c3f5d75c32
When the link process is completed, the types type_set_t and roles ebitmap in a role attribute are settled, then we could go on to scan all role attributes in the base->p_roles.table checking if any non-zero bit in its roles ebitmap is indeed another role attribute. If this is the case, then we need to escalate the roles ebitmap of the sub role attribute into that of the parent, and remove the sub role attribute from parent's roles ebitmap. Since sub-attribute's roles ebitmap may further contain other role attributes, we need to re-scan the updated parent's roles ebitmap. Also if a loop dependency is detected, no escalation of sub-attribute's roles ebitmap is needed. Note, although in the link stage all role identifiers defined in any block/decl of any module would be copied into the base->p_roles.table, the role-attribute relationships could still be recorded in the decl's local symtab[SYM_ROLES] table(see get_local_role()), so before all above escalation of sub role attribute's roles ebitmap into that of parent ever happens, all decl in the base->global list except the global block would have to be traversed so as to populate potential role-attribute relationships from decl up to the base module. Signed-off-by: Harry Ciao <qingtao.cao@windriver.com> Signed-off-by: Steve Lawrence <slawrence@tresys.com> |
||
---|---|---|
.. | ||
test | ||
ChangeLog | ||
checkmodule.8 | ||
checkmodule.c | ||
checkpolicy.8 | ||
checkpolicy.c | ||
checkpolicy.h | ||
COPYING | ||
Makefile | ||
module_compiler.c | ||
module_compiler.h | ||
parse_util.c | ||
parse_util.h | ||
policy_define.c | ||
policy_define.h | ||
policy_parse.y | ||
policy_scan.l | ||
queue.c | ||
queue.h | ||
VERSION |