diff mbox series

[04/11] libselinux/utils: improve compute_av output

Message ID 20231219160943.334370-4-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit 1dd0433885d5
Delegated to: Petr Lautrbach
Headers show
Series [01/11] libselinux/man: mention errno for regex compilation failure | expand

Commit Message

Christian Göttsche Dec. 19, 2023, 4:09 p.m. UTC 
Show the more interesting inverse of the auditdeny vector as dontaudit.

Show the inverse of the decided vector, although since Linux v2.6.30
f1c6381a6e33 ("SELinux: remove unused av.decided field") all permissions
are always decided.

    $ compute_av staff_u:staff_r:staff_t:s0 sysadm_u:sysadm_r:sysadm_t:s0 process
    allowed= null
    auditdeny= { fork transition sigchld sigkill sigstop signull ptrace getsched setsched getsession getpgid setpgid getcap setcap share getattr setexec setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setcurrent execmem execstack execheap setkeycreate setsockcreate getrlimit 0x80000000 }
    dontaudit= { signal }

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libselinux/utils/compute_av.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/libselinux/utils/compute_av.c b/libselinux/utils/compute_av.c
index cca407d6..09f574a0 100644
--- a/libselinux/utils/compute_av.c
+++ b/libselinux/utils/compute_av.c
@@ -44,10 +44,14 @@  int main(int argc, char **argv)
 	print_access_vector(tclass, avd.allowed);
 	printf("\n");
 
-	if (avd.decided != ~0U) {
+	if (~avd.decided) {
 		printf("decided=");
 		print_access_vector(tclass, avd.decided);
 		printf("\n");
+
+		printf("undecided=");
+		print_access_vector(tclass, ~avd.decided);
+		printf("\n");
 	}
 
 	if (avd.auditallow) {
@@ -56,10 +60,14 @@  int main(int argc, char **argv)
 		printf("\n");
 	}
 
-	if (avd.auditdeny != ~0U) {
-		printf("auditdeny");
+	if (~avd.auditdeny) {
+		printf("auditdeny=");
 		print_access_vector(tclass, avd.auditdeny);
 		printf("\n");
+
+		printf("dontaudit=");
+		print_access_vector(tclass, ~avd.auditdeny);
+		printf("\n");
 	}
 
 	exit(EXIT_SUCCESS);