Added "-G, --expand_generated" option to specify that all automatically generated attributes should be expanded and removed.
Added "-X, --expand_size <SIZE>" option to specify which attributes are expanded when building a kernel policy. All attributes that have less types assigned to it than SIZE will be expanded when writing AV rules. Signed-off-by: James Carter <jwca...@tycho.nsa.gov> --- secilc/secil2conf.c | 2 ++ secilc/secilc.8.xml | 10 ++++++++++ secilc/secilc.c | 31 ++++++++++++++++++++++++++++++- 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/secilc/secil2conf.c b/secilc/secil2conf.c index 5d8fe87..4e97dd6 100644 --- a/secilc/secil2conf.c +++ b/secilc/secil2conf.c @@ -124,6 +124,8 @@ int main(int argc, char *argv[]) cil_db_init(&db); cil_set_preserve_tunables(db, preserve_tunables); cil_set_mls(db, mls); + cil_set_attrs_expand_generated(db, 0); + cil_set_attrs_expand_size(db, 0); for (i = optind; i < argc; i++) { file = fopen(argv[i], "r"); diff --git a/secilc/secilc.8.xml b/secilc/secilc.8.xml index 9e2670b..4c779b6 100644 --- a/secilc/secilc.8.xml +++ b/secilc/secilc.8.xml @@ -81,6 +81,16 @@ </varlistentry> <varlistentry> + <term><option>-G, --expand-generated</option></term> + <listitem><para>Expand and remove auto-generated attributes</para></listitem> + </varlistentry> + + <varlistentry> + <term><option>-X, --attrs-size <size></option></term> + <listitem><para>Expand type attributes with fewer than <emphasis role="bold"><SIZE></emphasis> members.</para></listitem> + </varlistentry> + + <varlistentry> <term><option>-v, --verbose</option></term> <listitem><para>Increment verbosity level.</para></listitem> </varlistentry> diff --git a/secilc/secilc.c b/secilc/secilc.c index f4ecbee..f2232e7 100644 --- a/secilc/secilc.c +++ b/secilc/secilc.c @@ -64,6 +64,9 @@ static __attribute__((__noreturn__)) void usage(const char *prog) printf(" -D, --disable-dontaudit do not add dontaudit rules to the binary policy\n"); printf(" -P, --preserve-tunables treat tunables as booleans\n"); printf(" -N, --disable-neverallow do not check neverallow rules\n"); + printf(" -G, --expand-generated Expand and remove auto-generated attributes\n"); + printf(" -X, --expand-size <SIZE> Expand type attributes with fewer than <SIZE>\n"); + printf(" members.\n"); printf(" -v, --verbose increment verbosity level\n"); printf(" -h, --help display usage information\n"); exit(1); @@ -90,6 +93,8 @@ int main(int argc, char *argv[]) int preserve_tunables = 0; int handle_unknown = -1; int policyvers = POLICYDB_VERSION_MAX; + int attrs_expand_generated = 0; + int attrs_expand_size = -1; int opt_char; int opt_index = 0; char *fc_buf = NULL; @@ -107,12 +112,14 @@ int main(int argc, char *argv[]) {"preserve-tunables", no_argument, 0, 'P'}, {"output", required_argument, 0, 'o'}, {"filecontexts", required_argument, 0, 'f'}, + {"expand-generated", no_argument, 0, 'G'}, + {"expand-size", required_argument, 0, 'X'}, {0, 0, 0, 0} }; int i; while (1) { - opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PDNc:", long_opts, &opt_index); + opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PDNc:GX:", long_opts, &opt_index); if (opt_char == -1) { break; } @@ -180,6 +187,24 @@ int main(int argc, char *argv[]) case 'f': filecontexts = strdup(optarg); break; + case 'G': + attrs_expand_generated = 1; + break; + case 'X': { + char *endptr = NULL; + errno = 0; + attrs_expand_size = strtol(optarg, &endptr, 10); + if (errno != 0 || endptr == optarg || *endptr != '\0') { + fprintf(stderr, "Bad attribute expand size: %s\n", optarg); + usage(argv[0]); + } + + if (attrs_expand_size < 0) { + fprintf(stderr, "Attribute expand size must be > 0\n"); + usage(argv[0]); + } + break; + } case 'h': usage(argv[0]); case '?': @@ -210,6 +235,10 @@ int main(int argc, char *argv[]) cil_set_mls(db, mls); cil_set_target_platform(db, target); cil_set_policy_version(db, policyvers); + cil_set_attrs_expand_generated(db, attrs_expand_generated); + if (attrs_expand_size >= 0) { + cil_set_attrs_expand_size(db, (unsigned)attrs_expand_size); + } for (i = optind; i < argc; i++) { file = fopen(argv[i], "r"); -- 2.7.4 _______________________________________________ Selinux mailing list Selinux@tycho.nsa.gov To unsubscribe, send email to selinux-le...@tycho.nsa.gov. To get help, send an email containing "help" to selinux-requ...@tycho.nsa.gov.