secilc: resolve conflicts in expandattribute.

When Android combines multiple .cil files from system.img and vendor.img it's possible to have conflicting expandattribute statements, e.g.
expandattribute hal_audio true;
expandattribute hal_audio false;

This change deals with scenario be resolving the value of the corresponding expandattribute to false. The rationale behind this override is that true is used for reduce run-time lookups, while false is used for tests which must pass.

---
 libsepol/cil/src/cil_resolve_ast.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

libsepol/cil/src/cil_resolve_ast.c +0 -1

index d1a5ed87..5c66f663 100644
@@ -271,7 +271,6 @@ exit:
 
 int cil_type_used(struct cil_symtab_datum *datum, int used)
 {
-       int rc = SEPOL_ERR;
        struct cil_typeattribute *attr = NULL;
 
        if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {

@@ -279,16 +278,13 @@ int cil_type_used(struct cil_symtab_datum *datum, int used)
                attr->used |= used;

libsepol/cil/src/cil_resolve_ast.c +0 -4

                }
        }
-
        return SEPOL_OK;
-exit:
-       return rc;
 }
 
 int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
--

2.16.2.804.g6dcf76e118-goog

Quoted 4 lines · Tri Vo

When Android combines multiple .cil files from system.img and vendor.img it's possible to have conflicting expandattribute statements, e.g.
expandattribute hal_audio true;
expandattribute hal_audio false;

Isn't this the policy.conf version? I thought cil files had:
expandtypeattribute, am I wrong here?

Quoted 6 lines

This change deals with scenario be resolving the value of the corresponding expandattribute to false. The rationale behind this override is that true is used for reduce run-time lookups, while false is used for tests which must pass.

So in a conflict, it's always forced to false, which prevents expansion. That seems reasonable. I would imagine this should also update some document somewhere that describes this behavior, does one exist? I couldn't find anything, but not sure if it's on some external webpage. Stephen do you know?

Quoted 4 lines

---
 libsepol/cil/src/cil_resolve_ast.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

libsepol/cil/src/cil_resolve_ast.c exit: · line 272

Quoted 7 lines

libsepol/cil/src/cil_resolve_ast.c +0 -0

index d1a5ed87..5c66f663 100644
@@ -271,7 +271,6 @@ exit:
 
 int cil_type_used(struct cil_symtab_datum *datum, int used)

Quoted 7 lines

libsepol/cil/src/cil_resolve_ast.c +0 -1

 {
-       int rc = SEPOL_ERR;
        struct cil_typeattribute *attr = NULL;
 
        if (FLAVOR(datum) == CIL_TYPEATTRIBUTE) {

@@ -279,16 +278,13 @@ int cil_type_used(struct cil_symtab_datum *datum, int used)
                attr->used |= used;

libsepol/cil/src/cil_resolve_ast.c int cil_type_used(struct cil_symtab_datum *datum, int used) · line 284

Quoted 10 lines

libsepol/cil/src/cil_resolve_ast.c +4 -4

                if ((attr->used & CIL_ATTR_EXPAND_TRUE) &&
                                (attr->used & CIL_ATTR_EXPAND_FALSE)) {
-                       cil_log(CIL_ERR, "Conflicting use of expandtypeattribute. "
-                                       "Expandtypeattribute may be set to true or false "
-                                       "but not both. \n");
-                       goto exit;
+                       cil_log(CIL_WARN, "Conflicting use of expandtypeattribute. "
+                                       "Expandtypeattribute was set to both true or false for %s. "
+                                       "Resolving to false. \n", attr->datum.name);
+                       attr->used ^= CIL_ATTR_EXPAND_TRUE;

Sure, this saves an operation, but:

attr->used &= ~CIL_ATTR_EXPAND_TRUE;

Is less fragile and the usual unset idiom. I won't request this changed unless either you agree or someone else has the same opinion as me.

One could always argue that conditional code that relies on the entry condition is the whole
point of conditional code :-P

Quoted 13 lines

libsepol/cil/src/cil_resolve_ast.c +0 -4

                }
        }
-
        return SEPOL_OK;
-exit:
-       return rc;
 }
 
 int cil_resolve_permissionx(struct cil_tree_node *current, struct cil_permissionx *permx, void *extra_args)
--

2.16.2.804.g6dcf76e118-goog