415989003e
Commit 692716fc5f ("libsepol/cil: raise default attrs_expand_size to 2") was
reverted and attributes with one type are not expanded anymore.
Fixes:
./secilc test/policy.cil
./secilc -c 32 -O -M 1 -f /dev/null -o opt-actual.bin test/opt-input.cil
checkpolicy -b -C -M -o opt-actual.cil opt-actual.bin >/dev/null
diff test/opt-expected.cil opt-actual.cil
11a12
> (typeattribute at01)
21a23
> (typeattributeset at01 (tp01))
25c27,28
< (allow tp01 self (cl01 (p01a p01b p11a p11b)))
---
> (allow tp01 at01 (cl01 (p11b)))
> (allow tp01 self (cl01 (p01a p01b p11a)))
Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
Acked-by: James Carter <jwcart2@gmail.com>
60 lines
1.4 KiB
Text
60 lines
1.4 KiB
Text
(handleunknown deny)
|
|
(class cl01 (p01a p01b p11a p11b))
|
|
(classorder (cl01))
|
|
(sid kernel)
|
|
(sidorder (kernel))
|
|
(mls true)
|
|
(sensitivity s01)
|
|
(sensitivityorder (s01))
|
|
(category c01)
|
|
(categoryorder (c01))
|
|
(sensitivitycategory s01 (c01))
|
|
(typeattribute at01)
|
|
(typeattribute at02)
|
|
(boolean b01 false)
|
|
(type tp01)
|
|
(type tp02)
|
|
(type tp04)
|
|
(type tpr1)
|
|
(type tpr2)
|
|
(type tpr3)
|
|
(type tpr4)
|
|
(type tpr5)
|
|
(typeattributeset at01 (tp01))
|
|
(typeattributeset at02 (tp01 tp02))
|
|
(allow at02 tpr1 (cl01 (p01a p01b p11a)))
|
|
(allow at02 tpr3 (cl01 (p01a p01b p11a)))
|
|
(allow tp01 at01 (cl01 (p11b)))
|
|
(allow tp01 self (cl01 (p01a p01b p11a)))
|
|
(allow tp01 tpr1 (cl01 (p11b)))
|
|
(dontaudit at02 tpr2 (cl01 (p01a p01b p11a)))
|
|
(dontaudit at02 tpr4 (cl01 (p01a p01b p11a)))
|
|
(dontaudit tp01 tpr2 (cl01 (p11b)))
|
|
(booleanif b01
|
|
(true
|
|
(allow tp01 tpr3 (cl01 (p11b)))
|
|
(allow tp01 tpr5 (cl01 (p01a p01b p11a p11b)))
|
|
(allow tp02 tpr5 (cl01 (p01a p11a)))
|
|
(dontaudit tp01 tpr4 (cl01 (p11b)))
|
|
)
|
|
(false
|
|
(allow at02 tpr5 (cl01 (p01a p01b p11a)))
|
|
)
|
|
)
|
|
(role object_r)
|
|
(role rl01)
|
|
(roletype rl01 tp01)
|
|
(roletype object_r tp01)
|
|
(roletype object_r tp02)
|
|
(roletype object_r tp04)
|
|
(roletype object_r tpr1)
|
|
(roletype object_r tpr2)
|
|
(roletype object_r tpr3)
|
|
(roletype object_r tpr4)
|
|
(roletype object_r tpr5)
|
|
(user us01)
|
|
(userrole us01 object_r)
|
|
(userrole us01 rl01)
|
|
(userlevel us01 (s01))
|
|
(userrange us01 ((s01) (s01)))
|
|
(sidcontext kernel (us01 rl01 tp01 ((s01) (s01))))
|