diff mbox series

libsepol: update policy capabilities array

Message ID 20231109135400.44658-1-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit b8f5245953a5
Delegated to: Petr Lautrbach
Headers show
Series libsepol: update policy capabilities array | expand

Commit Message

Christian Göttsche Nov. 9, 2023, 1:54 p.m. UTC 
Use their enum values as indices to clarify their relationships.
Specify array size to verify it at compile time.
Remove unnecessary trailing entry, since all access is controlled by a
check against POLICYDB_CAP_MAX.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/src/polcaps.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

Comments

James Carter Nov. 14, 2023, 8:41 p.m. UTC | #1 
On Thu, Nov 9, 2023 at 8:54 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> Use their enum values as indices to clarify their relationships.
> Specify array size to verify it at compile time.
> Remove unnecessary trailing entry, since all access is controlled by a
> check against POLICYDB_CAP_MAX.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libsepol/src/polcaps.c | 21 ++++++++++-----------
>  1 file changed, 10 insertions(+), 11 deletions(-)
>
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index be12580a..8289443a 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -5,17 +5,16 @@
>  #include <string.h>
>  #include <sepol/policydb/polcaps.h>
>
> -static const char * const polcap_names[] = {
> -       "network_peer_controls",        /* POLICYDB_CAP_NETPEER */
> -       "open_perms",                   /* POLICYDB_CAP_OPENPERM */
> -       "extended_socket_class",        /* POLICYDB_CAP_EXTSOCKCLASS */
> -       "always_check_network",         /* POLICYDB_CAP_ALWAYSNETWORK */
> -       "cgroup_seclabel",              /* POLICYDB_CAP_SECLABEL */
> -       "nnp_nosuid_transition",        /* POLICYDB_CAP_NNP_NOSUID_TRANSITION */
> -       "genfs_seclabel_symlinks",      /* POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS */
> -       "ioctl_skip_cloexec",           /* POLICYDB_CAP_IOCTL_SKIP_CLOEXEC */
> -       "userspace_initial_context",    /* POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT */
> -       NULL
> +static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> +       [POLICYDB_CAP_NETPEER]                          = "network_peer_controls",
> +       [POLICYDB_CAP_OPENPERM]                         = "open_perms",
> +       [POLICYDB_CAP_EXTSOCKCLASS]                     = "extended_socket_class",
> +       [POLICYDB_CAP_ALWAYSNETWORK]                    = "always_check_network",
> +       [POLICYDB_CAP_CGROUPSECLABEL]                   = "cgroup_seclabel",
> +       [POLICYDB_CAP_NNP_NOSUID_TRANSITION]            = "nnp_nosuid_transition",
> +       [POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS]          = "genfs_seclabel_symlinks",
> +       [POLICYDB_CAP_IOCTL_SKIP_CLOEXEC]               = "ioctl_skip_cloexec",
> +       [POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT]        = "userspace_initial_context",
>  };
>
>  int sepol_polcap_getnum(const char *name)
> --
> 2.42.0
>
James Carter Nov. 16, 2023, 2:57 p.m. UTC | #2 
On Tue, Nov 14, 2023 at 3:41 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Thu, Nov 9, 2023 at 8:54 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
> >
> > Use their enum values as indices to clarify their relationships.
> > Specify array size to verify it at compile time.
> > Remove unnecessary trailing entry, since all access is controlled by a
> > check against POLICYDB_CAP_MAX.
> >
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: James Carter <jwcart2@gmail.com>
>

This patch has been merged.
Thanks,
Jim

> > ---
> >  libsepol/src/polcaps.c | 21 ++++++++++-----------
> >  1 file changed, 10 insertions(+), 11 deletions(-)
> >
> > diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> > index be12580a..8289443a 100644
> > --- a/libsepol/src/polcaps.c
> > +++ b/libsepol/src/polcaps.c
> > @@ -5,17 +5,16 @@
> >  #include <string.h>
> >  #include <sepol/policydb/polcaps.h>
> >
> > -static const char * const polcap_names[] = {
> > -       "network_peer_controls",        /* POLICYDB_CAP_NETPEER */
> > -       "open_perms",                   /* POLICYDB_CAP_OPENPERM */
> > -       "extended_socket_class",        /* POLICYDB_CAP_EXTSOCKCLASS */
> > -       "always_check_network",         /* POLICYDB_CAP_ALWAYSNETWORK */
> > -       "cgroup_seclabel",              /* POLICYDB_CAP_SECLABEL */
> > -       "nnp_nosuid_transition",        /* POLICYDB_CAP_NNP_NOSUID_TRANSITION */
> > -       "genfs_seclabel_symlinks",      /* POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS */
> > -       "ioctl_skip_cloexec",           /* POLICYDB_CAP_IOCTL_SKIP_CLOEXEC */
> > -       "userspace_initial_context",    /* POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT */
> > -       NULL
> > +static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> > +       [POLICYDB_CAP_NETPEER]                          = "network_peer_controls",
> > +       [POLICYDB_CAP_OPENPERM]                         = "open_perms",
> > +       [POLICYDB_CAP_EXTSOCKCLASS]                     = "extended_socket_class",
> > +       [POLICYDB_CAP_ALWAYSNETWORK]                    = "always_check_network",
> > +       [POLICYDB_CAP_CGROUPSECLABEL]                   = "cgroup_seclabel",
> > +       [POLICYDB_CAP_NNP_NOSUID_TRANSITION]            = "nnp_nosuid_transition",
> > +       [POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS]          = "genfs_seclabel_symlinks",
> > +       [POLICYDB_CAP_IOCTL_SKIP_CLOEXEC]               = "ioctl_skip_cloexec",
> > +       [POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT]        = "userspace_initial_context",
> >  };
> >
> >  int sepol_polcap_getnum(const char *name)
> > --
> > 2.42.0
> >
diff mbox series

Patch

diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
index be12580a..8289443a 100644
--- a/libsepol/src/polcaps.c
+++ b/libsepol/src/polcaps.c
@@ -5,17 +5,16 @@ 
 #include <string.h>
 #include <sepol/policydb/polcaps.h>
 
-static const char * const polcap_names[] = {
-	"network_peer_controls",	/* POLICYDB_CAP_NETPEER */
-	"open_perms",			/* POLICYDB_CAP_OPENPERM */
-	"extended_socket_class",	/* POLICYDB_CAP_EXTSOCKCLASS */
-	"always_check_network",		/* POLICYDB_CAP_ALWAYSNETWORK */
-	"cgroup_seclabel",		/* POLICYDB_CAP_SECLABEL */
-	"nnp_nosuid_transition",	/* POLICYDB_CAP_NNP_NOSUID_TRANSITION */
-	"genfs_seclabel_symlinks",	/* POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS */
-	"ioctl_skip_cloexec",		/* POLICYDB_CAP_IOCTL_SKIP_CLOEXEC */
-	"userspace_initial_context",	/* POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT */
-	NULL
+static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
+	[POLICYDB_CAP_NETPEER]				= "network_peer_controls",
+	[POLICYDB_CAP_OPENPERM]				= "open_perms",
+	[POLICYDB_CAP_EXTSOCKCLASS]			= "extended_socket_class",
+	[POLICYDB_CAP_ALWAYSNETWORK]			= "always_check_network",
+	[POLICYDB_CAP_CGROUPSECLABEL]			= "cgroup_seclabel",
+	[POLICYDB_CAP_NNP_NOSUID_TRANSITION]		= "nnp_nosuid_transition",
+	[POLICYDB_CAP_GENFS_SECLABEL_SYMLINKS]		= "genfs_seclabel_symlinks",
+	[POLICYDB_CAP_IOCTL_SKIP_CLOEXEC]		= "ioctl_skip_cloexec",
+	[POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT]	= "userspace_initial_context",
 };
 
 int sepol_polcap_getnum(const char *name)