SELinux Archive on lore.kernel.org
 help / color / Atom feed
From: James Carter <jwcart2@gmail.com>
To: Dominick Grift <dominick.grift@defensec.nl>
Cc: SElinux list <selinux@vger.kernel.org>
Subject: Re: [PATCH v4] secilc/docs: document expandtypeattribute
Date: Mon, 3 Aug 2020 16:56:50 -0400
Message-ID: <CAP+JOzQ=wnAWHp7i6OVjpV58QxdFPT63ON7HOLuVHjoL8O2Oqg@mail.gmail.com> (raw)
In-Reply-To: <20200802123421.222597-1-dominick.grift@defensec.nl>

On Sun, Aug 2, 2020 at 8:39 AM Dominick Grift
<dominick.grift@defensec.nl> wrote:
>
> This was added for Androids Treble in 2017.
>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
> ---
> v2: overriden is overridden
> v3: add link to README.md
> v4: rephrase and add another example
>
>  secilc/docs/README.md              |  1 +
>  secilc/docs/cil_type_statements.md | 44 ++++++++++++++++++++++++++++++
>  2 files changed, 45 insertions(+)
>
> diff --git a/secilc/docs/README.md b/secilc/docs/README.md
> index 3f1838e6..efab2a71 100644
> --- a/secilc/docs/README.md
> +++ b/secilc/docs/README.md
> @@ -126,6 +126,7 @@ CIL (Common Intermediate Language)
>    * [typealiasactual](cil_type_statements.md#typealiasactual)
>    * [typeattribute](cil_type_statements.md#typeattribute)
>    * [typeattributeset](cil_type_statements.md#typeattributeset)
> +  * [expandtypeattribute](cil_type_statements.md#expandtypeattribute)
>    * [typebounds](cil_type_statements.md#typebounds)
>    * [typechange](cil_type_statements.md#typechange)
>    * [typemember](cil_type_statements.md#typemember)
> diff --git a/secilc/docs/cil_type_statements.md b/secilc/docs/cil_type_statements.md
> index f9dd3a76..41f0f01a 100644
> --- a/secilc/docs/cil_type_statements.md
> +++ b/secilc/docs/cil_type_statements.md
> @@ -213,6 +213,50 @@ This example is equivalent to `{ domain -kernel.process -ueventd.process -init.p
>          )
>      )
>
> +expandtypeattribute
> +-------------------
> +
> +Overrides the compiler defaults for the expansion of one or more previously declared [`typeattribute`](cil_type_statements.md#typeattribute) identifiers.
> +
> +Note that this statement can be overridden at compile-time with `secilc -X SIZE` and that this functionality is not intended to override `secilc -X SIZE` for individual type attributes!
> +

I didn't mention the "-X" option in my reply to the selinux notebook patch.

This is like what I mentioned in the selinux notebook, but mentions
the "-X" option.

Gives more control over type attribute expansion and removal. When the
value is true, all rules involving the type attribute will be expanded
and the type attribute will be removed from the policy. When the value
is false, the type attribute will not be removed from the policy, even
if the default expand rules or "-X" option cause the rules involving
the type attribute to be expanded.

Thanks,
Jim

> +**Statement definition:**
> +
> +    (expandtypeattribute typeattribute_id true|false)
> +
> +**Where:**
> +
> +<table>
> +<colgroup>
> +<col width="25%" />
> +<col width="75%" />
> +</colgroup>
> +<tbody>
> +<tr class="odd">
> +<td align="left"><p><code>expandtypeattribute</code></p></td>
> +<td align="left"><p>The <code>expandtypeattribute</code> keyword.</p></td>
> +</tr>
> +<tr class="even">
> +<td align="left"><p><code>typeattribute_id</code></p></td>
> +<td align="left"><p>One or more previously declared <code>typeattribute</code> identifiers. Multiple entries consist of a space separated list enclosed in parentheses '()'.</p></td>
> +</tr>
> +<tr class="odd">
> +<td align="left"><p><code>true | false</code></p></td>
> +<td align="left"><p>Either true or false.</p></td>
> +</tr>
> +</tbody>
> +</table>
> +
> +**Examples:**
> +
> +This example uses the expandtypeattribute statement to forcibly expand a previously declared `domain` type attribute.
> +
> +    (expandtypeattribute domain true)
> +
> +This example uses the expandtypeattribute statement to not expand previously declared `file_type` and `port_type` type attributes regardless of compiler defaults.
> +
> +    (expandtypeattribute (file_type port_type) false)
> +
>  typebounds
>  ----------
>
> --
> 2.28.0
>

  reply index

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-30  9:23 [PATCH] " Dominick Grift
2020-07-30 11:45 ` [PATCH v2] " Dominick Grift
2020-07-30 13:11   ` [PATCH v3] " Dominick Grift
2020-07-30 22:22     ` James Carter
2020-07-31  7:26       ` Dominick Grift
2020-07-31 19:50         ` James Carter
2020-07-31 20:12           ` Dominick Grift
2020-07-31 20:22             ` James Carter
2020-07-31 21:07               ` Dominick Grift
2020-08-02 12:34       ` [PATCH v4] " Dominick Grift
2020-08-03 20:56         ` James Carter [this message]
2020-08-04  7:18           ` Dominick Grift
2020-08-04 14:45             ` James Carter
2020-08-04 15:48               ` Dominick Grift
2020-08-04 20:23                 ` James Carter
2020-08-04 20:29                   ` Dominick Grift
2020-08-05 19:23                     ` James Carter
2020-08-05 19:48                       ` [PATCH v5] " Dominick Grift
2020-08-05 20:22                         ` James Carter
2020-08-17 15:57                           ` Stephen Smalley

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAP+JOzQ=wnAWHp7i6OVjpV58QxdFPT63ON7HOLuVHjoL8O2Oqg@mail.gmail.com' \
    --to=jwcart2@gmail.com \
    --cc=dominick.grift@defensec.nl \
    --cc=selinux@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org
	public-inbox-index selinux

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git