[refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 2/28/2012 5:41 AM, Harry Ciao wrote:
> Hi Chirst,

Call me Chris please.  Christ has completely different meanings that I couldn't live up to :)

> I am a rookie about regexp, were I able to match just the role rule but
> skip the role-types rule in one regexp, I would have combined the two
> steps of "get_role_rules" and "remove_role_types" into one, and properly
> comment out the original role declaration, which so far has not been
> commented off but duplicated to the top of base.conf or policy.conf,
> where I have taken the advantage of the fact that multiple declarations
> for a role identifier are tolerated by the compiler.
>
> Such improvement is a must-have given that role-types no longer is used
> to define roles, and a module built into base.pp which also defines a
> role could be sorted after other modules which could reference the same
> role in the role-types rule.

How about this:

diff --git a/support/comment_move_decl.sed b/support/comment_move_decl.sed
index 601c4f7..1d851c9 100644
--- a/support/comment_move_decl.sed
+++ b/support/comment_move_decl.sed
@@ -10,5 +10,6 @@
  /^[[:blank:]]*fs_use_(xattr|task|trans) /s/^/# this line was moved by the build process: &/
  /^[[:blank:]]*sid /s/^/# this line was moved by the build process: &/
  /^[[:blank:]]*bool /s/^/# this line was moved by the build process: &/
+/^[[:blank:]]*role [a-zA-Z_]+[[:blank:]]*;/s/^/# this line was moved by the build process: &/
  
  :nextline
diff --git a/support/get_type_attr_decl.sed b/support/get_type_attr_decl.sed
index 69c6ccd..5bf48be 100644
--- a/support/get_type_attr_decl.sed
+++ b/support/get_type_attr_decl.sed
@@ -10,4 +10,9 @@
  	p
  }
  
+/^[[:blank:]]*role [a-zA-Z_]+[[:blank:]]*;/{
+	s/^[[:blank:]]+//
+	p
+}
+
  :nextline


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com