| Message ID | 20200304094947.181153-1-omosnace@redhat.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [RFC] libsepol/cil: raise default attrs_expand_size to 2 | expand |
On Wed, Mar 4, 2020 at 4:50 AM Ondrej Mosnacek <omosnace@redhat.com> wrote: > > Tne value attrs_expand_size == 1 removes all empty attributes, but it > also makes sense to expand all attributes that have only one type. This > removes some redundant rules (there is sometimes the same rule for the > type and the attribute) and reduces the number of attributes that the > kernel has to go through when looking up rules. > > Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> > --- > libsepol/cil/src/cil.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c > index d222ad3a..31380e8b 100644 > --- a/libsepol/cil/src/cil.c > +++ b/libsepol/cil/src/cil.c > @@ -452,7 +452,8 @@ void cil_db_init(struct cil_db **db) > (*db)->disable_dontaudit = CIL_FALSE; > (*db)->disable_neverallow = CIL_FALSE; > (*db)->attrs_expand_generated = CIL_FALSE; > - (*db)->attrs_expand_size = 1; > + /* 2 == remove attributes that cointain none or just 1 type */ s/cointain/contain/
diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c index d222ad3a..31380e8b 100644 --- a/libsepol/cil/src/cil.c +++ b/libsepol/cil/src/cil.c @@ -452,7 +452,8 @@ void cil_db_init(struct cil_db **db) (*db)->disable_dontaudit = CIL_FALSE; (*db)->disable_neverallow = CIL_FALSE; (*db)->attrs_expand_generated = CIL_FALSE; - (*db)->attrs_expand_size = 1; + /* 2 == remove attributes that cointain none or just 1 type */ + (*db)->attrs_expand_size = 2; (*db)->preserve_tunables = CIL_FALSE; (*db)->handle_unknown = -1; (*db)->mls = -1;
Tne value attrs_expand_size == 1 removes all empty attributes, but it also makes sense to expand all attributes that have only one type. This removes some redundant rules (there is sometimes the same rule for the type and the attribute) and reduces the number of attributes that the kernel has to go through when looking up rules. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> --- libsepol/cil/src/cil.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)