platform_external_selinux/checkpolicy
Harry Ciao c3f5d75c32 Support adding one role attribute into another.
When the link process is completed, the types type_set_t and roles
ebitmap in a role attribute are settled, then we could go on to scan
all role attributes in the base->p_roles.table checking if any non-zero
bit in its roles ebitmap is indeed another role attribute.

If this is the case, then we need to escalate the roles ebitmap of
the sub role attribute into that of the parent, and remove the sub role
attribute from parent's roles ebitmap.

Since sub-attribute's roles ebitmap may further contain other role
attributes, we need to re-scan the updated parent's roles ebitmap.

Also if a loop dependency is detected, no escalation of sub-attribute's
roles ebitmap is needed.

Note, although in the link stage all role identifiers defined in any
block/decl of any module would be copied into the base->p_roles.table,
the role-attribute relationships could still be recorded in the decl's
local symtab[SYM_ROLES] table(see get_local_role()), so before all above
escalation of sub role attribute's roles ebitmap into that of parent ever
happens, all decl in the base->global list except the global block would
have to be traversed so as to populate potential role-attribute
relationships from decl up to the base module.

Signed-off-by: Harry Ciao <qingtao.cao@windriver.com>
Signed-off-by: Steve Lawrence <slawrence@tresys.com>
2011-07-25 10:09:48 -04:00
..
test checkpolicy: add support for using last path component in type transition rules 2011-04-29 15:20:21 -04:00
ChangeLog Revision version bump 2011-05-17 10:18:26 -04:00
checkmodule.8 Author: Steve Lawrence 2010-06-14 14:45:46 -04:00
checkmodule.c Author: Daniel J Walsh 2010-06-14 14:44:44 -04:00
checkpolicy.8 Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) 2009-11-27 13:39:03 -05:00
checkpolicy.c Patch for Ticket #1 [1672486] (checkpolicy/checkmodule) 2009-11-27 13:39:03 -05:00
checkpolicy.h initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
COPYING initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
Makefile initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
module_compiler.c Add role attribute support when compiling modules. 2011-07-25 10:09:27 -04:00
module_compiler.h Add role attribute support when compiling modules. 2011-07-25 10:09:27 -04:00
parse_util.c initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
parse_util.h initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
policy_define.c Support adding one role attribute into another. 2011-07-25 10:09:48 -04:00
policy_define.h Add role attribute support when compiling modules. 2011-07-25 10:09:27 -04:00
policy_parse.y Add role attribute support when compiling modules. 2011-07-25 10:09:27 -04:00
policy_scan.l Add role attribute support when compiling modules. 2011-07-25 10:09:27 -04:00
queue.c initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
queue.h initial import from svn trunk revision 2950 2008-08-19 15:30:36 -04:00
VERSION Revision version bump 2011-05-17 10:18:26 -04:00