAS);
> } else if (parse_current->data == CIL_KEY_TYPEALIASACTUAL) {
> diff --git a/libsepol/cil/src/cil_build_ast.h b/libsepol/cil/src/cil_build_ast.h
> index 54662035..33bae997 100644
> --- a/libsepol/cil/src/cil_build_ast.h
> +++ b/libsepol/cil/src/cil_build_ast.h
> @@ -138,6 +138,8 @@ int cil_gen_aliasactual(struct cil_db *db, struct cil_tree_node *parse_current,
> void cil_destroy_aliasactual(struct cil_aliasactual *aliasactual);
> int cil_gen_typeattributeset(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> void cil_destroy_typeattributeset(struct cil_typeattributeset *attrtypes);
> +int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> +void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr);
> int cil_gen_typebounds(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> void cil_destroy_typepermissive(struct cil_typepermissive *typeperm);
> diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c
> index 2d085dd7..d6685050 100644
> --- a/libsepol/cil/src/cil_copy_ast.c
> +++ b/libsepol/cil/src/cil_copy_ast.c
> @@ -648,6 +648,29 @@ int cil_copy_typeattributeset(struct cil_db *db, void *data, void **copy, __attr
> return SEPOL_OK;
> }
>
> +int cil_copy_expandtypeattribute(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
> +{
> + struct cil_expandtypeattribute *orig = data;
> + struct cil_expandtypeattribute *new = NULL;
> +
> + fprintf(stderr, "%s %u\n", __func__, __LINE__);
> + cil_expandtypeattribute_init(&new);
> +
> + if (orig->attr_strs != NULL) {
> + cil_copy_list(orig->attr_strs, &new->attr_strs);
> + }
> +
> + if (orig->attr_datums != NULL) {
> + cil_copy_list(orig->attr_datums, &new->attr_datums);
> + }
> +
> + new->expand = orig->expand;
> +
> + *copy = new;
> +
> + return SEPOL_OK;
> +}
> +
> int cil_copy_alias(__attribute__((unused)) struct cil_db *db, void *data, void **copy, symtab_t *symtab)
> {
> struct cil_alias *orig = data;
> @@ -1808,6 +1831,9 @@ int __cil_copy_node_helper(struct cil_tree_node *orig, __attribute__((unused)) u
> case CIL_TYPEATTRIBUTESET:
> copy_func = &cil_copy_typeattributeset;
> break;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + copy_func = &cil_copy_expandtypeattribute;
> + break;
> case CIL_TYPEALIAS:
> copy_func = &cil_copy_alias;
> break;
> diff --git a/libsepol/cil/src/cil_flavor.h b/libsepol/cil/src/cil_flavor.h
> index cd08b972..c01f967a 100644
> --- a/libsepol/cil/src/cil_flavor.h
> +++ b/libsepol/cil/src/cil_flavor.h
> @@ -73,6 +73,7 @@ enum cil_flavor {
> CIL_ROLETYPE,
> CIL_ROLEBOUNDS,
> CIL_TYPEATTRIBUTESET,
> + CIL_EXPANDTYPEATTRIBUTE,
> CIL_TYPEALIASACTUAL,
> CIL_TYPEBOUNDS,
> CIL_TYPEPERMISSIVE,
> diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h
> index efa2cd6e..aee3f00c 100644
> --- a/libsepol/cil/src/cil_internal.h
> +++ b/libsepol/cil/src/cil_internal.h
> @@ -174,6 +174,7 @@ char *CIL_KEY_SELINUXUSER;
> char *CIL_KEY_SELINUXUSERDEFAULT;
> char *CIL_KEY_TYPEATTRIBUTE;
> char *CIL_KEY_TYPEATTRIBUTESET;
> +char *CIL_KEY_EXPANDTYPEATTRIBUTE;
> char *CIL_KEY_TYPEALIAS;
> char *CIL_KEY_TYPEALIASACTUAL;
> char *CIL_KEY_TYPEBOUNDS;
> @@ -515,9 +516,11 @@ struct cil_type {
> int value;
> };
>
> -#define CIL_ATTR_AVRULE 0x01
> -#define CIL_ATTR_NEVERALLOW 0x02
> -#define CIL_ATTR_CONSTRAINT 0x04
> +#define CIL_ATTR_AVRULE (1 << 0)
> +#define CIL_ATTR_NEVERALLOW (1 << 1)
> +#define CIL_ATTR_CONSTRAINT (1 << 2)
> +#define CIL_ATTR_EXPAND_TRUE (1 << 3)
> +#define CIL_ATTR_EXPAND_FALSE (1 << 4)
> struct cil_typeattribute {
> struct cil_symtab_datum datum;
> struct cil_list *expr_list;
> @@ -531,6 +534,12 @@ struct cil_typeattributeset {
> struct cil_list *datum_expr;
> };
>
> +struct cil_expandtypeattribute {
> + struct cil_list *attr_strs;
> + struct cil_list *attr_datums;
> + int expand;
> +};
> +
> struct cil_typepermissive {
> char *type_str;
> void *type; /* type or alias */
> @@ -977,6 +986,7 @@ void cil_roleattributeset_init(struct cil_roleattributeset **attrset);
> void cil_roletype_init(struct cil_roletype **roletype);
> void cil_typeattribute_init(struct cil_typeattribute **attribute);
> void cil_typeattributeset_init(struct cil_typeattributeset **attrset);
> +void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr);
> void cil_alias_init(struct cil_alias **alias);
> void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
> void cil_typepermissive_init(struct cil_typepermissive **typeperm);
> diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
> index e32a8fc9..1941fab3 100644
> --- a/libsepol/cil/src/cil_post.c
> +++ b/libsepol/cil/src/cil_post.c
> @@ -1194,6 +1194,14 @@ static int cil_typeattribute_used(struct cil_typeattribute *attr, struct cil_db
> return CIL_FALSE;
> }
>
> + if (attr->used & CIL_ATTR_EXPAND_FALSE) {
> + return CIL_TRUE;
> + }
> +
> + if (attr->used & CIL_ATTR_EXPAND_TRUE) {
> + return CIL_FALSE;
> + }
> +
> if (attr->used & CIL_ATTR_CONSTRAINT) {
> return CIL_TRUE;
> }
> diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
> index de00679e..676e156e 100644
> --- a/libsepol/cil/src/cil_reset_ast.c
> +++ b/libsepol/cil/src/cil_reset_ast.c
> @@ -549,6 +549,7 @@ int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused)) uint32
> case CIL_CLASSORDER:
> case CIL_CATORDER:
> case CIL_SENSITIVITYORDER:
> + case CIL_EXPANDTYPEATTRIBUTE:
> break; /* Nothing to reset */
> default:
> break;
> diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
> index 6da44ba1..8925b271 100644
> --- a/libsepol/cil/src/cil_resolve_ast.c
> +++ b/libsepol/cil/src/cil_resolve_ast.c
> @@ -271,14 +271,24 @@ exit:
>
> int cil_type_used(struct cil_symtab_datum *datum, int used)
> {
> + int rc = SEPOL_ERR;
> struct cil_typeattribute *attr = NULL;
>
> if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
> attr = (struct cil_typeattribute*)datum;
> attr->used |= used;
> + if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
> + (attr->used & CIL_ATTR_EXPAND_FALSE)) {
> + cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
> + "Expandtypeattribute may be set to true or false "
> + "but not both. \n");
> + goto exit;
> + }
> }
>
> - return 0;
> + return SEPOL_OK;
> +exit:
> + return rc;
> }
>
> int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
> @@ -453,6 +463,44 @@ exit:
> return rc;
> }
>
> +int cil_resolve_expandtypeattribute(struct cil_tree_node *current, void *extra_args)
> +{
> + struct cil_expandtypeattribute *expandattr = current->data;
> + struct cil_symtab_datum *attr_datum = NULL;
> + struct cil_tree_node *attr_node = NULL;
> + struct cil_list_item *curr;
> + int used;
> + int rc = SEPOL_ERR;
> +
> + cil_list_init(&expandattr->attr_datums, CIL_TYPE);
> +
> + cil_list_for_each(curr, expandattr->attr_strs) {
> + rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_TYPES, extra_args, &attr_datum);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + attr_node = attr_datum->nodes->head->data;
> +
> + if (attr_node->flavor != CIL_TYPEATTRIBUTE) {
> + rc = SEPOL_ERR;
> + cil_log(CIL_ERR, "Attribute type not an attribute\n");
> + goto exit;
> + }
> + used = expandattr->expand ? CIL_ATTR_EXPAND_TRUE : CIL_ATTR_EXPAND_FALSE;
> + rc = cil_type_used(attr_datum, used);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + cil_list_append(expandattr->attr_datums, CIL_TYPE, attr_datum);
> + }
> +
> + return SEPOL_OK;
> +exit:
> + return rc;
> +}
> +
> int cil_resolve_aliasactual(struct cil_tree_node *current, void *extra_args, enum cil_flavor flavor, enum cil_flavor alias_flavor)
> {
> int rc = SEPOL_ERR;
> @@ -3432,6 +3480,9 @@ int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
> case CIL_TYPEATTRIBUTESET:
> rc = cil_resolve_typeattributeset(node, args);
> break;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + rc = cil_resolve_expandtypeattribute(node, args);
> + break;
> case CIL_TYPEBOUNDS:
> rc = cil_resolve_bounds(node, args, CIL_TYPE, CIL_TYPEATTRIBUTE);
> break;
> diff --git a/libsepol/cil/src/cil_tree.c b/libsepol/cil/src/cil_tree.c
> index 9ff9d4b4..2cc2744a 100644
> --- a/libsepol/cil/src/cil_tree.c
> +++ b/libsepol/cil/src/cil_tree.c
> @@ -703,6 +703,17 @@ void cil_tree_print_node(struct cil_tree_node *node)
> cil_log(CIL_INFO, "TYPE: %s\n", type->datum.name);
> return;
> }
> + case CIL_EXPANDTYPEATTRIBUTE: {
> + struct cil_expandtypeattribute *attr = node->data;
> +
> + fprintf(stderr, "%s %u\n", __func__, __LINE__);
> + cil_log(CIL_INFO, "(EXPANDTYPEATTRIBUTE ");
> + cil_tree_print_expr(attr->attr_datums, attr->attr_strs);
> + cil_log(CIL_INFO, "%s)\n",attr->expand ?
> + CIL_KEY_CONDTRUE : CIL_KEY_CONDFALSE);
> +
> + return;
> + }
> case CIL_TYPEATTRIBUTESET: {
> struct cil_typeattributeset *attr = node->data;
>
> diff --git a/libsepol/include/sepol/policydb/policydb.h b/libsepol/include/sepol/policydb/policydb.h
> index 4336a3f2..37e0c9e5 100644
> --- a/libsepol/include/sepol/policydb/policydb.h
> +++ b/libsepol/include/sepol/policydb/policydb.h
> @@ -178,7 +178,11 @@ typedef struct type_datum {
> #define TYPE_ALIAS 2 /* alias in modular policy */
> uint32_t flavor;
> ebitmap_t types; /* types with this attribute */
> -#define TYPE_FLAGS_PERMISSIVE 0x01
> +#define TYPE_FLAGS_PERMISSIVE (1 << 0)
> +#define TYPE_FLAGS_EXPAND_ATTR_TRUE (1 << 1)
> +#define TYPE_FLAGS_EXPAND_ATTR_FALSE (1 << 2)
> +#define TYPE_FLAGS_EXPAND_ATTR (TYPE_FLAGS_EXPAND_ATTR_TRUE | \
> + TYPE_FLAGS_EXPAND_ATTR_FALSE)
> uint32_t flags;
> uint32_t bounds; /* bounds type, if exist */
> } type_datum_t;
> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> index ac095c30..7d8eb204 100644
> --- a/libsepol/src/module_to_cil.c
> +++ b/libsepol/src/module_to_cil.c
> @@ -2244,6 +2244,17 @@ static int type_to_cil(int indent, struct policydb *pdb, struct avrule_block *UN
> cil_println(indent, "(typeattribute %s)", key);
> }
>
> + if (type->flags & TYPE_FLAGS_EXPAND_ATTR) {
> + cil_indent(indent);
> + cil_printf("(expandtypeattribute (%s) ", key);
> + if (type->flags & TYPE_FLAGS_EXPAND_ATTR_TRUE) {
> + cil_printf("true");
> + } else if (type->flags & TYPE_FLAGS_EXPAND_ATTR_FALSE) {
> + cil_printf("false");
> + }
> + cil_printf(")\n");
> + }
> +
> if (ebitmap_cardinality(&type->types) > 0) {
> cil_indent(indent);
> cil_printf("(typeattributeset %s (", key);
>
--
James Carter <jwcart2@tycho.nsa.gov>
National Security Agency
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Add attribute expansion options
2017-05-05 20:29 ` James Carter
@ 2017-05-05 21:02 ` Jeffrey Vander Stoep
0 siblings, 0 replies; 4+ messages in thread
From: Jeffrey Vander Stoep @ 2017-05-05 21:02 UTC (permalink / raw)
To: James Carter, selinux
[-- Attachment #1: Type: text/plain, Size: 29705 bytes --]
Yes, we are generating CIL from policy.conf files.
On Fri, May 5, 2017 at 1:28 PM James Carter <jwcart2@tycho.nsa.gov> wrote:
> On 05/04/2017 05:36 PM, Jeff Vander Stoep wrote:
> > This commit adds attribute expansion statements to the policy
> > language allowing compiler defaults to be overridden.
> >
> > Always expands an attribute example:
> > expandattribute { foo } true;
> > CIL example:
> > (expandtypeattribute (foo) true)
> >
> > Never expand an attribute example:
> > expandattribute { bar } false;
> > CIL example:
> > (expandtypeattribute (bar) false)
> >
>
> It works for secilc and for checkpolicy -C (which outputs CIL), but the
> expandattribute rules are ignored when building the kernel policy from a
> policy.conf. Are you generating CIL from policy.conf files? If not, then it
> might make sense to only have this feature in CIL.
>
> Jim
>
> > Adding the annotations directly to policy was chosen over other
> > methods as it is consistent with how targeted runtime optimizations
> > are specified in other languages. For example, in C the "inline"
> > command.
> >
> > Motivation
> >
> > expandattribute true:
> > Android has been moving away from a monolithic policy binary to
> > a two part split policy representing the Android platform and the
> > underlying vendor-provided hardware interface. The goal is a stable
> > API allowing these two parts to be updated independently of each
> > other. Attributes provide an important mechanism for compatibility.
> > For example, when the vendor provides a HAL for the platform,
> > permissions needed by clients of the HAL can be granted to an
> > attribute. Clients need only be assigned the attribute and do not
> > need to be aware of the underlying types and permissions being
> > granted.
> >
> > Inheriting permissions via attribute creates a convenient mechanism
> > for independence between vendor and platform policy, but results
> > in the creation of many attributes, and the potential for performance
> > issues when processes are clients of many HALs. [1] Annotating these
> > attributes for expansion at compile time allows us to retain the
> > compatibility benefits of using attributes without the performance
> > costs. [2]
> >
> > expandattribute false:
> > Commit 0be23c3f15fd added the capability to aggresively remove unused
> > attributes. This is generally useful as too many attributes assigned
> > to a type results in lengthy policy look up times when there is a
> > cache miss. However, removing attributes can also result in loss of
> > information used in external tests. On Android, we're considering
> > stripping neverallow rules from on-device policy. This is consistent
> > with the kernel policy binary which also did not contain neverallows.
> > Removing neverallow rules results in a 5-10% decrease in on-device
> > policy build and load and a policy size decrease of ~250k. Neverallow
> > rules are still asserted at build time and during device
> > certification (CTS). If neverallow rules are absent when secilc is
> > run, some attributes are being stripped from policy and neverallow
> > tests in CTS may be violated. [3] This change retains the aggressive
> > attribute stripping behavior but adds an override mechanism to
> > preserve attributes marked as necessary.
> >
> > [1] https://github.com/SELinuxProject/cil/issues/9
> > [2] Annotating all HAL client attributes for expansion resulted in
> > system_server's dropping from 19 attributes to 8. Because these
> > attributes were not widely applied to other types, the final
> > policy size change was negligible.
> > [3] data_file_type and service_manager_type are stripped from AOSP
> > policy when using secilc's -G option. This impacts 11 neverallow
> > tests in CTS.
> >
> > Test: Build and boot Marlin with all hal_*_client attributes marked
> > for expansion. Verify (using seinfo and sesearch) that permissions
> > are correctly expanded from attributes to types.
> > Test: Mark types being stripped by secilc with "preserve" and verify
> > that they are retained in policy and applied to the same types.
> >
> > Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
> > ---
> > checkpolicy/policy_define.c | 82
> ++++++++++++++++++++++++++++++
> > checkpolicy/policy_define.h | 1 +
> > checkpolicy/policy_parse.y | 5 ++
> > checkpolicy/policy_scan.l | 2 +
> > libsepol/cil/src/cil.c | 15 ++++++
> > libsepol/cil/src/cil_build_ast.c | 72
> ++++++++++++++++++++++++++
> > libsepol/cil/src/cil_build_ast.h | 2 +
> > libsepol/cil/src/cil_copy_ast.c | 26 ++++++++++
> > libsepol/cil/src/cil_flavor.h | 1 +
> > libsepol/cil/src/cil_internal.h | 16 ++++--
> > libsepol/cil/src/cil_post.c | 8 +++
> > libsepol/cil/src/cil_reset_ast.c | 1 +
> > libsepol/cil/src/cil_resolve_ast.c | 53 ++++++++++++++++++-
> > libsepol/cil/src/cil_tree.c | 11 ++++
> > libsepol/include/sepol/policydb/policydb.h | 6 ++-
> > libsepol/src/module_to_cil.c | 11 ++++
> > 16 files changed, 307 insertions(+), 5 deletions(-)
> >
> > diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> > index 949ca711..63e3c53f 100644
> > --- a/checkpolicy/policy_define.c
> > +++ b/checkpolicy/policy_define.c
> > @@ -1139,6 +1139,88 @@ int define_attrib(void)
> > return 0;
> > }
> >
> > +int expand_attrib(void)
> > +{
> > + char *id;
> > + ebitmap_t attrs;
> > + type_datum_t *attr;
> > + ebitmap_node_t *node;
> > + uint32_t i;
> > + int rc = -1;
> > + int flags = 0;
> > +
> > + if (pass == 1) {
> > + for (i = 0; i < 2; i++) {
> > + while ((id = queue_remove(id_queue))) {
> > + free(id);
> > + }
> > + }
> > + return 0;
> > + }
> > +
> > + ebitmap_init(&attrs);
> > + while ((id = queue_remove(id_queue))) {
> > + if (!id) {
> > + yyerror("No attribute name for expandattribute
> statement?");
> > + goto exit;
> > + }
> > +
> > + if (!is_id_in_scope(SYM_TYPES, id)) {
> > + yyerror2("attribute %s is not within scope", id);
> > + goto exit;
> > + }
> > +
> > + attr = hashtab_search(policydbp->p_types.table, id);
> > + if (!attr) {
> > + yyerror2("attribute %s is not declared", id);
> > + goto exit;
> > + }
> > +
> > + if (attr->flavor != TYPE_ATTRIB) {
> > + yyerror2("%s is a type, not an attribute", id);
> > + goto exit;
> > + }
> > +
> > + if (attr->flags & TYPE_FLAGS_EXPAND_ATTR) {
> > + yyerror2("%s already has the expandattribute
> option specified", id);
> > + goto exit;
> > + }
> > + if (ebitmap_set_bit(&attrs, attr->s.value - 1, TRUE)) {
> > + yyerror("Out of memory!");
> > + goto exit;
> > + }
> > +
> > + free(id);
> > + }
> > +
> > + id = (char *) queue_remove(id_queue);
> > + if (!id) {
> > + yyerror("No option specified for attribute expansion.");
> > + goto exit;
> > + }
> > +
> > + if (!strcmp(id, "T")) {
> > + flags = TYPE_FLAGS_EXPAND_ATTR_TRUE;
> > + } else {
> > + flags = TYPE_FLAGS_EXPAND_ATTR_FALSE;
> > + }
> > +
> > + ebitmap_for_each_bit(&attrs, node, i) {
> > + if (!ebitmap_node_get_bit(node, i)){
> > + continue;
> > + }
> > + attr = hashtab_search(policydbp->p_types.table,
> > + policydbp->sym_val_to_name[SYM_TYPES][i]);
> > + attr->flags |= flags;
> > + }
> > +
> > + rc = 0;
> > +exit:
> > + ebitmap_destroy(&attrs);
> > + free(id);
> > + return rc;
> > +}
> > +
> > static int add_aliases_to_type(type_datum_t * type)
> > {
> > char *id;
> > diff --git a/checkpolicy/policy_define.h b/checkpolicy/policy_define.h
> > index 964baae0..9f4b6d0d 100644
> > --- a/checkpolicy/policy_define.h
> > +++ b/checkpolicy/policy_define.h
> > @@ -65,6 +65,7 @@ int define_typebounds(void);
> > int define_type(int alias);
> > int define_user(void);
> > int define_validatetrans(constraint_expr_t *expr);
> > +int expand_attrib(void);
> > int insert_id(const char *id,int push);
> > int insert_separator(int push);
> > role_datum_t *define_role_dom(role_datum_t *r);
> > diff --git a/checkpolicy/policy_parse.y b/checkpolicy/policy_parse.y
> > index 3b6a2f86..1ac1c96b 100644
> > --- a/checkpolicy/policy_parse.y
> > +++ b/checkpolicy/policy_parse.y
> > @@ -103,6 +103,7 @@ typedef int (* require_func_t)(int pass);
> > %token TYPES
> > %token ALIAS
> > %token ATTRIBUTE
> > +%token EXPANDATTRIBUTE
> > %token BOOL
> > %token TUNABLE
> > %token IF
> > @@ -314,6 +315,7 @@ rbac_decl : attribute_role_def
> > | role_attr_def
> > ;
> > te_decl : attribute_def
> > + | expandattribute_def
> > | type_def
> > | typealias_def
> > | typeattribute_def
> > @@ -328,6 +330,9 @@ te_decl : attribute_def
> > attribute_def : ATTRIBUTE identifier ';'
> > { if (define_attrib()) return -1;}
> > ;
> > +expandattribute_def : EXPANDATTRIBUTE names bool_val ';'
> > + { if (expand_attrib()) return -1;}
> > + ;
> > type_def : TYPE identifier alias_def opt_attr_list ';'
> > {if (define_type(1)) return -1;}
> > | TYPE identifier opt_attr_list ';'
> > diff --git a/checkpolicy/policy_scan.l b/checkpolicy/policy_scan.l
> > index 2f7f2216..028bd25e 100644
> > --- a/checkpolicy/policy_scan.l
> > +++ b/checkpolicy/policy_scan.l
> > @@ -106,6 +106,8 @@ ALIAS |
> > alias { return(ALIAS); }
> > ATTRIBUTE |
> > attribute { return(ATTRIBUTE); }
> > +EXPANDATTRIBUTE |
> > +expandattribute { return(EXPANDATTRIBUTE); }
> > TYPE_TRANSITION |
> > type_transition { return(TYPE_TRANSITION); }
> > TYPE_MEMBER |
> > diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> > index a64c5284..9b9ccc36 100644
> > --- a/libsepol/cil/src/cil.c
> > +++ b/libsepol/cil/src/cil.c
> > @@ -159,6 +159,7 @@ static void cil_init_keys(void)
> > CIL_KEY_SELINUXUSERDEFAULT = cil_strpool_add("selinuxuserdefault");
> > CIL_KEY_TYPEATTRIBUTE = cil_strpool_add("typeattribute");
> > CIL_KEY_TYPEATTRIBUTESET = cil_strpool_add("typeattributeset");
> > + CIL_KEY_EXPANDTYPEATTRIBUTE =
> cil_strpool_add("expandtypeattribute");
> > CIL_KEY_TYPEALIAS = cil_strpool_add("typealias");
> > CIL_KEY_TYPEALIASACTUAL = cil_strpool_add("typealiasactual");
> > CIL_KEY_TYPEBOUNDS = cil_strpool_add("typebounds");
> > @@ -623,6 +624,9 @@ void cil_destroy_data(void **data, enum cil_flavor
> flavor)
> > case CIL_TYPEATTRIBUTESET:
> > cil_destroy_typeattributeset(*data);
> > break;
> > + case CIL_EXPANDTYPEATTRIBUTE:
> > + cil_destroy_expandtypeattribute(*data);
> > + break;
> > case CIL_TYPEALIASACTUAL:
> > cil_destroy_aliasactual(*data);
> > break;
> > @@ -987,6 +991,8 @@ const char * cil_node_to_string(struct cil_tree_node
> *node)
> > return CIL_KEY_TYPEALIAS;
> > case CIL_TYPEATTRIBUTESET:
> > return CIL_KEY_TYPEATTRIBUTESET;
> > + case CIL_EXPANDTYPEATTRIBUTE:
> > + return CIL_KEY_EXPANDTYPEATTRIBUTE;
> > case CIL_TYPEALIASACTUAL:
> > return CIL_KEY_TYPEALIASACTUAL;
> > case CIL_TYPEBOUNDS:
> > @@ -2038,6 +2044,15 @@ void cil_typeattributeset_init(struct
> cil_typeattributeset **attrset)
> > (*attrset)->datum_expr = NULL;
> > }
> >
> > +void cil_expandtypeattribute_init(struct cil_expandtypeattribute
> **expandattr)
> > +{
> > + *expandattr = cil_malloc(sizeof(**expandattr));
> > +
> > + (*expandattr)->attr_strs = NULL;
> > + (*expandattr)->attr_datums = NULL;
> > + (*expandattr)->expand = 0;
> > +}
> > +
> > void cil_alias_init(struct cil_alias **alias)
> > {
> > *alias = cil_malloc(sizeof(**alias));
> > diff --git a/libsepol/cil/src/cil_build_ast.c
> b/libsepol/cil/src/cil_build_ast.c
> > index 4b03dc35..36cc6735 100644
> > --- a/libsepol/cil/src/cil_build_ast.c
> > +++ b/libsepol/cil/src/cil_build_ast.c
> > @@ -3176,6 +3176,75 @@ void cil_destroy_typeattributeset(struct
> cil_typeattributeset *attrset)
> > free(attrset);
> > }
> >
> > +int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node
> *parse_current, struct cil_tree_node *ast_node)
> > +{
> > + enum cil_syntax syntax[] = {
> > + CIL_SYN_STRING,
> > + CIL_SYN_STRING | CIL_SYN_LIST,
> > + CIL_SYN_STRING,
> > + CIL_SYN_END
> > + };
> > + char *expand_str;
> > + int syntax_len = sizeof(syntax)/sizeof(*syntax);
> > + struct cil_expandtypeattribute *expandattr = NULL;
> > + int rc = SEPOL_ERR;
> > +
> > + if (db == NULL || parse_current == NULL || ast_node == NULL) {
> > + goto exit;
> > + }
> > +
> > + rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
> > + if (rc != SEPOL_OK) {
> > + goto exit;
> > + }
> > +
> > + cil_expandtypeattribute_init(&expandattr);
> > +
> > + if (parse_current->next->cl_head == NULL) {
> > + cil_list_init(&expandattr->attr_strs, CIL_TYPE);
> > + cil_list_append(expandattr->attr_strs, CIL_STRING,
> parse_current->next->data);
> > + } else {
> > + rc = cil_fill_list(parse_current->next->cl_head, CIL_TYPE,
> &expandattr->attr_strs);
> > + if (rc != SEPOL_OK) {
> > + goto exit;
> > + }
> > + }
> > +
> > + expand_str = parse_current->next->next->data;
> > +
> > + if (expand_str == CIL_KEY_CONDTRUE) {
> > + expandattr->expand = CIL_TRUE;
> > + } else if (expand_str == CIL_KEY_CONDFALSE) {
> > + expandattr->expand = CIL_FALSE;
> > + } else {
> > + cil_log(CIL_ERR, "Value must be either \'true\' or
> \'false\'");
> > + goto exit;
> > + }
> > +
> > + ast_node->data = expandattr;
> > + ast_node->flavor = CIL_EXPANDTYPEATTRIBUTE;
> > +
> > + return SEPOL_OK;
> > +
> > +exit:
> > + cil_tree_log(parse_current, CIL_ERR, "Bad expandtypeattribute
> statement");
> > + cil_destroy_expandtypeattribute(expandattr);
> > + return rc;
> > +}
> > +
> > +void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute
> *expandattr)
> > +{
> > + if (expandattr == NULL) {
> > + return;
> > + }
> > +
> > + cil_list_destroy(&expandattr->attr_strs, CIL_TRUE);
> > +
> > + cil_list_destroy(&expandattr->attr_datums, CIL_FALSE);
> > +
> > + free(expandattr);
> > +}
> > +
> > int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node
> *parse_current, struct cil_tree_node *ast_node)
> > {
> > enum cil_syntax syntax[] = {
> > @@ -6013,6 +6082,9 @@ int __cil_build_ast_node_helper(struct
> cil_tree_node *parse_current, uint32_t *f
> > } else if (parse_current->data == CIL_KEY_TYPEATTRIBUTESET) {
> > rc = cil_gen_typeattributeset(db, parse_current, ast_node);
> > *finished = CIL_TREE_SKIP_NEXT;
> > + } else if (parse_current->data == CIL_KEY_EXPANDTYPEATTRIBUTE) {
> > + rc = cil_gen_expandtypeattribute(db, parse_current,
> ast_node);
> > + *finished = CIL_TREE_SKIP_NEXT;
> > } else if (parse_current->data == CIL_KEY_TYPEALIAS) {
> > rc = cil_gen_alias(db, parse_current, ast_node,
> CIL_TYPEALIAS);
> > } else if (parse_current->data == CIL_KEY_TYPEALIASACTUAL) {
> > diff --git a/libsepol/cil/src/cil_build_ast.h
> b/libsepol/cil/src/cil_build_ast.h
> > index 54662035..33bae997 100644
> > --- a/libsepol/cil/src/cil_build_ast.h
> > +++ b/libsepol/cil/src/cil_build_ast.h
> > @@ -138,6 +138,8 @@ int cil_gen_aliasactual(struct cil_db *db, struct
> cil_tree_node *parse_current,
> > void cil_destroy_aliasactual(struct cil_aliasactual *aliasactual);
> > int cil_gen_typeattributeset(struct cil_db *db, struct cil_tree_node
> *parse_current, struct cil_tree_node *ast_node);
> > void cil_destroy_typeattributeset(struct cil_typeattributeset
> *attrtypes);
> > +int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node
> *parse_current, struct cil_tree_node *ast_node);
> > +void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute
> *expandattr);
> > int cil_gen_typebounds(struct cil_db *db, struct cil_tree_node
> *parse_current, struct cil_tree_node *ast_node);
> > int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node
> *parse_current, struct cil_tree_node *ast_node);
> > void cil_destroy_typepermissive(struct cil_typepermissive *typeperm);
> > diff --git a/libsepol/cil/src/cil_copy_ast.c
> b/libsepol/cil/src/cil_copy_ast.c
> > index 2d085dd7..d6685050 100644
> > --- a/libsepol/cil/src/cil_copy_ast.c
> > +++ b/libsepol/cil/src/cil_copy_ast.c
> > @@ -648,6 +648,29 @@ int cil_copy_typeattributeset(struct cil_db *db,
> void *data, void **copy, __attr
> > return SEPOL_OK;
> > }
> >
> > +int cil_copy_expandtypeattribute(__attribute__((unused)) struct cil_db
> *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
> > +{
> > + struct cil_expandtypeattribute *orig = data;
> > + struct cil_expandtypeattribute *new = NULL;
> > +
> > + fprintf(stderr, "%s %u\n", __func__, __LINE__);
> > + cil_expandtypeattribute_init(&new);
> > +
> > + if (orig->attr_strs != NULL) {
> > + cil_copy_list(orig->attr_strs, &new->attr_strs);
> > + }
> > +
> > + if (orig->attr_datums != NULL) {
> > + cil_copy_list(orig->attr_datums, &new->attr_datums);
> > + }
> > +
> > + new->expand = orig->expand;
> > +
> > + *copy = new;
> > +
> > + return SEPOL_OK;
> > +}
> > +
> > int cil_copy_alias(__attribute__((unused)) struct cil_db *db, void
> *data, void **copy, symtab_t *symtab)
> > {
> > struct cil_alias *orig = data;
> > @@ -1808,6 +1831,9 @@ int __cil_copy_node_helper(struct cil_tree_node
> *orig, __attribute__((unused)) u
> > case CIL_TYPEATTRIBUTESET:
> > copy_func = &cil_copy_typeattributeset;
> > break;
> > + case CIL_EXPANDTYPEATTRIBUTE:
> > + copy_func = &cil_copy_expandtypeattribute;
> > + break;
> > case CIL_TYPEALIAS:
> > copy_func = &cil_copy_alias;
> > break;
> > diff --git a/libsepol/cil/src/cil_flavor.h
> b/libsepol/cil/src/cil_flavor.h
> > index cd08b972..c01f967a 100644
> > --- a/libsepol/cil/src/cil_flavor.h
> > +++ b/libsepol/cil/src/cil_flavor.h
> > @@ -73,6 +73,7 @@ enum cil_flavor {
> > CIL_ROLETYPE,
> > CIL_ROLEBOUNDS,
> > CIL_TYPEATTRIBUTESET,
> > + CIL_EXPANDTYPEATTRIBUTE,
> > CIL_TYPEALIASACTUAL,
> > CIL_TYPEBOUNDS,
> > CIL_TYPEPERMISSIVE,
> > diff --git a/libsepol/cil/src/cil_internal.h
> b/libsepol/cil/src/cil_internal.h
> > index efa2cd6e..aee3f00c 100644
> > --- a/libsepol/cil/src/cil_internal.h
> > +++ b/libsepol/cil/src/cil_internal.h
> > @@ -174,6 +174,7 @@ char *CIL_KEY_SELINUXUSER;
> > char *CIL_KEY_SELINUXUSERDEFAULT;
> > char *CIL_KEY_TYPEATTRIBUTE;
> > char *CIL_KEY_TYPEATTRIBUTESET;
> > +char *CIL_KEY_EXPANDTYPEATTRIBUTE;
> > char *CIL_KEY_TYPEALIAS;
> > char *CIL_KEY_TYPEALIASACTUAL;
> > char *CIL_KEY_TYPEBOUNDS;
> > @@ -515,9 +516,11 @@ struct cil_type {
> > int value;
> > };
> >
> > -#define CIL_ATTR_AVRULE 0x01
> > -#define CIL_ATTR_NEVERALLOW 0x02
> > -#define CIL_ATTR_CONSTRAINT 0x04
> > +#define CIL_ATTR_AVRULE (1 << 0)
> > +#define CIL_ATTR_NEVERALLOW (1 << 1)
> > +#define CIL_ATTR_CONSTRAINT (1 << 2)
> > +#define CIL_ATTR_EXPAND_TRUE (1 << 3)
> > +#define CIL_ATTR_EXPAND_FALSE (1 << 4)
> > struct cil_typeattribute {
> > struct cil_symtab_datum datum;
> > struct cil_list *expr_list;
> > @@ -531,6 +534,12 @@ struct cil_typeattributeset {
> > struct cil_list *datum_expr;
> > };
> >
> > +struct cil_expandtypeattribute {
> > + struct cil_list *attr_strs;
> > + struct cil_list *attr_datums;
> > + int expand;
> > +};
> > +
> > struct cil_typepermissive {
> > char *type_str;
> > void *type; /* type or alias */
> > @@ -977,6 +986,7 @@ void cil_roleattributeset_init(struct
> cil_roleattributeset **attrset);
> > void cil_roletype_init(struct cil_roletype **roletype);
> > void cil_typeattribute_init(struct cil_typeattribute **attribute);
> > void cil_typeattributeset_init(struct cil_typeattributeset **attrset);
> > +void cil_expandtypeattribute_init(struct cil_expandtypeattribute
> **expandattr);
> > void cil_alias_init(struct cil_alias **alias);
> > void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
> > void cil_typepermissive_init(struct cil_typepermissive **typeperm);
> > diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
> > index e32a8fc9..1941fab3 100644
> > --- a/libsepol/cil/src/cil_post.c
> > +++ b/libsepol/cil/src/cil_post.c
> > @@ -1194,6 +1194,14 @@ static int cil_typeattribute_used(struct
> cil_typeattribute *attr, struct cil_db
> > return CIL_FALSE;
> > }
> >
> > + if (attr->used & CIL_ATTR_EXPAND_FALSE) {
> > + return CIL_TRUE;
> > + }
> > +
> > + if (attr->used & CIL_ATTR_EXPAND_TRUE) {
> > + return CIL_FALSE;
> > + }
> > +
> > if (attr->used & CIL_ATTR_CONSTRAINT) {
> > return CIL_TRUE;
> > }
> > diff --git a/libsepol/cil/src/cil_reset_ast.c
> b/libsepol/cil/src/cil_reset_ast.c
> > index de00679e..676e156e 100644
> > --- a/libsepol/cil/src/cil_reset_ast.c
> > +++ b/libsepol/cil/src/cil_reset_ast.c
> > @@ -549,6 +549,7 @@ int __cil_reset_node(struct cil_tree_node *node,
> __attribute__((unused)) uint32
> > case CIL_CLASSORDER:
> > case CIL_CATORDER:
> > case CIL_SENSITIVITYORDER:
> > + case CIL_EXPANDTYPEATTRIBUTE:
> > break; /* Nothing to reset */
> > default:
> > break;
> > diff --git a/libsepol/cil/src/cil_resolve_ast.c
> b/libsepol/cil/src/cil_resolve_ast.c
> > index 6da44ba1..8925b271 100644
> > --- a/libsepol/cil/src/cil_resolve_ast.c
> > +++ b/libsepol/cil/src/cil_resolve_ast.c
> > @@ -271,14 +271,24 @@ exit:
> >
> > int cil_type_used(struct cil_symtab_datum *datum, int used)
> > {
> > + int rc = SEPOL_ERR;
> > struct cil_typeattribute *attr = NULL;
> >
> > if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
> > attr = (struct cil_typeattribute*)datum;
> > attr->used |= used;
> > + if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
> > + (attr->used & CIL_ATTR_EXPAND_FALSE)) {
> > + cil_log(CIL_ERR, "Conflicting use of
> expandtypeattribute. "
> > + "Expandtypeattribute may be set to
> true or false "
> > + "but not both. \n");
> > + goto exit;
> > + }
> > }
> >
> > - return 0;
> > + return SEPOL_OK;
> > +exit:
> > + return rc;
> > }
> >
> > int cil_resolve_permissionx(struct cil_tree_node *current, struct
> cil_permissionx *permx, void *extra_args)
> > @@ -453,6 +463,44 @@ exit:
> > return rc;
> > }
> >
> > +int cil_resolve_expandtypeattribute(struct cil_tree_node *current, void
> *extra_args)
> > +{
> > + struct cil_expandtypeattribute *expandattr = current->data;
> > + struct cil_symtab_datum *attr_datum = NULL;
> > + struct cil_tree_node *attr_node = NULL;
> > + struct cil_list_item *curr;
> > + int used;
> > + int rc = SEPOL_ERR;
> > +
> > + cil_list_init(&expandattr->attr_datums, CIL_TYPE);
> > +
> > + cil_list_for_each(curr, expandattr->attr_strs) {
> > + rc = cil_resolve_name(current, (char *)curr->data,
> CIL_SYM_TYPES, extra_args, &attr_datum);
> > + if (rc != SEPOL_OK) {
> > + goto exit;
> > + }
> > +
> > + attr_node = attr_datum->nodes->head->data;
> > +
> > + if (attr_node->flavor != CIL_TYPEATTRIBUTE) {
> > + rc = SEPOL_ERR;
> > + cil_log(CIL_ERR, "Attribute type not an
> attribute\n");
> > + goto exit;
> > + }
> > + used = expandattr->expand ? CIL_ATTR_EXPAND_TRUE :
> CIL_ATTR_EXPAND_FALSE;
> > + rc = cil_type_used(attr_datum, used);
> > + if (rc != SEPOL_OK) {
> > + goto exit;
> > + }
> > +
> > + cil_list_append(expandattr->attr_datums, CIL_TYPE,
> attr_datum);
> > + }
> > +
> > + return SEPOL_OK;
> > +exit:
> > + return rc;
> > +}
> > +
> > int cil_resolve_aliasactual(struct cil_tree_node *current, void
> *extra_args, enum cil_flavor flavor, enum cil_flavor alias_flavor)
> > {
> > int rc = SEPOL_ERR;
> > @@ -3432,6 +3480,9 @@ int __cil_resolve_ast_node(struct cil_tree_node
> *node, void *extra_args)
> > case CIL_TYPEATTRIBUTESET:
> > rc = cil_resolve_typeattributeset(node, args);
> > break;
> > + case CIL_EXPANDTYPEATTRIBUTE:
> > + rc = cil_resolve_expandtypeattribute(node, args);
> > + break;
> > case CIL_TYPEBOUNDS:
> > rc = cil_resolve_bounds(node, args, CIL_TYPE,
> CIL_TYPEATTRIBUTE);
> > break;
> > diff --git a/libsepol/cil/src/cil_tree.c b/libsepol/cil/src/cil_tree.c
> > index 9ff9d4b4..2cc2744a 100644
> > --- a/libsepol/cil/src/cil_tree.c
> > +++ b/libsepol/cil/src/cil_tree.c
> > @@ -703,6 +703,17 @@ void cil_tree_print_node(struct cil_tree_node *node)
> > cil_log(CIL_INFO, "TYPE: %s\n", type->datum.name);
> > return;
> > }
> > + case CIL_EXPANDTYPEATTRIBUTE: {
> > + struct cil_expandtypeattribute *attr = node->data;
> > +
> > + fprintf(stderr, "%s %u\n", __func__, __LINE__);
> > + cil_log(CIL_INFO, "(EXPANDTYPEATTRIBUTE ");
> > + cil_tree_print_expr(attr->attr_datums,
> attr->attr_strs);
> > + cil_log(CIL_INFO, "%s)\n",attr->expand ?
> > + CIL_KEY_CONDTRUE :
> CIL_KEY_CONDFALSE);
> > +
> > + return;
> > + }
> > case CIL_TYPEATTRIBUTESET: {
> > struct cil_typeattributeset *attr = node->data;
> >
> > diff --git a/libsepol/include/sepol/policydb/policydb.h
> b/libsepol/include/sepol/policydb/policydb.h
> > index 4336a3f2..37e0c9e5 100644
> > --- a/libsepol/include/sepol/policydb/policydb.h
> > +++ b/libsepol/include/sepol/policydb/policydb.h
> > @@ -178,7 +178,11 @@ typedef struct type_datum {
> > #define TYPE_ALIAS 2 /* alias in modular policy */
> > uint32_t flavor;
> > ebitmap_t types; /* types with this attribute */
> > -#define TYPE_FLAGS_PERMISSIVE 0x01
> > +#define TYPE_FLAGS_PERMISSIVE (1 << 0)
> > +#define TYPE_FLAGS_EXPAND_ATTR_TRUE (1 << 1)
> > +#define TYPE_FLAGS_EXPAND_ATTR_FALSE (1 << 2)
> > +#define TYPE_FLAGS_EXPAND_ATTR (TYPE_FLAGS_EXPAND_ATTR_TRUE | \
> > + TYPE_FLAGS_EXPAND_ATTR_FALSE)
> > uint32_t flags;
> > uint32_t bounds; /* bounds type, if exist */
> > } type_datum_t;
> > diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> > index ac095c30..7d8eb204 100644
> > --- a/libsepol/src/module_to_cil.c
> > +++ b/libsepol/src/module_to_cil.c
> > @@ -2244,6 +2244,17 @@ static int type_to_cil(int indent, struct
> policydb *pdb, struct avrule_block *UN
> > cil_println(indent, "(typeattribute %s)", key);
> > }
> >
> > + if (type->flags & TYPE_FLAGS_EXPAND_ATTR) {
> > + cil_indent(indent);
> > + cil_printf("(expandtypeattribute (%s) ", key);
> > + if (type->flags & TYPE_FLAGS_EXPAND_ATTR_TRUE) {
> > + cil_printf("true");
> > + } else if (type->flags &
> TYPE_FLAGS_EXPAND_ATTR_FALSE) {
> > + cil_printf("false");
> > + }
> > + cil_printf(")\n");
> > + }
> > +
> > if (ebitmap_cardinality(&type->types) > 0) {
> > cil_indent(indent);
> > cil_printf("(typeattributeset %s (", key);
> >
>
>
> --
> James Carter <jwcart2@tycho.nsa.gov>
> National Security Agency
>
[-- Attachment #2: Type: text/html, Size: 37437 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Add attribute expansion options
2017-05-04 21:36 [PATCH] Add attribute expansion options Jeff Vander Stoep
2017-05-05 20:29 ` James Carter
@ 2017-05-09 16:56 ` James Carter
1 sibling, 0 replies; 4+ messages in thread
From: James Carter @ 2017-05-09 16:56 UTC (permalink / raw)
To: Jeff Vander Stoep, selinux
On 05/04/2017 05:36 PM, Jeff Vander Stoep wrote:
> This commit adds attribute expansion statements to the policy
> language allowing compiler defaults to be overridden.
>
> Always expands an attribute example:
> expandattribute { foo } true;
> CIL example:
> (expandtypeattribute (foo) true)
>
> Never expand an attribute example:
> expandattribute { bar } false;
> CIL example:
> (expandtypeattribute (bar) false)
>
> Adding the annotations directly to policy was chosen over other
> methods as it is consistent with how targeted runtime optimizations
> are specified in other languages. For example, in C the "inline"
> command.
>
> Motivation
>
> expandattribute true:
> Android has been moving away from a monolithic policy binary to
> a two part split policy representing the Android platform and the
> underlying vendor-provided hardware interface. The goal is a stable
> API allowing these two parts to be updated independently of each
> other. Attributes provide an important mechanism for compatibility.
> For example, when the vendor provides a HAL for the platform,
> permissions needed by clients of the HAL can be granted to an
> attribute. Clients need only be assigned the attribute and do not
> need to be aware of the underlying types and permissions being
> granted.
>
> Inheriting permissions via attribute creates a convenient mechanism
> for independence between vendor and platform policy, but results
> in the creation of many attributes, and the potential for performance
> issues when processes are clients of many HALs. [1] Annotating these
> attributes for expansion at compile time allows us to retain the
> compatibility benefits of using attributes without the performance
> costs. [2]
>
> expandattribute false:
> Commit 0be23c3f15fd added the capability to aggresively remove unused
> attributes. This is generally useful as too many attributes assigned
> to a type results in lengthy policy look up times when there is a
> cache miss. However, removing attributes can also result in loss of
> information used in external tests. On Android, we're considering
> stripping neverallow rules from on-device policy. This is consistent
> with the kernel policy binary which also did not contain neverallows.
> Removing neverallow rules results in a 5-10% decrease in on-device
> policy build and load and a policy size decrease of ~250k. Neverallow
> rules are still asserted at build time and during device
> certification (CTS). If neverallow rules are absent when secilc is
> run, some attributes are being stripped from policy and neverallow
> tests in CTS may be violated. [3] This change retains the aggressive
> attribute stripping behavior but adds an override mechanism to
> preserve attributes marked as necessary.
>
> [1] https://github.com/SELinuxProject/cil/issues/9
> [2] Annotating all HAL client attributes for expansion resulted in
> system_server's dropping from 19 attributes to 8. Because these
> attributes were not widely applied to other types, the final
> policy size change was negligible.
> [3] data_file_type and service_manager_type are stripped from AOSP
> policy when using secilc's -G option. This impacts 11 neverallow
> tests in CTS.
>
> Test: Build and boot Marlin with all hal_*_client attributes marked
> for expansion. Verify (using seinfo and sesearch) that permissions
> are correctly expanded from attributes to types.
> Test: Mark types being stripped by secilc with "preserve" and verify
> that they are retained in policy and applied to the same types.
>
> Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Applied.
Thanks,
Jim
> ---
> checkpolicy/policy_define.c | 82 ++++++++++++++++++++++++++++++
> checkpolicy/policy_define.h | 1 +
> checkpolicy/policy_parse.y | 5 ++
> checkpolicy/policy_scan.l | 2 +
> libsepol/cil/src/cil.c | 15 ++++++
> libsepol/cil/src/cil_build_ast.c | 72 ++++++++++++++++++++++++++
> libsepol/cil/src/cil_build_ast.h | 2 +
> libsepol/cil/src/cil_copy_ast.c | 26 ++++++++++
> libsepol/cil/src/cil_flavor.h | 1 +
> libsepol/cil/src/cil_internal.h | 16 ++++--
> libsepol/cil/src/cil_post.c | 8 +++
> libsepol/cil/src/cil_reset_ast.c | 1 +
> libsepol/cil/src/cil_resolve_ast.c | 53 ++++++++++++++++++-
> libsepol/cil/src/cil_tree.c | 11 ++++
> libsepol/include/sepol/policydb/policydb.h | 6 ++-
> libsepol/src/module_to_cil.c | 11 ++++
> 16 files changed, 307 insertions(+), 5 deletions(-)
>
> diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> index 949ca711..63e3c53f 100644
> --- a/checkpolicy/policy_define.c
> +++ b/checkpolicy/policy_define.c
> @@ -1139,6 +1139,88 @@ int define_attrib(void)
> return 0;
> }
>
> +int expand_attrib(void)
> +{
> + char *id;
> + ebitmap_t attrs;
> + type_datum_t *attr;
> + ebitmap_node_t *node;
> + uint32_t i;
> + int rc = -1;
> + int flags = 0;
> +
> + if (pass == 1) {
> + for (i = 0; i < 2; i++) {
> + while ((id = queue_remove(id_queue))) {
> + free(id);
> + }
> + }
> + return 0;
> + }
> +
> + ebitmap_init(&attrs);
> + while ((id = queue_remove(id_queue))) {
> + if (!id) {
> + yyerror("No attribute name for expandattribute statement?");
> + goto exit;
> + }
> +
> + if (!is_id_in_scope(SYM_TYPES, id)) {
> + yyerror2("attribute %s is not within scope", id);
> + goto exit;
> + }
> +
> + attr = hashtab_search(policydbp->p_types.table, id);
> + if (!attr) {
> + yyerror2("attribute %s is not declared", id);
> + goto exit;
> + }
> +
> + if (attr->flavor != TYPE_ATTRIB) {
> + yyerror2("%s is a type, not an attribute", id);
> + goto exit;
> + }
> +
> + if (attr->flags & TYPE_FLAGS_EXPAND_ATTR) {
> + yyerror2("%s already has the expandattribute option specified", id);
> + goto exit;
> + }
> + if (ebitmap_set_bit(&attrs, attr->s.value - 1, TRUE)) {
> + yyerror("Out of memory!");
> + goto exit;
> + }
> +
> + free(id);
> + }
> +
> + id = (char *) queue_remove(id_queue);
> + if (!id) {
> + yyerror("No option specified for attribute expansion.");
> + goto exit;
> + }
> +
> + if (!strcmp(id, "T")) {
> + flags = TYPE_FLAGS_EXPAND_ATTR_TRUE;
> + } else {
> + flags = TYPE_FLAGS_EXPAND_ATTR_FALSE;
> + }
> +
> + ebitmap_for_each_bit(&attrs, node, i) {
> + if (!ebitmap_node_get_bit(node, i)){
> + continue;
> + }
> + attr = hashtab_search(policydbp->p_types.table,
> + policydbp->sym_val_to_name[SYM_TYPES][i]);
> + attr->flags |= flags;
> + }
> +
> + rc = 0;
> +exit:
> + ebitmap_destroy(&attrs);
> + free(id);
> + return rc;
> +}
> +
> static int add_aliases_to_type(type_datum_t * type)
> {
> char *id;
> diff --git a/checkpolicy/policy_define.h b/checkpolicy/policy_define.h
> index 964baae0..9f4b6d0d 100644
> --- a/checkpolicy/policy_define.h
> +++ b/checkpolicy/policy_define.h
> @@ -65,6 +65,7 @@ int define_typebounds(void);
> int define_type(int alias);
> int define_user(void);
> int define_validatetrans(constraint_expr_t *expr);
> +int expand_attrib(void);
> int insert_id(const char *id,int push);
> int insert_separator(int push);
> role_datum_t *define_role_dom(role_datum_t *r);
> diff --git a/checkpolicy/policy_parse.y b/checkpolicy/policy_parse.y
> index 3b6a2f86..1ac1c96b 100644
> --- a/checkpolicy/policy_parse.y
> +++ b/checkpolicy/policy_parse.y
> @@ -103,6 +103,7 @@ typedef int (* require_func_t)(int pass);
> %token TYPES
> %token ALIAS
> %token ATTRIBUTE
> +%token EXPANDATTRIBUTE
> %token BOOL
> %token TUNABLE
> %token IF
> @@ -314,6 +315,7 @@ rbac_decl : attribute_role_def
> | role_attr_def
> ;
> te_decl : attribute_def
> + | expandattribute_def
> | type_def
> | typealias_def
> | typeattribute_def
> @@ -328,6 +330,9 @@ te_decl : attribute_def
> attribute_def : ATTRIBUTE identifier ';'
> { if (define_attrib()) return -1;}
> ;
> +expandattribute_def : EXPANDATTRIBUTE names bool_val ';'
> + { if (expand_attrib()) return -1;}
> + ;
> type_def : TYPE identifier alias_def opt_attr_list ';'
> {if (define_type(1)) return -1;}
> | TYPE identifier opt_attr_list ';'
> diff --git a/checkpolicy/policy_scan.l b/checkpolicy/policy_scan.l
> index 2f7f2216..028bd25e 100644
> --- a/checkpolicy/policy_scan.l
> +++ b/checkpolicy/policy_scan.l
> @@ -106,6 +106,8 @@ ALIAS |
> alias { return(ALIAS); }
> ATTRIBUTE |
> attribute { return(ATTRIBUTE); }
> +EXPANDATTRIBUTE |
> +expandattribute { return(EXPANDATTRIBUTE); }
> TYPE_TRANSITION |
> type_transition { return(TYPE_TRANSITION); }
> TYPE_MEMBER |
> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> index a64c5284..9b9ccc36 100644
> --- a/libsepol/cil/src/cil.c
> +++ b/libsepol/cil/src/cil.c
> @@ -159,6 +159,7 @@ static void cil_init_keys(void)
> CIL_KEY_SELINUXUSERDEFAULT = cil_strpool_add("selinuxuserdefault");
> CIL_KEY_TYPEATTRIBUTE = cil_strpool_add("typeattribute");
> CIL_KEY_TYPEATTRIBUTESET = cil_strpool_add("typeattributeset");
> + CIL_KEY_EXPANDTYPEATTRIBUTE = cil_strpool_add("expandtypeattribute");
> CIL_KEY_TYPEALIAS = cil_strpool_add("typealias");
> CIL_KEY_TYPEALIASACTUAL = cil_strpool_add("typealiasactual");
> CIL_KEY_TYPEBOUNDS = cil_strpool_add("typebounds");
> @@ -623,6 +624,9 @@ void cil_destroy_data(void **data, enum cil_flavor flavor)
> case CIL_TYPEATTRIBUTESET:
> cil_destroy_typeattributeset(*data);
> break;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + cil_destroy_expandtypeattribute(*data);
> + break;
> case CIL_TYPEALIASACTUAL:
> cil_destroy_aliasactual(*data);
> break;
> @@ -987,6 +991,8 @@ const char * cil_node_to_string(struct cil_tree_node *node)
> return CIL_KEY_TYPEALIAS;
> case CIL_TYPEATTRIBUTESET:
> return CIL_KEY_TYPEATTRIBUTESET;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + return CIL_KEY_EXPANDTYPEATTRIBUTE;
> case CIL_TYPEALIASACTUAL:
> return CIL_KEY_TYPEALIASACTUAL;
> case CIL_TYPEBOUNDS:
> @@ -2038,6 +2044,15 @@ void cil_typeattributeset_init(struct cil_typeattributeset **attrset)
> (*attrset)->datum_expr = NULL;
> }
>
> +void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr)
> +{
> + *expandattr = cil_malloc(sizeof(**expandattr));
> +
> + (*expandattr)->attr_strs = NULL;
> + (*expandattr)->attr_datums = NULL;
> + (*expandattr)->expand = 0;
> +}
> +
> void cil_alias_init(struct cil_alias **alias)
> {
> *alias = cil_malloc(sizeof(**alias));
> diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
> index 4b03dc35..36cc6735 100644
> --- a/libsepol/cil/src/cil_build_ast.c
> +++ b/libsepol/cil/src/cil_build_ast.c
> @@ -3176,6 +3176,75 @@ void cil_destroy_typeattributeset(struct cil_typeattributeset *attrset)
> free(attrset);
> }
>
> +int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
> +{
> + enum cil_syntax syntax[] = {
> + CIL_SYN_STRING,
> + CIL_SYN_STRING | CIL_SYN_LIST,
> + CIL_SYN_STRING,
> + CIL_SYN_END
> + };
> + char *expand_str;
> + int syntax_len = sizeof(syntax)/sizeof(*syntax);
> + struct cil_expandtypeattribute *expandattr = NULL;
> + int rc = SEPOL_ERR;
> +
> + if (db == NULL || parse_current == NULL || ast_node == NULL) {
> + goto exit;
> + }
> +
> + rc = __cil_verify_syntax(parse_current, syntax, syntax_len);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + cil_expandtypeattribute_init(&expandattr);
> +
> + if (parse_current->next->cl_head == NULL) {
> + cil_list_init(&expandattr->attr_strs, CIL_TYPE);
> + cil_list_append(expandattr->attr_strs, CIL_STRING, parse_current->next->data);
> + } else {
> + rc = cil_fill_list(parse_current->next->cl_head, CIL_TYPE, &expandattr->attr_strs);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> + }
> +
> + expand_str = parse_current->next->next->data;
> +
> + if (expand_str == CIL_KEY_CONDTRUE) {
> + expandattr->expand = CIL_TRUE;
> + } else if (expand_str == CIL_KEY_CONDFALSE) {
> + expandattr->expand = CIL_FALSE;
> + } else {
> + cil_log(CIL_ERR, "Value must be either \'true\' or \'false\'");
> + goto exit;
> + }
> +
> + ast_node->data = expandattr;
> + ast_node->flavor = CIL_EXPANDTYPEATTRIBUTE;
> +
> + return SEPOL_OK;
> +
> +exit:
> + cil_tree_log(parse_current, CIL_ERR, "Bad expandtypeattribute statement");
> + cil_destroy_expandtypeattribute(expandattr);
> + return rc;
> +}
> +
> +void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr)
> +{
> + if (expandattr == NULL) {
> + return;
> + }
> +
> + cil_list_destroy(&expandattr->attr_strs, CIL_TRUE);
> +
> + cil_list_destroy(&expandattr->attr_datums, CIL_FALSE);
> +
> + free(expandattr);
> +}
> +
> int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node)
> {
> enum cil_syntax syntax[] = {
> @@ -6013,6 +6082,9 @@ int __cil_build_ast_node_helper(struct cil_tree_node *parse_current, uint32_t *f
> } else if (parse_current->data == CIL_KEY_TYPEATTRIBUTESET) {
> rc = cil_gen_typeattributeset(db, parse_current, ast_node);
> *finished = CIL_TREE_SKIP_NEXT;
> + } else if (parse_current->data == CIL_KEY_EXPANDTYPEATTRIBUTE) {
> + rc = cil_gen_expandtypeattribute(db, parse_current, ast_node);
> + *finished = CIL_TREE_SKIP_NEXT;
> } else if (parse_current->data == CIL_KEY_TYPEALIAS) {
> rc = cil_gen_alias(db, parse_current, ast_node, CIL_TYPEALIAS);
> } else if (parse_current->data == CIL_KEY_TYPEALIASACTUAL) {
> diff --git a/libsepol/cil/src/cil_build_ast.h b/libsepol/cil/src/cil_build_ast.h
> index 54662035..33bae997 100644
> --- a/libsepol/cil/src/cil_build_ast.h
> +++ b/libsepol/cil/src/cil_build_ast.h
> @@ -138,6 +138,8 @@ int cil_gen_aliasactual(struct cil_db *db, struct cil_tree_node *parse_current,
> void cil_destroy_aliasactual(struct cil_aliasactual *aliasactual);
> int cil_gen_typeattributeset(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> void cil_destroy_typeattributeset(struct cil_typeattributeset *attrtypes);
> +int cil_gen_expandtypeattribute(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> +void cil_destroy_expandtypeattribute(struct cil_expandtypeattribute *expandattr);
> int cil_gen_typebounds(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> int cil_gen_typepermissive(struct cil_db *db, struct cil_tree_node *parse_current, struct cil_tree_node *ast_node);
> void cil_destroy_typepermissive(struct cil_typepermissive *typeperm);
> diff --git a/libsepol/cil/src/cil_copy_ast.c b/libsepol/cil/src/cil_copy_ast.c
> index 2d085dd7..d6685050 100644
> --- a/libsepol/cil/src/cil_copy_ast.c
> +++ b/libsepol/cil/src/cil_copy_ast.c
> @@ -648,6 +648,29 @@ int cil_copy_typeattributeset(struct cil_db *db, void *data, void **copy, __attr
> return SEPOL_OK;
> }
>
> +int cil_copy_expandtypeattribute(__attribute__((unused)) struct cil_db *db, void *data, void **copy, __attribute__((unused)) symtab_t *symtab)
> +{
> + struct cil_expandtypeattribute *orig = data;
> + struct cil_expandtypeattribute *new = NULL;
> +
> + fprintf(stderr, "%s %u\n", __func__, __LINE__);
> + cil_expandtypeattribute_init(&new);
> +
> + if (orig->attr_strs != NULL) {
> + cil_copy_list(orig->attr_strs, &new->attr_strs);
> + }
> +
> + if (orig->attr_datums != NULL) {
> + cil_copy_list(orig->attr_datums, &new->attr_datums);
> + }
> +
> + new->expand = orig->expand;
> +
> + *copy = new;
> +
> + return SEPOL_OK;
> +}
> +
> int cil_copy_alias(__attribute__((unused)) struct cil_db *db, void *data, void **copy, symtab_t *symtab)
> {
> struct cil_alias *orig = data;
> @@ -1808,6 +1831,9 @@ int __cil_copy_node_helper(struct cil_tree_node *orig, __attribute__((unused)) u
> case CIL_TYPEATTRIBUTESET:
> copy_func = &cil_copy_typeattributeset;
> break;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + copy_func = &cil_copy_expandtypeattribute;
> + break;
> case CIL_TYPEALIAS:
> copy_func = &cil_copy_alias;
> break;
> diff --git a/libsepol/cil/src/cil_flavor.h b/libsepol/cil/src/cil_flavor.h
> index cd08b972..c01f967a 100644
> --- a/libsepol/cil/src/cil_flavor.h
> +++ b/libsepol/cil/src/cil_flavor.h
> @@ -73,6 +73,7 @@ enum cil_flavor {
> CIL_ROLETYPE,
> CIL_ROLEBOUNDS,
> CIL_TYPEATTRIBUTESET,
> + CIL_EXPANDTYPEATTRIBUTE,
> CIL_TYPEALIASACTUAL,
> CIL_TYPEBOUNDS,
> CIL_TYPEPERMISSIVE,
> diff --git a/libsepol/cil/src/cil_internal.h b/libsepol/cil/src/cil_internal.h
> index efa2cd6e..aee3f00c 100644
> --- a/libsepol/cil/src/cil_internal.h
> +++ b/libsepol/cil/src/cil_internal.h
> @@ -174,6 +174,7 @@ char *CIL_KEY_SELINUXUSER;
> char *CIL_KEY_SELINUXUSERDEFAULT;
> char *CIL_KEY_TYPEATTRIBUTE;
> char *CIL_KEY_TYPEATTRIBUTESET;
> +char *CIL_KEY_EXPANDTYPEATTRIBUTE;
> char *CIL_KEY_TYPEALIAS;
> char *CIL_KEY_TYPEALIASACTUAL;
> char *CIL_KEY_TYPEBOUNDS;
> @@ -515,9 +516,11 @@ struct cil_type {
> int value;
> };
>
> -#define CIL_ATTR_AVRULE 0x01
> -#define CIL_ATTR_NEVERALLOW 0x02
> -#define CIL_ATTR_CONSTRAINT 0x04
> +#define CIL_ATTR_AVRULE (1 << 0)
> +#define CIL_ATTR_NEVERALLOW (1 << 1)
> +#define CIL_ATTR_CONSTRAINT (1 << 2)
> +#define CIL_ATTR_EXPAND_TRUE (1 << 3)
> +#define CIL_ATTR_EXPAND_FALSE (1 << 4)
> struct cil_typeattribute {
> struct cil_symtab_datum datum;
> struct cil_list *expr_list;
> @@ -531,6 +534,12 @@ struct cil_typeattributeset {
> struct cil_list *datum_expr;
> };
>
> +struct cil_expandtypeattribute {
> + struct cil_list *attr_strs;
> + struct cil_list *attr_datums;
> + int expand;
> +};
> +
> struct cil_typepermissive {
> char *type_str;
> void *type; /* type or alias */
> @@ -977,6 +986,7 @@ void cil_roleattributeset_init(struct cil_roleattributeset **attrset);
> void cil_roletype_init(struct cil_roletype **roletype);
> void cil_typeattribute_init(struct cil_typeattribute **attribute);
> void cil_typeattributeset_init(struct cil_typeattributeset **attrset);
> +void cil_expandtypeattribute_init(struct cil_expandtypeattribute **expandattr);
> void cil_alias_init(struct cil_alias **alias);
> void cil_aliasactual_init(struct cil_aliasactual **aliasactual);
> void cil_typepermissive_init(struct cil_typepermissive **typeperm);
> diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
> index e32a8fc9..1941fab3 100644
> --- a/libsepol/cil/src/cil_post.c
> +++ b/libsepol/cil/src/cil_post.c
> @@ -1194,6 +1194,14 @@ static int cil_typeattribute_used(struct cil_typeattribute *attr, struct cil_db
> return CIL_FALSE;
> }
>
> + if (attr->used & CIL_ATTR_EXPAND_FALSE) {
> + return CIL_TRUE;
> + }
> +
> + if (attr->used & CIL_ATTR_EXPAND_TRUE) {
> + return CIL_FALSE;
> + }
> +
> if (attr->used & CIL_ATTR_CONSTRAINT) {
> return CIL_TRUE;
> }
> diff --git a/libsepol/cil/src/cil_reset_ast.c b/libsepol/cil/src/cil_reset_ast.c
> index de00679e..676e156e 100644
> --- a/libsepol/cil/src/cil_reset_ast.c
> +++ b/libsepol/cil/src/cil_reset_ast.c
> @@ -549,6 +549,7 @@ int __cil_reset_node(struct cil_tree_node *node, __attribute__((unused)) uint32
> case CIL_CLASSORDER:
> case CIL_CATORDER:
> case CIL_SENSITIVITYORDER:
> + case CIL_EXPANDTYPEATTRIBUTE:
> break; /* Nothing to reset */
> default:
> break;
> diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
> index 6da44ba1..8925b271 100644
> --- a/libsepol/cil/src/cil_resolve_ast.c
> +++ b/libsepol/cil/src/cil_resolve_ast.c
> @@ -271,14 +271,24 @@ exit:
>
> int cil_type_used(struct cil_symtab_datum *datum, int used)
> {
> + int rc = SEPOL_ERR;
> struct cil_typeattribute *attr = NULL;
>
> if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {
> attr = (struct cil_typeattribute*)datum;
> attr->used |= used;
> + if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
> + (attr->used & CIL_ATTR_EXPAND_FALSE)) {
> + cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
> + "Expandtypeattribute may be set to true or false "
> + "but not both. \n");
> + goto exit;
> + }
> }
>
> - return 0;
> + return SEPOL_OK;
> +exit:
> + return rc;
> }
>
> int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
> @@ -453,6 +463,44 @@ exit:
> return rc;
> }
>
> +int cil_resolve_expandtypeattribute(struct cil_tree_node *current, void *extra_args)
> +{
> + struct cil_expandtypeattribute *expandattr = current->data;
> + struct cil_symtab_datum *attr_datum = NULL;
> + struct cil_tree_node *attr_node = NULL;
> + struct cil_list_item *curr;
> + int used;
> + int rc = SEPOL_ERR;
> +
> + cil_list_init(&expandattr->attr_datums, CIL_TYPE);
> +
> + cil_list_for_each(curr, expandattr->attr_strs) {
> + rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_TYPES, extra_args, &attr_datum);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + attr_node = attr_datum->nodes->head->data;
> +
> + if (attr_node->flavor != CIL_TYPEATTRIBUTE) {
> + rc = SEPOL_ERR;
> + cil_log(CIL_ERR, "Attribute type not an attribute\n");
> + goto exit;
> + }
> + used = expandattr->expand ? CIL_ATTR_EXPAND_TRUE : CIL_ATTR_EXPAND_FALSE;
> + rc = cil_type_used(attr_datum, used);
> + if (rc != SEPOL_OK) {
> + goto exit;
> + }
> +
> + cil_list_append(expandattr->attr_datums, CIL_TYPE, attr_datum);
> + }
> +
> + return SEPOL_OK;
> +exit:
> + return rc;
> +}
> +
> int cil_resolve_aliasactual(struct cil_tree_node *current, void *extra_args, enum cil_flavor flavor, enum cil_flavor alias_flavor)
> {
> int rc = SEPOL_ERR;
> @@ -3432,6 +3480,9 @@ int __cil_resolve_ast_node(struct cil_tree_node *node, void *extra_args)
> case CIL_TYPEATTRIBUTESET:
> rc = cil_resolve_typeattributeset(node, args);
> break;
> + case CIL_EXPANDTYPEATTRIBUTE:
> + rc = cil_resolve_expandtypeattribute(node, args);
> + break;
> case CIL_TYPEBOUNDS:
> rc = cil_resolve_bounds(node, args, CIL_TYPE, CIL_TYPEATTRIBUTE);
> break;
> diff --git a/libsepol/cil/src/cil_tree.c b/libsepol/cil/src/cil_tree.c
> index 9ff9d4b4..2cc2744a 100644
> --- a/libsepol/cil/src/cil_tree.c
> +++ b/libsepol/cil/src/cil_tree.c
> @@ -703,6 +703,17 @@ void cil_tree_print_node(struct cil_tree_node *node)
> cil_log(CIL_INFO, "TYPE: %s\n", type->datum.name);
> return;
> }
> + case CIL_EXPANDTYPEATTRIBUTE: {
> + struct cil_expandtypeattribute *attr = node->data;
> +
> + fprintf(stderr, "%s %u\n", __func__, __LINE__);
> + cil_log(CIL_INFO, "(EXPANDTYPEATTRIBUTE ");
> + cil_tree_print_expr(attr->attr_datums, attr->attr_strs);
> + cil_log(CIL_INFO, "%s)\n",attr->expand ?
> + CIL_KEY_CONDTRUE : CIL_KEY_CONDFALSE);
> +
> + return;
> + }
> case CIL_TYPEATTRIBUTESET: {
> struct cil_typeattributeset *attr = node->data;
>
> diff --git a/libsepol/include/sepol/policydb/policydb.h b/libsepol/include/sepol/policydb/policydb.h
> index 4336a3f2..37e0c9e5 100644
> --- a/libsepol/include/sepol/policydb/policydb.h
> +++ b/libsepol/include/sepol/policydb/policydb.h
> @@ -178,7 +178,11 @@ typedef struct type_datum {
> #define TYPE_ALIAS 2 /* alias in modular policy */
> uint32_t flavor;
> ebitmap_t types; /* types with this attribute */
> -#define TYPE_FLAGS_PERMISSIVE 0x01
> +#define TYPE_FLAGS_PERMISSIVE (1 << 0)
> +#define TYPE_FLAGS_EXPAND_ATTR_TRUE (1 << 1)
> +#define TYPE_FLAGS_EXPAND_ATTR_FALSE (1 << 2)
> +#define TYPE_FLAGS_EXPAND_ATTR (TYPE_FLAGS_EXPAND_ATTR_TRUE | \
> + TYPE_FLAGS_EXPAND_ATTR_FALSE)
> uint32_t flags;
> uint32_t bounds; /* bounds type, if exist */
> } type_datum_t;
> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> index ac095c30..7d8eb204 100644
> --- a/libsepol/src/module_to_cil.c
> +++ b/libsepol/src/module_to_cil.c
> @@ -2244,6 +2244,17 @@ static int type_to_cil(int indent, struct policydb *pdb, struct avrule_block *UN
> cil_println(indent, "(typeattribute %s)", key);
> }
>
> + if (type->flags & TYPE_FLAGS_EXPAND_ATTR) {
> + cil_indent(indent);
> + cil_printf("(expandtypeattribute (%s) ", key);
> + if (type->flags & TYPE_FLAGS_EXPAND_ATTR_TRUE) {
> + cil_printf("true");
> + } else if (type->flags & TYPE_FLAGS_EXPAND_ATTR_FALSE) {
> + cil_printf("false");
> + }
> + cil_printf(")\n");
> + }
> +
> if (ebitmap_cardinality(&type->types) > 0) {
> cil_indent(indent);
> cil_printf("(typeattributeset %s (", key);
>
--
James Carter <jwcart2@tycho.nsa.gov>
National Security Agency
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-05-09 16:56 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-04 21:36 [PATCH] Add attribute expansion options Jeff Vander Stoep
2017-05-05 20:29 ` James Carter
2017-05-05 21:02 ` Jeffrey Vander Stoep
2017-05-09 16:56 ` James Carter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.