* [refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf
@ 2012-02-28 10:33 Harry Ciao
2012-02-28 10:41 ` Harry Ciao
0 siblings, 1 reply; 4+ messages in thread
From: Harry Ciao @ 2012-02-28 10:33 UTC (permalink / raw)
To: refpolicy
Now that the role-types rule is no longer used to define a role,
role declarations should be bumped to the top of base.conf or
policy.conf along with other declarations. Otherwise the compiler
could complain an unknown role when its reference occurs before its
first declaration.
Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
---
Makefile | 2 ++
Rules.modular | 6 ++++--
Rules.monolithic | 6 ++++--
support/get_role_rules.sed | 13 +++++++++++++
4 files changed, 23 insertions(+), 4 deletions(-)
create mode 100644 support/get_role_rules.sed
diff --git a/Makefile b/Makefile
index 5a43919..dda0e11 100644
--- a/Makefile
+++ b/Makefile
@@ -100,6 +100,8 @@ genperm := $(PYTHON) -E $(support)/genclassperms.py
fcsort := $(tmpdir)/fc_sort
setbools := $(AWK) -f $(support)/set_bools_tuns.awk
get_type_attr_decl := $(SED) -r -f $(support)/get_type_attr_decl.sed
+get_role_rules := $(SED) -r -f $(support)/get_role_rules.sed
+remove_role_types := $(SED) -e '/^[[:blank:]]*\<role\>[[:blank:]]*.*\<types\>/d'
comment_move_decl := $(SED) -r -f $(support)/comment_move_decl.sed
gennetfilter := $(PYTHON) -E $(support)/gennetfilter.py
m4iferror := $(support)/iferror.m4
diff --git a/Rules.modular b/Rules.modular
index 313d837..78ef24b 100644
--- a/Rules.modular
+++ b/Rules.modular
@@ -13,7 +13,7 @@ base_mod := $(tmpdir)/base.mod
users_extra := $(tmpdir)/users_extra
-base_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
+base_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
base_pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
base_te_files := $(base_mods)
@@ -157,8 +157,10 @@ $(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf
# extract attributes and put them first. extract post te stuff
# like genfscon and put last.
-$(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
+$(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
$(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf
+ $(verbose) $(get_role_rules) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_role_rules.conf
+ $(verbose) $(remove_role_types) $(tmpdir)/all_role_rules.conf | $(SORT) -u > $(tmpdir)/all_role_decls.conf
$(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf
# these have to run individually because order matters:
$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
diff --git a/Rules.monolithic b/Rules.monolithic
index 7c4d035..33f9aa6 100644
--- a/Rules.monolithic
+++ b/Rules.monolithic
@@ -35,7 +35,7 @@ all_fc_files := $(all_modules:.te=.fc)
pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
post_te_files := $(user_files) $(poldir)/constraints
-policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
+policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
# search layer dirs for source files
vpath %.te $(all_layers)
@@ -144,8 +144,10 @@ $(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf
# extract attributes and put them first. extract post te stuff
# like genfscon and put last.
-$(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
+$(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
$(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_attrs_types.conf
+ $(verbose) $(get_role_rules) $(tmpdir)/all_te_files.conf | $(SORT) > $(tmpdir)/all_role_rules.conf
+ $(verbose) $(remove_role_types) $(tmpdir)/all_role_rules.conf | $(SORT) -u > $(tmpdir)/all_role_decls.conf
$(verbose) cat $(tmpdir)/post_te_files.conf > $(tmpdir)/all_post.conf
# these have to run individually because order matters:
$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
diff --git a/support/get_role_rules.sed b/support/get_role_rules.sed
new file mode 100644
index 0000000..9485cfc
--- /dev/null
+++ b/support/get_role_rules.sed
@@ -0,0 +1,13 @@
+#n
+# print out role declarations and role types rules
+# that are not inside require and optional blocks.
+
+/require \{/,/} # end require/b nextline
+/optional \{/,/} # end optional/b nextline
+
+/^[[:blank:]]*\<role\>[[:blank:]]+/{
+ s/^[[:blank:]]+//
+ p
+}
+
+:nextline
--
1.7.0.4
^ permalink raw reply related [flat|nested] 4+ messages in thread* [refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf
2012-02-28 10:33 [refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf Harry Ciao
@ 2012-02-28 10:41 ` Harry Ciao
2012-02-28 15:56 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Harry Ciao @ 2012-02-28 10:41 UTC (permalink / raw)
To: refpolicy
Hi Chirst,
I am a rookie about regexp, were I able to match just the role rule but
skip the role-types rule in one regexp, I would have combined the two
steps of "get_role_rules" and "remove_role_types" into one, and properly
comment out the original role declaration, which so far has not been
commented off but duplicated to the top of base.conf or policy.conf,
where I have taken the advantage of the fact that multiple declarations
for a role identifier are tolerated by the compiler.
Such improvement is a must-have given that role-types no longer is used
to define roles, and a module built into base.pp which also defines a
role could be sorted after other modules which could reference the same
role in the role-types rule.
Thanks,
Harry
On 02/28/2012 06:33 PM, Harry Ciao wrote:
> Now that the role-types rule is no longer used to define a role,
> role declarations should be bumped to the top of base.conf or
> policy.conf along with other declarations. Otherwise the compiler
> could complain an unknown role when its reference occurs before its
> first declaration.
>
> Signed-off-by: Harry Ciao<qingtao.cao@windriver.com>
> ---
> Makefile | 2 ++
> Rules.modular | 6 ++++--
> Rules.monolithic | 6 ++++--
> support/get_role_rules.sed | 13 +++++++++++++
> 4 files changed, 23 insertions(+), 4 deletions(-)
> create mode 100644 support/get_role_rules.sed
>
> diff --git a/Makefile b/Makefile
> index 5a43919..dda0e11 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -100,6 +100,8 @@ genperm := $(PYTHON) -E $(support)/genclassperms.py
> fcsort := $(tmpdir)/fc_sort
> setbools := $(AWK) -f $(support)/set_bools_tuns.awk
> get_type_attr_decl := $(SED) -r -f $(support)/get_type_attr_decl.sed
> +get_role_rules := $(SED) -r -f $(support)/get_role_rules.sed
> +remove_role_types := $(SED) -e '/^[[:blank:]]*\<role\>[[:blank:]]*.*\<types\>/d'
> comment_move_decl := $(SED) -r -f $(support)/comment_move_decl.sed
> gennetfilter := $(PYTHON) -E $(support)/gennetfilter.py
> m4iferror := $(support)/iferror.m4
> diff --git a/Rules.modular b/Rules.modular
> index 313d837..78ef24b 100644
> --- a/Rules.modular
> +++ b/Rules.modular
> @@ -13,7 +13,7 @@ base_mod := $(tmpdir)/base.mod
>
> users_extra := $(tmpdir)/users_extra
>
> -base_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
> +base_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
>
> base_pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
> base_te_files := $(base_mods)
> @@ -157,8 +157,10 @@ $(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf
>
> # extract attributes and put them first. extract post te stuff
> # like genfscon and put last.
> -$(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
> +$(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
> $(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT)> $(tmpdir)/all_attrs_types.conf
> + $(verbose) $(get_role_rules) $(tmpdir)/all_te_files.conf | $(SORT)> $(tmpdir)/all_role_rules.conf
> + $(verbose) $(remove_role_types) $(tmpdir)/all_role_rules.conf | $(SORT) -u> $(tmpdir)/all_role_decls.conf
> $(verbose) cat $(tmpdir)/post_te_files.conf> $(tmpdir)/all_post.conf
> # these have to run individually because order matters:
> $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf>> $(tmpdir)/all_post.conf || true
> diff --git a/Rules.monolithic b/Rules.monolithic
> index 7c4d035..33f9aa6 100644
> --- a/Rules.monolithic
> +++ b/Rules.monolithic
> @@ -35,7 +35,7 @@ all_fc_files := $(all_modules:.te=.fc)
> pre_te_files := $(secclass) $(isids) $(avs) $(m4support) $(poldir)/mls $(poldir)/mcs $(policycaps)
> post_te_files := $(user_files) $(poldir)/constraints
>
> -policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
> +policy_sections := $(tmpdir)/pre_te_files.conf $(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/global_bools.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf
>
> # search layer dirs for source files
> vpath %.te $(all_layers)
> @@ -144,8 +144,10 @@ $(tmpdir)/post_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf
>
> # extract attributes and put them first. extract post te stuff
> # like genfscon and put last.
> -$(tmpdir)/all_attrs_types.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
> +$(tmpdir)/all_attrs_types.conf $(tmpdir)/all_role_decls.conf $(tmpdir)/only_te_rules.conf $(tmpdir)/all_post.conf: $(tmpdir)/all_te_files.conf $(tmpdir)/post_te_files.conf
> $(verbose) $(get_type_attr_decl) $(tmpdir)/all_te_files.conf | $(SORT)> $(tmpdir)/all_attrs_types.conf
> + $(verbose) $(get_role_rules) $(tmpdir)/all_te_files.conf | $(SORT)> $(tmpdir)/all_role_rules.conf
> + $(verbose) $(remove_role_types) $(tmpdir)/all_role_rules.conf | $(SORT) -u> $(tmpdir)/all_role_decls.conf
> $(verbose) cat $(tmpdir)/post_te_files.conf> $(tmpdir)/all_post.conf
> # these have to run individually because order matters:
> $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf>> $(tmpdir)/all_post.conf || true
> diff --git a/support/get_role_rules.sed b/support/get_role_rules.sed
> new file mode 100644
> index 0000000..9485cfc
> --- /dev/null
> +++ b/support/get_role_rules.sed
> @@ -0,0 +1,13 @@
> +#n
> +# print out role declarations and role types rules
> +# that are not inside require and optional blocks.
> +
> +/require \{/,/} # end require/b nextline
> +/optional \{/,/} # end optional/b nextline
> +
> +/^[[:blank:]]*\<role\>[[:blank:]]+/{
> + s/^[[:blank:]]+//
> + p
> +}
> +
> +:nextline
^ permalink raw reply [flat|nested] 4+ messages in thread* [refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf
2012-02-28 10:41 ` Harry Ciao
@ 2012-02-28 15:56 ` Christopher J. PeBenito
2012-02-29 8:20 ` Harry Ciao
0 siblings, 1 reply; 4+ messages in thread
From: Christopher J. PeBenito @ 2012-02-28 15:56 UTC (permalink / raw)
To: refpolicy
On 2/28/2012 5:41 AM, Harry Ciao wrote:
> Hi Chirst,
Call me Chris please. Christ has completely different meanings that I couldn't live up to :)
> I am a rookie about regexp, were I able to match just the role rule but
> skip the role-types rule in one regexp, I would have combined the two
> steps of "get_role_rules" and "remove_role_types" into one, and properly
> comment out the original role declaration, which so far has not been
> commented off but duplicated to the top of base.conf or policy.conf,
> where I have taken the advantage of the fact that multiple declarations
> for a role identifier are tolerated by the compiler.
>
> Such improvement is a must-have given that role-types no longer is used
> to define roles, and a module built into base.pp which also defines a
> role could be sorted after other modules which could reference the same
> role in the role-types rule.
How about this:
diff --git a/support/comment_move_decl.sed b/support/comment_move_decl.sed
index 601c4f7..1d851c9 100644
--- a/support/comment_move_decl.sed
+++ b/support/comment_move_decl.sed
@@ -10,5 +10,6 @@
/^[[:blank:]]*fs_use_(xattr|task|trans) /s/^/# this line was moved by the build process: &/
/^[[:blank:]]*sid /s/^/# this line was moved by the build process: &/
/^[[:blank:]]*bool /s/^/# this line was moved by the build process: &/
+/^[[:blank:]]*role [a-zA-Z_]+[[:blank:]]*;/s/^/# this line was moved by the build process: &/
:nextline
diff --git a/support/get_type_attr_decl.sed b/support/get_type_attr_decl.sed
index 69c6ccd..5bf48be 100644
--- a/support/get_type_attr_decl.sed
+++ b/support/get_type_attr_decl.sed
@@ -10,4 +10,9 @@
p
}
+/^[[:blank:]]*role [a-zA-Z_]+[[:blank:]]*;/{
+ s/^[[:blank:]]+//
+ p
+}
+
:nextline
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply related [flat|nested] 4+ messages in thread* [refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf
2012-02-28 15:56 ` Christopher J. PeBenito
@ 2012-02-29 8:20 ` Harry Ciao
0 siblings, 0 replies; 4+ messages in thread
From: Harry Ciao @ 2012-02-29 8:20 UTC (permalink / raw)
To: refpolicy
Hi Chris,
On 02/28/2012 11:56 PM, Christopher J. PeBenito wrote:
> On 2/28/2012 5:41 AM, Harry Ciao wrote:
>> Hi Chirst,
>
> Call me Chris please. Christ has completely different meanings that I
> couldn't live up to :)
Gotcha :-)
Many thanks for your suggestion, turns out the role declaration and
role-types rules could be separated in such an elegant way! I've also
made very small changes and posted the patch again.
Thanks again!
Harry
>
>> I am a rookie about regexp, were I able to match just the role rule but
>> skip the role-types rule in one regexp, I would have combined the two
>> steps of "get_role_rules" and "remove_role_types" into one, and properly
>> comment out the original role declaration, which so far has not been
>> commented off but duplicated to the top of base.conf or policy.conf,
>> where I have taken the advantage of the fact that multiple declarations
>> for a role identifier are tolerated by the compiler.
>>
>> Such improvement is a must-have given that role-types no longer is used
>> to define roles, and a module built into base.pp which also defines a
>> role could be sorted after other modules which could reference the same
>> role in the role-types rule.
>
> How about this:
>
> diff --git a/support/comment_move_decl.sed
> b/support/comment_move_decl.sed
> index 601c4f7..1d851c9 100644
> --- a/support/comment_move_decl.sed
> +++ b/support/comment_move_decl.sed
> @@ -10,5 +10,6 @@
> /^[[:blank:]]*fs_use_(xattr|task|trans) /s/^/# this line was moved by
> the build process: &/
> /^[[:blank:]]*sid /s/^/# this line was moved by the build process: &/
> /^[[:blank:]]*bool /s/^/# this line was moved by the build process: &/
> +/^[[:blank:]]*role [a-zA-Z_]+[[:blank:]]*;/s/^/# this line was moved
> by the build process: &/
>
> :nextline
> diff --git a/support/get_type_attr_decl.sed
> b/support/get_type_attr_decl.sed
> index 69c6ccd..5bf48be 100644
> --- a/support/get_type_attr_decl.sed
> +++ b/support/get_type_attr_decl.sed
> @@ -10,4 +10,9 @@
> p
> }
>
> +/^[[:blank:]]*role [a-zA-Z_]+[[:blank:]]*;/{
> + s/^[[:blank:]]+//
> + p
> +}
> +
> :nextline
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-02-29 8:20 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-28 10:33 [refpolicy] [v0 PATCH 1/1] Copy role declarations to the top of base.conf or policy.conf Harry Ciao
2012-02-28 10:41 ` Harry Ciao
2012-02-28 15:56 ` Christopher J. PeBenito
2012-02-29 8:20 ` Harry Ciao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.