53 static int __cil_expr_to_bitmap(struct cil_list *expr, ebitmap_t *out, int max, struct cil_db *db);
54 … __cil_expr_list_to_bitmap(struct cil_list *expr_list, ebitmap_t *out, int max, struct cil_db *db);
553 	struct cil_db *db = extra_args;  in __cil_post_db_count_helper()  local
570 			db->num_classes++;  in __cil_post_db_count_helper()
578 			type->value = db->num_types;  in __cil_post_db_count_helper()
579 			db->num_types++;  in __cil_post_db_count_helper()
580 			db->num_types_and_attrs++;  in __cil_post_db_count_helper()
588 			db->num_types_and_attrs++;  in __cil_post_db_count_helper()
597 			role->value = db->num_roles;  in __cil_post_db_count_helper()
598 			db->num_roles++;  in __cil_post_db_count_helper()
608 			user->value = db->num_users;  in __cil_post_db_count_helper()
609 			db->num_users++;  in __cil_post_db_count_helper()
614 		db->netifcon->count++;  in __cil_post_db_count_helper()
617 		db->genfscon->count++;  in __cil_post_db_count_helper()
620 		db->filecon->count++;  in __cil_post_db_count_helper()
623 		db->nodecon->count++;  in __cil_post_db_count_helper()
626 		db->ibpkeycon->count++;  in __cil_post_db_count_helper()
629 		db->ibendportcon->count++;  in __cil_post_db_count_helper()
632 		db->portcon->count++;  in __cil_post_db_count_helper()
635 		db->pirqcon->count++;  in __cil_post_db_count_helper()
638 		db->iomemcon->count++;  in __cil_post_db_count_helper()
641 		db->ioportcon->count++;  in __cil_post_db_count_helper()
644 		db->pcidevicecon->count++;  in __cil_post_db_count_helper()
647 		db->devicetreecon->count++;  in __cil_post_db_count_helper()
650 		db->fsuse->count++;  in __cil_post_db_count_helper()
661 	struct cil_db *db = extra_args;  in __cil_post_db_array_helper()  local
676 		if (db->val_to_type == NULL) {  in __cil_post_db_array_helper()
677 			db->val_to_type = cil_malloc(sizeof(*db->val_to_type) * db->num_types);  in __cil_post_db_array_helper()
679 		db->val_to_type[type->value] = type;  in __cil_post_db_array_helper()
684 		if (db->val_to_role == NULL) {  in __cil_post_db_array_helper()
685 			db->val_to_role = cil_malloc(sizeof(*db->val_to_role) * db->num_roles);  in __cil_post_db_array_helper()
687 		db->val_to_role[role->value] = role;  in __cil_post_db_array_helper()
692 		if (db->val_to_user == NULL) {  in __cil_post_db_array_helper()
693 			db->val_to_user = cil_malloc(sizeof(*db->val_to_user) * db->num_users);  in __cil_post_db_array_helper()
695 		db->val_to_user[user->value] = user;  in __cil_post_db_array_helper()
699 		cil_list_append(db->userprefixes, CIL_USERPREFIX, node->data);  in __cil_post_db_array_helper()
703 		cil_list_prepend(db->selinuxusers, CIL_SELINUXUSER, node->data);  in __cil_post_db_array_helper()
707 		cil_list_append(db->selinuxusers, CIL_SELINUXUSERDEFAULT, node->data);  in __cil_post_db_array_helper()
711 		struct cil_sort *sort = db->netifcon;  in __cil_post_db_array_helper()
722 		struct cil_sort *sort = db->ibendportcon;  in __cil_post_db_array_helper()
733 		struct cil_sort *sort = db->fsuse;  in __cil_post_db_array_helper()
744 		struct cil_sort *sort = db->genfscon;  in __cil_post_db_array_helper()
755 		struct cil_sort *sort = db->filecon;  in __cil_post_db_array_helper()
766 		struct cil_sort *sort = db->nodecon;  in __cil_post_db_array_helper()
777 		struct cil_sort *sort = db->ibpkeycon;  in __cil_post_db_array_helper()
788 		struct cil_sort *sort = db->portcon;  in __cil_post_db_array_helper()
799 		struct cil_sort *sort = db->pirqcon;  in __cil_post_db_array_helper()
810 		struct cil_sort *sort = db->iomemcon;  in __cil_post_db_array_helper()
821 		struct cil_sort *sort = db->ioportcon;  in __cil_post_db_array_helper()
832 		struct cil_sort *sort = db->pcidevicecon;  in __cil_post_db_array_helper()
843 		struct cil_sort *sort = db->devicetreecon;  in __cil_post_db_array_helper()
860 static int __evaluate_type_expression(struct cil_typeattribute *attr, struct cil_db *db)  in __evaluate_type_expression()  argument
865 	rc = __cil_expr_list_to_bitmap(attr->expr_list, attr->types, db->num_types, db);  in __evaluate_type_expression()
875 …atic int __cil_type_to_bitmap(struct cil_symtab_datum *datum, ebitmap_t *bitmap, struct cil_db *db)  in __cil_type_to_bitmap()  argument
885 			rc = __evaluate_type_expression(attr, db);  in __cil_type_to_bitmap()
912 static int __evaluate_user_expression(struct cil_userattribute *attr, struct cil_db *db)  in __evaluate_user_expression()  argument
917 	rc = __cil_expr_list_to_bitmap(attr->expr_list, attr->users, db->num_users, db);  in __evaluate_user_expression()
927 …atic int __cil_user_to_bitmap(struct cil_symtab_datum *datum, ebitmap_t *bitmap, struct cil_db *db)  in __cil_user_to_bitmap()  argument
939 			rc = __evaluate_user_expression(attr, db);  in __cil_user_to_bitmap()
960 static int __evaluate_role_expression(struct cil_roleattribute *attr, struct cil_db *db)  in __evaluate_role_expression()  argument
965 	rc = __cil_expr_list_to_bitmap(attr->expr_list, attr->roles, db->num_roles, db);  in __evaluate_role_expression()
975 …atic int __cil_role_to_bitmap(struct cil_symtab_datum *datum, ebitmap_t *bitmap, struct cil_db *db)  in __cil_role_to_bitmap()  argument
985 			rc = __evaluate_role_expression(attr, db);  in __cil_role_to_bitmap()
1004 static int __evaluate_permissionx_expression(struct cil_permissionx *permx, struct cil_db *db)  in __evaluate_permissionx_expression()  argument
1011 …rc = __cil_expr_to_bitmap(permx->expr_str, permx->perms, 0x10000, db); // max is one more than 0xF…  in __evaluate_permissionx_expression()
1044 …itmap(struct cil_symtab_datum *datum, ebitmap_t *bitmap, __attribute__((unused)) struct cil_db *db)  in __cil_permx_to_bitmap()  argument
1067 …itmap(struct cil_symtab_datum *datum, ebitmap_t *bitmap, __attribute__((unused)) struct cil_db *db)  in __cil_perm_to_bitmap()  argument
1082 static int __evaluate_cat_expression(struct cil_cats *cats, struct cil_db *db)  in __evaluate_cat_expression()  argument
1098 	rc = __cil_expr_to_bitmap(cats->datum_expr, &bitmap, db->num_cats, db);  in __evaluate_cat_expression()
1107 	cil_list_for_each(curr, db->catorder) {  in __evaluate_cat_expression()
1126 static int __cil_cat_to_bitmap(struct cil_symtab_datum *datum, ebitmap_t *bitmap, struct cil_db *db)  in __cil_cat_to_bitmap()  argument
1137 			rc = __evaluate_cat_expression(catset->cats, db);  in __cil_cat_to_bitmap()
1249 …(struct cil_list_item *curr, enum cil_flavor flavor, ebitmap_t *bitmap, int max, struct cil_db *db)  in __cil_expr_to_bitmap_helper()  argument
1256 			rc = __cil_type_to_bitmap(curr->data, bitmap, db);  in __cil_expr_to_bitmap_helper()
1259 			rc = __cil_role_to_bitmap(curr->data, bitmap, db);  in __cil_expr_to_bitmap_helper()
1262 			rc = __cil_user_to_bitmap(curr->data, bitmap, db);  in __cil_expr_to_bitmap_helper()
1265 			rc = __cil_perm_to_bitmap(curr->data, bitmap, db);  in __cil_expr_to_bitmap_helper()
1268 			rc = __cil_cat_to_bitmap(curr->data, bitmap, db);  in __cil_expr_to_bitmap_helper()
1276 		rc = __cil_expr_to_bitmap(l, bitmap, max, db);  in __cil_expr_to_bitmap_helper()
1283 		rc = __cil_permx_to_bitmap(curr->data, bitmap, db);  in __cil_expr_to_bitmap_helper()
1289 static int __cil_expr_to_bitmap(struct cil_list *expr, ebitmap_t *out, int max, struct cil_db *db)  in __cil_expr_to_bitmap()  argument
1338 			rc = __cil_expr_to_bitmap_helper(curr->next, flavor, &b1, max, db);  in __cil_expr_to_bitmap()
1353 				rc = __cil_expr_to_bitmap_helper(curr->next->next, flavor, &b2, max, db);  in __cil_expr_to_bitmap()
1381 			rc = __cil_expr_to_bitmap_helper(curr, flavor, &b2, max, db);  in __cil_expr_to_bitmap()
1409 …t __cil_expr_list_to_bitmap(struct cil_list *expr_list, ebitmap_t *out, int max, struct cil_db *db)  in __cil_expr_list_to_bitmap()  argument
1424 		rc = __cil_expr_to_bitmap(l, &bitmap, max, db);  in __cil_expr_list_to_bitmap()
1440 static int cil_typeattribute_used(struct cil_typeattribute *attr, struct cil_db *db)  in cil_typeattribute_used()  argument
1458 	if (db->attrs_expand_generated || attr->used == CIL_ATTR_NEVERALLOW) {  in cil_typeattribute_used()
1471 		if (ebitmap_cardinality(attr->types) < db->attrs_expand_size) {  in cil_typeattribute_used()
1531 	struct cil_db *db = extra_args;  in __cil_post_db_attr_helper()  local
1548 			rc = __evaluate_type_expression(attr, db);  in __cil_post_db_attr_helper()
1551 		attr->keep = cil_typeattribute_used(attr, db);  in __cil_post_db_attr_helper()
1557 			rc = __evaluate_role_expression(attr, db);  in __cil_post_db_attr_helper()
1565 			rc = __evaluate_permissionx_expression(rule->perms.x.permx, db);  in __cil_post_db_attr_helper()
1572 		rc = __evaluate_permissionx_expression(permx, db);  in __cil_post_db_attr_helper()
1579 			rc = __evaluate_user_expression(attr, db);  in __cil_post_db_attr_helper()
1632 	struct cil_db *db = extra_args;  in __cil_post_db_roletype_helper()  local
1664 				role = db->val_to_role[i];  in __cil_post_db_roletype_helper()
1722 	struct cil_db *db = extra_args;  in __cil_post_db_userrole_helper()  local
1759 				user = db->val_to_user[i];  in __cil_post_db_userrole_helper()
1787 static int __evaluate_level_expression(struct cil_level *level, struct cil_db *db)  in __evaluate_level_expression()  argument
1790 		return __evaluate_cat_expression(level->cats, db);  in __evaluate_level_expression()
1796 static int __evaluate_levelrange_expression(struct cil_levelrange *levelrange, struct cil_db *db)  in __evaluate_levelrange_expression()  argument
1801 		rc =  __evaluate_cat_expression(levelrange->low->cats, db);  in __evaluate_levelrange_expression()
1807 		rc = __evaluate_cat_expression(levelrange->high->cats, db);  in __evaluate_levelrange_expression()
1820 	struct cil_db *db = extra_args;  in __cil_post_db_cat_helper()  local
1836 		rc = __evaluate_cat_expression(catset->cats, db);  in __cil_post_db_cat_helper()
1844 		rc = __evaluate_cat_expression(senscat->cats, db);  in __cil_post_db_cat_helper()
1851 		rc = __evaluate_level_expression(node->data, db);  in __cil_post_db_cat_helper()
1858 		rc = __evaluate_levelrange_expression(node->data, db);  in __cil_post_db_cat_helper()
1866 		rc = __evaluate_level_expression(user->dftlevel, db);  in __cil_post_db_cat_helper()
1870 		rc = __evaluate_levelrange_expression(user->range, db);  in __cil_post_db_cat_helper()
1879 		rc = __evaluate_levelrange_expression(selinuxuser->range, db);  in __cil_post_db_cat_helper()
1887 		rc = __evaluate_levelrange_expression(rangetrans->range, db);  in __cil_post_db_cat_helper()
1895 		rc = __evaluate_levelrange_expression(context->range, db);  in __cil_post_db_cat_helper()
1903 		rc = __evaluate_levelrange_expression(sidcontext->context->range, db);  in __cil_post_db_cat_helper()
1912 			rc = __evaluate_levelrange_expression(filecon->context->range, db);  in __cil_post_db_cat_helper()
1922 		rc = __evaluate_levelrange_expression(ibpkeycon->context->range, db);  in __cil_post_db_cat_helper()
1930 		rc = __evaluate_levelrange_expression(ibendportcon->context->range, db);  in __cil_post_db_cat_helper()
1937 		rc = __evaluate_levelrange_expression(portcon->context->range, db);  in __cil_post_db_cat_helper()
1945 		rc = __evaluate_levelrange_expression(nodecon->context->range, db);  in __cil_post_db_cat_helper()
1953 		rc = __evaluate_levelrange_expression(genfscon->context->range, db);  in __cil_post_db_cat_helper()
1961 		rc = __evaluate_levelrange_expression(netifcon->if_context->range, db);  in __cil_post_db_cat_helper()
1965 		rc = __evaluate_levelrange_expression(netifcon->packet_context->range, db);  in __cil_post_db_cat_helper()
1973 		rc = __evaluate_levelrange_expression(pirqcon->context->range, db);  in __cil_post_db_cat_helper()
1981 		rc = __evaluate_levelrange_expression(iomemcon->context->range, db);  in __cil_post_db_cat_helper()
1989 		rc = __evaluate_levelrange_expression(ioportcon->context->range, db);  in __cil_post_db_cat_helper()
1997 		rc = __evaluate_levelrange_expression(pcidevicecon->context->range, db);  in __cil_post_db_cat_helper()
2005 		rc = __evaluate_levelrange_expression(devicetreecon->context->range, db);  in __cil_post_db_cat_helper()
2013 		rc = __evaluate_levelrange_expression(fsuse->context->range, db);  in __cil_post_db_cat_helper()
2052 …ab, symtab_t *common_symtab, unsigned int num_perms, struct cil_list **new_list, struct cil_db *db)  in __evaluate_perm_expression()  argument
2063 	rc = __cil_expr_to_bitmap(perms, &bitmap, num_perms, db);  in __evaluate_perm_expression()
2088 static int __evaluate_classperms(struct cil_classperms *cp, struct cil_db *db)  in __evaluate_classperms()  argument
2100 …erm_expression(cp->perms, CIL_PERM, &class->perms, common_symtab, class->num_perms, &new_list, db);  in __evaluate_classperms()
2119 static int __evaluate_classperms_list(struct cil_list *classperms, struct cil_db *db)  in __evaluate_classperms_list()  argument
2128 				rc = __evaluate_classperms(cp, db);  in __evaluate_classperms_list()
2136 					rc = __evaluate_classperms_list(cmp->classperms, db);  in __evaluate_classperms_list()
2145 			rc = __evaluate_classperms_list(cp->classperms, db);  in __evaluate_classperms_list()
2159 	struct cil_db *db;  member
2168 	int rc = __evaluate_classperms_list(cmp->classperms, map_args->db);  in __evaluate_map_perm_classperms()
2177 static int __evaluate_map_class(struct cil_class *mc, struct cil_db *db)  in __evaluate_map_class()  argument
2181 	map_args.db = db;  in __evaluate_map_class()
2191 	struct cil_db *db = extra_args;  in __cil_post_db_classperms_helper()  local
2205 		rc = __evaluate_map_class(node->data, db);  in __cil_post_db_classperms_helper()
2213 		rc = __evaluate_classperms_list(cp->classperms, db);  in __cil_post_db_classperms_helper()
2221 		rc = __evaluate_classperms_list(avrule->perms.classperms, db);  in __cil_post_db_classperms_helper()
2230 		rc = __evaluate_classperms_list(constrain->classperms, db);  in __cil_post_db_classperms_helper()
2266 …onst void *), int (*concompar)(const void *, const void *), struct cil_db *db, enum cil_flavor fla…  in __cil_post_process_context_rules()  argument
2283 			if (!db->multiple_decls ||  in __cil_post_process_context_rules()
2292 				rc2 = cil_tree_walk(db->ast->root,  in __cil_post_process_context_rules()
2297 				rc2 = cil_tree_walk(db->ast->root,  in __cil_post_process_context_rules()
2314 static int cil_post_db(struct cil_db *db)  in cil_post_db()  argument
2318 	rc = cil_tree_walk(db->ast->root, __cil_post_db_count_helper, NULL, NULL, db);  in cil_post_db()
2324 	rc = cil_tree_walk(db->ast->root, __cil_post_db_array_helper, NULL, NULL, db);  in cil_post_db()
2330 	rc = cil_tree_walk(db->ast->root, __cil_post_db_neverallow_attr_helper, NULL, NULL, db);  in cil_post_db()
2336 	rc = cil_tree_walk(db->ast->root, __cil_post_db_attr_helper, NULL, NULL, db);  in cil_post_db()
2342 	rc = cil_tree_walk(db->ast->root, __cil_post_db_roletype_helper, NULL, NULL, db);  in cil_post_db()
2348 	rc = cil_tree_walk(db->ast->root, __cil_post_db_userrole_helper, NULL, NULL, db);  in cil_post_db()
2354 	rc = cil_tree_walk(db->ast->root, __cil_post_db_classperms_helper, NULL, NULL, db);  in cil_post_db()
2360 	rc = cil_tree_walk(db->ast->root, __cil_post_db_cat_helper, NULL, NULL, db);  in cil_post_db()
2366 …c = __cil_post_process_context_rules(db->netifcon, cil_post_netifcon_compare, cil_post_netifcon_co…  in cil_post_db()
2372 …c = __cil_post_process_context_rules(db->genfscon, cil_post_genfscon_compare, cil_post_genfscon_co…  in cil_post_db()
2378 … = __cil_post_process_context_rules(db->ibpkeycon, cil_post_ibpkeycon_compare, cil_post_ibpkeycon_…  in cil_post_db()
2384 …cil_post_process_context_rules(db->ibendportcon, cil_post_ibendportcon_compare, cil_post_ibendport…  in cil_post_db()
2390 …rc = __cil_post_process_context_rules(db->portcon, cil_post_portcon_compare, cil_post_portcon_cont…  in cil_post_db()
2396 …rc = __cil_post_process_context_rules(db->nodecon, cil_post_nodecon_compare, cil_post_nodecon_cont…  in cil_post_db()
2402 …rc = __cil_post_process_context_rules(db->fsuse, cil_post_fsuse_compare, cil_post_fsuse_context_co…  in cil_post_db()
2408 …rc = __cil_post_process_context_rules(db->filecon, cil_post_filecon_compare, cil_post_filecon_cont…  in cil_post_db()
2414 …c = __cil_post_process_context_rules(db->iomemcon, cil_post_iomemcon_compare, cil_post_iomemcon_co…  in cil_post_db()
2420 … = __cil_post_process_context_rules(db->ioportcon, cil_post_ioportcon_compare, cil_post_ioportcon_…  in cil_post_db()
2426 …cil_post_process_context_rules(db->pcidevicecon, cil_post_pcidevicecon_compare, cil_post_pcidevice…  in cil_post_db()
2432 …il_post_process_context_rules(db->devicetreecon, cil_post_devicetreecon_compare, cil_post_devicetr…  in cil_post_db()
2442 static int cil_post_verify(struct cil_db *db)  in cil_post_verify()  argument
2455 	extra_args.db = db;  in cil_post_verify()
2464 		rc = cil_tree_walk(db->ast->root, __cil_verify_helper, NULL, NULL, &extra_args);  in cil_post_verify()
2471 	if (db->handle_unknown == -1) {  in cil_post_verify()
2473 			db->handle_unknown = SEPOL_DENY_UNKNOWN;  in cil_post_verify()
2475 			db->handle_unknown = handleunknown;  in cil_post_verify()
2479 	if (db->mls == -1) {  in cil_post_verify()
2481 			db->mls = CIL_FALSE;  in cil_post_verify()
2483 			db->mls = mls;  in cil_post_verify()
2504 static int cil_pre_verify(struct cil_db *db)  in cil_pre_verify()  argument
2509 	extra_args.db = db;  in cil_pre_verify()
2511 	rc = cil_tree_walk(db->ast->root, __cil_pre_verify_helper, NULL, NULL, &extra_args);  in cil_pre_verify()
2521 int cil_post_process(struct cil_db *db)  in cil_post_process()  argument
2525 	rc = cil_pre_verify(db);  in cil_post_process()
2531 	rc = cil_post_db(db);  in cil_post_process()
2537 	rc = cil_post_verify(db);  in cil_post_process()