From f7b8b5055f0ccaf6e4611609581a2f9772c954c9 Mon Sep 17 00:00:00 2001 From: James Carter Date: Tue, 29 Jun 2021 11:14:00 -0400 Subject: [PATCH] secilc: Add support for using qualified names to secilc Provide the option "-Q" or "--qualified-names" to indicate that the policy is using qualified names. Using qualified names means that declaration names can have "dots" in them, but blocks, blockinherits, blockabstracts, and in-statements are not allowed in the policy. The libsepol function cil_set_qualified_names() is called with the desired value for the CIL db's "qualified_names" field. Signed-off-by: James Carter --- secilc/secilc.8.xml | 5 +++++ secilc/secilc.c | 11 ++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/secilc/secilc.8.xml b/secilc/secilc.8.xml index 2b734f09cf13..e9a121e26aee 100644 --- a/secilc/secilc.8.xml +++ b/secilc/secilc.8.xml @@ -75,6 +75,11 @@ Treat tunables as booleans. + + + Allow names containing dots (qualified names). Blocks, blockinherits, blockabstracts, and in-statements will not be allowed. + + Allow some statements to be re-declared. diff --git a/secilc/secilc.c b/secilc/secilc.c index 9c78e42565e9..1c4f1ca07b97 100644 --- a/secilc/secilc.c +++ b/secilc/secilc.c @@ -63,6 +63,9 @@ static __attribute__((__noreturn__)) void usage(const char *prog) printf(" statement if present in the policy\n"); printf(" -D, --disable-dontaudit do not add dontaudit rules to the binary policy\n"); printf(" -P, --preserve-tunables treat tunables as booleans\n"); + printf(" -Q, --qualified-names Allow names containing dots (qualified names).\n"); + printf(" Blocks, blockinherits, blockabstracts, and\n"); + printf(" in-statements will not be allowed.\n"); printf(" -m, --multiple-decls allow some statements to be re-declared\n"); printf(" -N, --disable-neverallow do not check neverallow rules\n"); printf(" -G, --expand-generated Expand and remove auto-generated attributes\n"); @@ -94,6 +97,7 @@ int main(int argc, char *argv[]) int multiple_decls = 0; int disable_neverallow = 0; int preserve_tunables = 0; + int qualified_names = 0; int handle_unknown = -1; int policyvers = POLICYDB_VERSION_MAX; int attrs_expand_generated = 0; @@ -115,6 +119,7 @@ int main(int argc, char *argv[]) {"multiple-decls", no_argument, 0, 'm'}, {"disable-neverallow", no_argument, 0, 'N'}, {"preserve-tunables", no_argument, 0, 'P'}, + {"qualified-names", no_argument, 0, 'Q'}, {"output", required_argument, 0, 'o'}, {"filecontexts", required_argument, 0, 'f'}, {"expand-generated", no_argument, 0, 'G'}, @@ -125,7 +130,7 @@ int main(int argc, char *argv[]) int i; while (1) { - opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PDmNOc:GX:n", long_opts, &opt_index); + opt_char = getopt_long(argc, argv, "o:f:U:hvt:M:PQDmNOc:GX:n", long_opts, &opt_index); if (opt_char == -1) { break; } @@ -190,6 +195,9 @@ int main(int argc, char *argv[]) case 'P': preserve_tunables = 1; break; + case 'Q': + qualified_names = 1; + break; case 'o': output = strdup(optarg); break; @@ -238,6 +246,7 @@ int main(int argc, char *argv[]) cil_set_multiple_decls(db, multiple_decls); cil_set_disable_neverallow(db, disable_neverallow); cil_set_preserve_tunables(db, preserve_tunables); + cil_set_qualified_names(db, qualified_names); if (handle_unknown != -1) { rc = cil_set_handle_unknown(db, handle_unknown); if (rc != SEPOL_OK) { -- 2.32.0