From: James Carter <jwcart2@gmail.com>
To: selinux@vger.kernel.org
Cc: j2468h@googlemail.com, James Carter <jwcart2@gmail.com>
Subject: [PATCH 3/4 v2] libsepol/cil: Limit the neverallow violations reported
Date: Wed, 19 Jan 2022 11:35:17 -0500 [thread overview]
Message-ID: <20220119163518.93780-4-jwcart2@gmail.com> (raw)
In-Reply-To: <20220119163518.93780-1-jwcart2@gmail.com>
When there is a neverallow violation, a search is made for all of
the rules that violate the neverallow. The violating rules as well
as their parents are written out to make it easier to find these
rules.
If there is a lot of rules that violate a neverallow, then this
amount of reporting is too much. Instead, only print out the first
four rules (with their parents) that match the violated neverallow
rule along with the total number of rules that violate the
neverallow at the default log level. Report all the violations when
at a higher verbosity level.
Signed-off-by: James Carter <jwcart2@gmail.com>
---
libsepol/cil/src/cil_binary.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
index b7da8241..8b64b37a 100644
--- a/libsepol/cil/src/cil_binary.c
+++ b/libsepol/cil/src/cil_binary.c
@@ -4640,6 +4640,9 @@ static int __cil_print_neverallow_failure(const struct cil_db *db, struct cil_tr
char *neverallow_str;
char *allow_str;
enum cil_flavor avrule_flavor;
+ int num_matching = 0;
+ int count_matching = 0;
+ enum cil_log_level log_level = cil_get_log_level();
target.rule_kind = CIL_AVRULE_ALLOWED;
target.is_extended = cil_rule->is_extended;
@@ -4666,11 +4669,19 @@ static int __cil_print_neverallow_failure(const struct cil_db *db, struct cil_tr
goto exit;
}
+ cil_list_for_each(i2, matching) {
+ num_matching++;
+ }
cil_list_for_each(i2, matching) {
n2 = i2->data;
r2 = n2->data;
__cil_print_parents(" ", n2);
__cil_print_rule(" ", allow_str, r2);
+ count_matching++;
+ if (count_matching >= 4 && num_matching > 4 && log_level == CIL_ERR) {
+ cil_log(CIL_ERR, " Only first 4 of %d matching rules shown (use \"-v\" to show all)\n", num_matching);
+ break;
+ }
}
cil_log(CIL_ERR,"\n");
cil_list_destroy(&matching, CIL_FALSE);
--
2.31.1
next prev parent reply other threads:[~2022-01-19 16:35 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-19 16:35 [PATCH 0/4 v2] libsepol/cil: Limit certain error and warning reports James Carter
2022-01-19 16:35 ` [PATCH 1/4 v2] libsepol/cil: Add cil_get_log_level() function James Carter
2022-01-19 16:35 ` [PATCH 2/4 v2] libsepol/cil: Provide more control over reporting bounds failures James Carter
2022-01-19 16:35 ` James Carter [this message]
2022-01-19 16:35 ` [PATCH 4/4 v2] libsepol/cil: Limit the amount of reporting for context rule conflicts James Carter
2022-02-18 21:17 ` [PATCH 0/4 v2] libsepol/cil: Limit certain error and warning reports James Carter
2022-02-24 21:07 ` James Carter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220119163518.93780-4-jwcart2@gmail.com \
--to=jwcart2@gmail.com \
--cc=j2468h@googlemail.com \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.