mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
parser: add flags to control rule merging
Add the ability to control whether rule merging is done. TODO: in the furture cleanup display of flags split accross two tables Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
parent
e84e481263
commit
1754b4da69
@ -24,8 +24,12 @@ typedef int optflags_t;
|
|||||||
typedef struct optflags {
|
typedef struct optflags {
|
||||||
optflags_t dfaflags;
|
optflags_t dfaflags;
|
||||||
optflags_t dfadump;
|
optflags_t dfadump;
|
||||||
|
optflags_t frontflags;
|
||||||
|
optflags_t frontdump;
|
||||||
optflags_t warn;
|
optflags_t warn;
|
||||||
optflags_t Werror;
|
optflags_t Werror;
|
||||||
} optflags;
|
} optflags;
|
||||||
|
|
||||||
|
extern optflags parseopts;
|
||||||
|
|
||||||
#endif /* __AA_COMMON_FLAGS_H */
|
#endif /* __AA_COMMON_FLAGS_H */
|
||||||
|
@ -103,13 +103,6 @@ optflag_table_t dfaoptflag_table[] = {
|
|||||||
{ 0, NULL, NULL, 0 },
|
{ 0, NULL, NULL, 0 },
|
||||||
};
|
};
|
||||||
|
|
||||||
optflags parseopts = {
|
|
||||||
.dfaflags = (optflags_t)(CONTROL_DFA_TREE_NORMAL | CONTROL_DFA_TREE_SIMPLE | CONTROL_DFA_MINIMIZE | CONTROL_DFA_DIFF_ENCODE),
|
|
||||||
.dfadump = 0,
|
|
||||||
.warn = DEFAULT_WARNINGS,
|
|
||||||
.Werror = 0
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
void print_flag_table(optflag_table_t *table)
|
void print_flag_table(optflag_table_t *table)
|
||||||
{
|
{
|
||||||
|
@ -41,8 +41,6 @@ typedef struct {
|
|||||||
extern optflag_table_t dfadumpflag_table[];
|
extern optflag_table_t dfadumpflag_table[];
|
||||||
extern optflag_table_t dfaoptflag_table[];
|
extern optflag_table_t dfaoptflag_table[];
|
||||||
|
|
||||||
extern optflags parseopts;
|
|
||||||
|
|
||||||
|
|
||||||
void print_flags(const char *prefix, optflag_table_t *table,
|
void print_flags(const char *prefix, optflag_table_t *table,
|
||||||
optflags_t flags);
|
optflags_t flags);
|
||||||
|
@ -15,6 +15,7 @@
|
|||||||
* along with this program; if not, contact or Canonical Ltd.
|
* along with this program; if not, contact or Canonical Ltd.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
#include "common_optarg.h"
|
||||||
#include "parser.h"
|
#include "parser.h"
|
||||||
#include "profile.h"
|
#include "profile.h"
|
||||||
#include "io_uring.h"
|
#include "io_uring.h"
|
||||||
|
@ -83,6 +83,9 @@ extern int parser_token;
|
|||||||
WARN_OVERRIDE | WARN_INCLUDE)
|
WARN_OVERRIDE | WARN_INCLUDE)
|
||||||
|
|
||||||
|
|
||||||
|
#define CONTROL_RULE_MERGE 0x1
|
||||||
|
#define DUMP_RULE_MERGE 0x1
|
||||||
|
|
||||||
typedef enum pattern_t pattern_t;
|
typedef enum pattern_t pattern_t;
|
||||||
|
|
||||||
|
|
||||||
|
@ -99,6 +99,16 @@ FILE *ofile = NULL;
|
|||||||
|
|
||||||
IncludeCache_t *g_includecache;
|
IncludeCache_t *g_includecache;
|
||||||
|
|
||||||
|
optflags parseopts = {
|
||||||
|
.dfaflags = (optflags_t)(CONTROL_DFA_TREE_NORMAL | CONTROL_DFA_TREE_SIMPLE | CONTROL_DFA_MINIMIZE | CONTROL_DFA_DIFF_ENCODE),
|
||||||
|
.dfadump = 0,
|
||||||
|
.frontflags = (optflags_t)(CONTROL_RULE_MERGE),
|
||||||
|
.frontdump = 0,
|
||||||
|
.warn = DEFAULT_WARNINGS,
|
||||||
|
.Werror = 0
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
#ifdef FORCE_READ_IMPLIES_EXEC
|
#ifdef FORCE_READ_IMPLIES_EXEC
|
||||||
int read_implies_exec = 1;
|
int read_implies_exec = 1;
|
||||||
#else
|
#else
|
||||||
|
@ -82,6 +82,9 @@ int abort_on_error = 0; /* stop processing profiles if error */
|
|||||||
int skip_bad_cache_rebuild = 0;
|
int skip_bad_cache_rebuild = 0;
|
||||||
int mru_skip_cache = 1;
|
int mru_skip_cache = 1;
|
||||||
|
|
||||||
|
bool O_rule_merge = true;
|
||||||
|
bool D_rule_merge = false;
|
||||||
|
|
||||||
/* for jobs_max and jobs
|
/* for jobs_max and jobs
|
||||||
* LONG_MAX : no limit
|
* LONG_MAX : no limit
|
||||||
* LONG_MIN : auto = detect system processing cores
|
* LONG_MIN : auto = detect system processing cores
|
||||||
@ -274,6 +277,16 @@ optflag_table_t warnflag_table[] = {
|
|||||||
{ 0, NULL, NULL, 0 },
|
{ 0, NULL, NULL, 0 },
|
||||||
};
|
};
|
||||||
|
|
||||||
|
optflag_table_t frontopts_table[] = {
|
||||||
|
{ 1, "rule-merge", "turn on rule merging", CONTROL_RULE_MERGE},
|
||||||
|
{ 0, NULL, NULL, 0 },
|
||||||
|
};
|
||||||
|
|
||||||
|
optflag_table_t frontdump_table[] = {
|
||||||
|
{ 1, "rule-merge", "dump information about rule merging", DUMP_RULE_MERGE},
|
||||||
|
{ 0, NULL, NULL, 0 },
|
||||||
|
};
|
||||||
|
|
||||||
/* Parse comma separated cachelocations. Commas can be escaped by \, */
|
/* Parse comma separated cachelocations. Commas can be escaped by \, */
|
||||||
static int parse_cacheloc(const char *arg, const char **cacheloc, int max_size)
|
static int parse_cacheloc(const char *arg, const char **cacheloc, int max_size)
|
||||||
{
|
{
|
||||||
@ -494,10 +507,13 @@ static int process_arg(int c, char *optarg)
|
|||||||
strcmp(optarg, "D") == 0) {
|
strcmp(optarg, "D") == 0) {
|
||||||
flagtable_help("--dump=", DUMP_HEADER, progname,
|
flagtable_help("--dump=", DUMP_HEADER, progname,
|
||||||
dfadumpflag_table);
|
dfadumpflag_table);
|
||||||
|
flagtable_help("--dump=", DUMP_HEADER, progname,
|
||||||
|
frontopts_table);
|
||||||
} else if (strcmp(optarg, "Optimize") == 0 ||
|
} else if (strcmp(optarg, "Optimize") == 0 ||
|
||||||
strcmp(optarg, "optimize") == 0 ||
|
strcmp(optarg, "optimize") == 0 ||
|
||||||
strcmp(optarg, "O") == 0) {
|
strcmp(optarg, "O") == 0) {
|
||||||
flagtable_help("-O ", "", progname, dfaoptflag_table);
|
flagtable_help("-O ", "", progname, dfaoptflag_table);
|
||||||
|
flagtable_help("-O ", "", progname, frontopts_table);
|
||||||
} else if (strcmp(optarg, "warn") == 0) {
|
} else if (strcmp(optarg, "warn") == 0) {
|
||||||
flagtable_help("--warn=", "", progname, warnflag_table);
|
flagtable_help("--warn=", "", progname, warnflag_table);
|
||||||
} else if (strcmp(optarg, "Werror") == 0) {
|
} else if (strcmp(optarg, "Werror") == 0) {
|
||||||
@ -569,12 +585,15 @@ static int process_arg(int c, char *optarg)
|
|||||||
dump_vars = 1;
|
dump_vars = 1;
|
||||||
} else if (strcmp(optarg, "show") == 0) {
|
} else if (strcmp(optarg, "show") == 0) {
|
||||||
print_flags("dump", dfadumpflag_table, parseopts.dfadump);
|
print_flags("dump", dfadumpflag_table, parseopts.dfadump);
|
||||||
|
print_flags("dump", frontdump_table, parseopts.frontdump);
|
||||||
} else if (strcmp(optarg, "variables") == 0) {
|
} else if (strcmp(optarg, "variables") == 0) {
|
||||||
dump_vars = 1;
|
dump_vars = 1;
|
||||||
} else if (strcmp(optarg, "expanded-variables") == 0) {
|
} else if (strcmp(optarg, "expanded-variables") == 0) {
|
||||||
dump_expanded_vars = 1;
|
dump_expanded_vars = 1;
|
||||||
} else if (!handle_flag_table(dfadumpflag_table, optarg,
|
} else if (!handle_flag_table(dfadumpflag_table, optarg,
|
||||||
&parseopts.dfadump)) {
|
&parseopts.dfadump) &&
|
||||||
|
!handle_flag_table(frontdump_table, optarg,
|
||||||
|
&parseopts.frontdump)) {
|
||||||
PERROR("%s: Invalid --Dump option %s\n",
|
PERROR("%s: Invalid --Dump option %s\n",
|
||||||
progname, optarg);
|
progname, optarg);
|
||||||
exit(1);
|
exit(1);
|
||||||
@ -583,8 +602,11 @@ static int process_arg(int c, char *optarg)
|
|||||||
case 'O':
|
case 'O':
|
||||||
if (strcmp(optarg, "show") == 0) {
|
if (strcmp(optarg, "show") == 0) {
|
||||||
print_flags("Optimize", dfaoptflag_table, parseopts.dfaflags);
|
print_flags("Optimize", dfaoptflag_table, parseopts.dfaflags);
|
||||||
|
print_flags("Optimize", frontopts_table, parseopts.frontflags);
|
||||||
} else if (!handle_flag_table(dfaoptflag_table, optarg,
|
} else if (!handle_flag_table(dfaoptflag_table, optarg,
|
||||||
&parseopts.dfaflags)) {
|
&parseopts.dfaflags) &&
|
||||||
|
!handle_flag_table(frontopts_table, optarg,
|
||||||
|
&parseopts.frontflags)) {
|
||||||
PERROR("%s: Invalid --Optimize option %s\n",
|
PERROR("%s: Invalid --Optimize option %s\n",
|
||||||
progname, optarg);
|
progname, optarg);
|
||||||
exit(1);
|
exit(1);
|
||||||
|
@ -111,12 +111,16 @@ static int process_file_entries(Profile *prof)
|
|||||||
|
|
||||||
int profile_merge_rules(Profile *prof)
|
int profile_merge_rules(Profile *prof)
|
||||||
{
|
{
|
||||||
|
if (!(parseopts.frontflags & CONTROL_RULE_MERGE))
|
||||||
|
return 0;
|
||||||
|
|
||||||
int res, tmp = process_file_entries(prof);
|
int res, tmp = process_file_entries(prof);
|
||||||
if (tmp < 0)
|
if (tmp < 0)
|
||||||
return -tmp;
|
return -tmp;
|
||||||
res = prof->merge_rules();
|
res = prof->merge_rules();
|
||||||
if (res < 0)
|
if (res < 0)
|
||||||
return -res;
|
return -res;
|
||||||
// TODO: output message eliminated rules res + tmp;
|
if (parseopts.frontdump & DUMP_RULE_MERGE)
|
||||||
|
fprintf(stderr, "RULE MERGE: deleted %d file rules, %d rules\n", tmp, res);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user