36d6db55b0
See
$ cd SELinuxProject/selinux
$ git log --pretty=oneline secilc-3.2..32611aea6543 -- secilc
98 lines
3.6 KiB
Diff
98 lines
3.6 KiB
Diff
From 532a4cc3365a0991ded85de81b8647f056cac926 Mon Sep 17 00:00:00 2001
|
|
From: James Carter <jwcart2@gmail.com>
|
|
Date: Tue, 29 Jun 2021 11:14:02 -0400
|
|
Subject: [PATCH] libsepol/cil: Add support for using qualified names to
|
|
secil2conf
|
|
|
|
Provide the option "-Q" or "--qualified-names" to indicate that the
|
|
policy is using qualified names.
|
|
|
|
Using qualified names means that declaration names can have "dots"
|
|
in them, but blocks, blockinherits, blockabstracts, and in-statements
|
|
are not allowed in the policy.
|
|
|
|
The libsepol function cil_set_qualified_names() is called with the
|
|
desired value for the CIL db's "qualified_names" field.
|
|
|
|
Signed-off-by: James Carter <jwcart2@gmail.com>
|
|
---
|
|
secilc/secil2conf.8.xml | 5 +++++
|
|
secilc/secil2conf.c | 11 ++++++++++-
|
|
2 files changed, 15 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/secilc/secil2conf.8.xml b/secilc/secil2conf.8.xml
|
|
index 59d87a5496cd..33646f97739b 100644
|
|
--- a/secilc/secil2conf.8.xml
|
|
+++ b/secilc/secil2conf.8.xml
|
|
@@ -50,6 +50,11 @@
|
|
<listitem><para>Treat tunables as booleans.</para></listitem>
|
|
</varlistentry>
|
|
|
|
+ <varlistentry>
|
|
+ <term><option>-Q, --qualified-names</option></term>
|
|
+ <listitem><para>Allow names containing dots (qualified names). Blocks, blockinherits, blockabstracts, and in-statements will not be allowed.</para></listitem>
|
|
+ </varlistentry>
|
|
+
|
|
<varlistentry>
|
|
<term><option>-v, --verbose</option></term>
|
|
<listitem><para>Increment verbosity level.</para></listitem>
|
|
diff --git a/secilc/secil2conf.c b/secilc/secil2conf.c
|
|
index 4e97dd66a436..d4103777a439 100644
|
|
--- a/secilc/secil2conf.c
|
|
+++ b/secilc/secil2conf.c
|
|
@@ -52,6 +52,9 @@ static __attribute__((__noreturn__)) void usage(const char *prog)
|
|
printf(" This will override the (mls boolean) statement\n");
|
|
printf(" if present in the policy\n");
|
|
printf(" -P, --preserve-tunables treat tunables as booleans\n");
|
|
+ printf(" -Q, --qualified-names Allow names containing dots (qualified names).\n");
|
|
+ printf(" Blocks, blockinherits, blockabstracts, and\n");
|
|
+ printf(" in-statements will not be allowed.\n");
|
|
printf(" -v, --verbose increment verbosity level\n");
|
|
printf(" -h, --help display usage information\n");
|
|
exit(1);
|
|
@@ -68,6 +71,7 @@ int main(int argc, char *argv[])
|
|
struct cil_db *db = NULL;
|
|
int mls = -1;
|
|
int preserve_tunables = 0;
|
|
+ int qualified_names = 0;
|
|
int opt_char;
|
|
int opt_index = 0;
|
|
enum cil_log_level log_level = CIL_ERR;
|
|
@@ -76,13 +80,14 @@ int main(int argc, char *argv[])
|
|
{"verbose", no_argument, 0, 'v'},
|
|
{"mls", required_argument, 0, 'M'},
|
|
{"preserve-tunables", no_argument, 0, 'P'},
|
|
+ {"qualified-names", no_argument, 0, 'Q'},
|
|
{"output", required_argument, 0, 'o'},
|
|
{0, 0, 0, 0}
|
|
};
|
|
int i;
|
|
|
|
while (1) {
|
|
- opt_char = getopt_long(argc, argv, "o:hvM:P", long_opts, &opt_index);
|
|
+ opt_char = getopt_long(argc, argv, "o:hvM:PQ", long_opts, &opt_index);
|
|
if (opt_char == -1) {
|
|
break;
|
|
}
|
|
@@ -102,6 +107,9 @@ int main(int argc, char *argv[])
|
|
case 'P':
|
|
preserve_tunables = 1;
|
|
break;
|
|
+ case 'Q':
|
|
+ qualified_names = 1;
|
|
+ break;
|
|
case 'o':
|
|
output = strdup(optarg);
|
|
break;
|
|
@@ -123,6 +131,7 @@ int main(int argc, char *argv[])
|
|
|
|
cil_db_init(&db);
|
|
cil_set_preserve_tunables(db, preserve_tunables);
|
|
+ cil_set_qualified_names(db, qualified_names);
|
|
cil_set_mls(db, mls);
|
|
cil_set_attrs_expand_generated(db, 0);
|
|
cil_set_attrs_expand_size(db, 0);
|
|
--
|
|
2.32.0
|
|
|