788d40b0e6
The CIL Reference Guide specifies how name resolution is suppose to work within an expanded macro. 1. Items defined inside the macro 2. Items passed into the macro as arguments 3. Items defined in the same namespace of the macro 4. Items defined in the caller's namespace 5. Items defined in the global namespace But Lorenzo Ceragioli <lorenzo.ceragioli@phd.unipi.it> found that the first step is not done. So the following policy: (block A (type a) (macro m () (type a) (allow a self (CLASS (PERM))) ) ) (block B (call A.m) ) will result in: (allow A.a self (CLASS (PERM))) instead of the expected: (allow B.a self (CLASS (PERM))) Now when an expanded call is found, the macro's namespace is checked first. If the name is found, then the name was declared in the macro and it is declared in the expanded call, so only the namespace of the call up to and including the global namespace will be searched. If the name is not found in the macro's namespace then name resolution continues with steps 2-5 above. Signed-off-by: James Carter <jwcart2@gmail.com> |
||
---|---|---|
.. | ||
cil | ||
include | ||
man | ||
src | ||
tests | ||
utils | ||
.gitignore | ||
COPYING | ||
Makefile | ||
VERSION |