[PATCH 1/1] Delete identical genfscon-s

[Pierre-Hugues Husson]

From: Pierre-Hugues Husson <***@gmail.com>

secilc has a multiple_decls option to allow for multiple type
declarations.
The next step is to allow multiple samples of the same rules.
This commit does this on genfscon

One usecase is Android/Project Treble:
With Project Treble, vendor might include rules included in later
in framework.
In order to be able to update the framework in this case, we need
to remove identical rules.
---
libsepol/cil/src/cil_post.c | 11 +++++++++++
1 file changed, 11 insertions(+)

diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
index a2122454..8446158e 100644
--- a/libsepol/cil/src/cil_post.c
+++ b/libsepol/cil/src/cil_post.c
@@ -53,6 +53,16 @@
static int __cil_expr_to_bitmap(struct cil_list *expr, ebitmap_t *out, int max, struct cil_db *db);
static int __cil_expr_list_to_bitmap(struct cil_list *expr_list, ebitmap_t *out, int max, struct cil_db *db);

+static int compact(void* array, int count, int len, int (*compar)(const void *, const void *)) {
+ char *a = (char*)array;
+ int i, j = 0;
+ for(i=1; i<count; i++) {
+ if(compar(a+i*len, a+j*len) != 0) j++;
+ if(i != j) memcpy(a+j*len, a+i*len, len);
+ }
+ return j;
+}
+
static int cil_verify_is_list(struct cil_list *list, enum cil_flavor flavor)
{
struct cil_list_item *curr;
@@ -2118,6 +2128,7 @@ static int cil_post_db(struct cil_db *db)

qsort(db->netifcon->array, db->netifcon->count, sizeof(db->netifcon->array), cil_post_netifcon_compare);
qsort(db->genfscon->array, db->genfscon->count, sizeof(db->genfscon->array), cil_post_genfscon_compare);
+ db->genfscon->count = compact(db->genfscon->array, db->genfscon->count, sizeof(db->genfscon->array), cil_post_genfscon_compare);
qsort(db->ibpkeycon->array, db->ibpkeycon->count, sizeof(db->ibpkeycon->array), cil_post_ibpkeycon_compare);
qsort(db->ibendportcon->array, db->ibendportcon->count, sizeof(db->ibendportcon->array), cil_post_ibendportcon_compare);
qsort(db->portcon->array, db->portcon->count, sizeof(db->portcon->array), cil_post_portcon_compare);

[jwcart2]

Post by Pierre-Hugues Husson
secilc has a multiple_decls option to allow for multiple type
declarations.
The next step is to allow multiple samples of the same rules.
This commit does this on genfscon
With Project Treble, vendor might include rules included in later
in framework.
In order to be able to update the framework in this case, we need
to remove identical rules.
Should the "compact" function be somewhere else? Or perhaps there is already
some variant available?

Where you put it is fine. There is no other variant.

Post by Pierre-Hugues Husson
Should the "compact" function simply take a cil_sort rather than a C array?
Should we compact all types indifferently?

It looks like secilc is not checking for duplicates right now for any of the
ocontext rules which is a problem.

I am assuming that if the genfscon is different only in the context, then that
should be an error. Is that correct?

So the following should be an error:
(genfscon FS1 / (U R T1 ((S) (S))))
(genfscon FS1 / (U R T2 ((S) (S))))

but if they both had T1, then it would be ok, but the second rule would not be
added to the policy.

I think the right approach in the compact function is to return an error if the
compare function returns 0 and the multiple-decls flag has not been used or the
contexts of the two rules are not the same. If the rule is exactly the same and
the multiple-decls flag is set, then skip the duplicate rule.

Post by Pierre-Hugues Husson
If so, we need to guarantee that the _compare function returns 0 only when the
types rules are identical, and not just the same match rule. Is this already
the case?
How is memory allocation done/will compact impact the release of the memory?
In my understanding this is just one big chunk, so the size isn't used when
free-ing, so it should be ok

Yes. It is one big chunk.

Thanks,
Jim

Post by Pierre-Hugues Husson
Delete identical genfscon-s
libsepol/cil/src/cil_post.c | 11 +++++++++++
1 file changed, 11 insertions(+)