Skip to content

libsepol, policycoreutils, and checkpolicy: Add support for generating CIL to libsepol and checkpolicy

James Carter selinux 5 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v5 Latest3 patches 3 repliesIn review
  2. v43 patches 1 replySuperseded
  3. v33 patches 7 repliesSuperseded
Earlier versions · 2
VersionPostedPatchesRepliesStatus
v23 patches0 repliesSuperseded
v13 patches0 repliesSuperseded

Patches in v5 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/3libsepol, policycoreutils: Move functions to convert a module package to CILlibsepol/Android.mk libsepol/include/sepol/module_to_cil.h libsepol/src/libsepol.map.in +3 more+3886 -38280 replies
2/3libsepol: add function to generate CIL from a module policydblibsepol/include/sepol/module_to_cil.h libsepol/src/libsepol.map.in libsepol/src/module_to_cil.c+255 -1150 replies
3/3checkpolicy: Add support for generating CILcheckpolicy/checkmodule.8 checkpolicy/checkmodule.c checkpolicy/checkpolicy.8 +1 more+105 -560 replies

Reviews trailers per patch

None of the 3 patches has a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchSteve Lawrence
SeriesA-b
1/3
2/3
3/3

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v5 thread

Cover letter [PATCH 0/3 v5] libsepol, policycoreutils, and checkpolicy: Add support for generating CIL to libsepol and checkpolicy

V5 Update usage functions for checkpolicy and checkmodule.
V4 Adds the new command-line options to the checkpolicy and checkmodule man pages, adds error checking and messages to checkpolicy and checkmodule, updates libsepol's Android.mk and libsepol.map.in files as needed, and makes pp linke libsepol dynamically. V3 fixes another whitespace issue.
V2 fixes some whitespace issues and make the new libsepol file LGPL instead of GPL.

This patch set moves the code to generate CIL from pp.c in policycoreutils/hll/pp to libsepol, adds a new function to generate CIL from a module policydb, and modifies checkpolicy and checkmodule to support generating CIL as their output.

The primary motivation of this work is to allow SE for Android to use the CIl compiler. Converting the policy.conf to CIL and then compiling to the kernel binary policy results in a policy that is about 20% smaller. The smaller size is because type expressions with negations are converted to type attribute sets in CIL instead of being expanded.

James Carter (3):
libsepol, policycoreutils: Move functions to convert a module package
to CIL
libsepol: add function to generate CIL from a module policydb
checkpolicy: Add support for generating CIL

 checkpolicy/checkmodule.8              |    5 +-
 checkpolicy/checkmodule.c              |   66 +-
 checkpolicy/checkpolicy.8              |    5 +-
 checkpolicy/checkpolicy.c              |   85 +-
 libsepol/Android.mk                    |    1 +
 libsepol/include/sepol/module_to_cil.h |    8 +
 libsepol/src/libsepol.map.in           |    3 +
 libsepol/src/module_to_cil.c           | 4010 ++++++++++++++++++++++++++++++++
 policycoreutils/hll/pp/Makefile        |    2 +-
 policycoreutils/hll/pp/pp.c            | 3830 +-----------------------------
 10 files changed, 4131 insertions(+), 3884 deletions(-)
 create mode 100644 libsepol/include/sepol/module_to_cil.h
 create mode 100644 libsepol/src/module_to_cil.c
Signature · 1 line
1.9.3

Read the cover letter in its thread