[Xen-devel] [PATCH 3/4] checkpolicy: add output for Xen policy version support

[Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>]

When invoked as "checkpolicy -t Xen -V", report the range of supported
versions for the Xen policy instead of the supported versions for the
SELinux policy.

This also changes the default maximum policy version to depend on the
policy type, so that running "checkpolicy -t Xen" without -c does not
fail due to the Xen policy having a different maximum version number.

Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
---
 checkpolicy/checkpolicy.c                  | 59 ++++++++++++++++++++++--------
 libsepol/include/sepol/policydb/policydb.h |  9 +++--
 2 files changed, 49 insertions(+), 19 deletions(-)

diff --git a/checkpolicy/checkpolicy.c b/checkpolicy/checkpolicy.c
index 61a2e89..e836bcb 100644
--- a/checkpolicy/checkpolicy.c
+++ b/checkpolicy/checkpolicy.c
@@ -99,7 +99,7 @@ static int handle_unknown = SEPOL_DENY_UNKNOWN;
 static const char *txtfile = "policy.conf";
 static const char *binfile = "policy";
 
-unsigned int policyvers = POLICYDB_VERSION_MAX;
+unsigned int policyvers = 0;
 
 void usage(char *progname)
 {
@@ -466,17 +466,7 @@ int main(int argc, char **argv)
                                        usage(argv[0]);
                                        exit(1);
                                }
-                               if (n < POLICYDB_VERSION_MIN
-                                   || n > POLICYDB_VERSION_MAX) {
-                                       fprintf(stderr,
-                                               "policyvers value %ld not in 
range %d-%d\n",
-                                               n, POLICYDB_VERSION_MIN,
-                                               POLICYDB_VERSION_MAX);
-                                       usage(argv[0]);
-                                       exit(1);
-                               }
-                               if (policyvers != n)
-                                       policyvers = n;
+                               policyvers = n;
                                break;
                        }
                case 'h':
@@ -485,10 +475,47 @@ int main(int argc, char **argv)
                }
        }
 
-       if (show_version) {
-               printf("%d (compatibility range %d-%d)\n", policyvers,
-                      POLICYDB_VERSION_MAX, POLICYDB_VERSION_MIN);
-               exit(0);
+       switch (target) {
+       case SEPOL_TARGET_SELINUX:
+               if (policyvers == 0) {
+                       policyvers = POLICYDB_VERSION_MAX;
+               } else if (policyvers < POLICYDB_VERSION_MIN
+                               || policyvers > POLICYDB_VERSION_MAX) {
+                       fprintf(stderr,
+                               "policyvers value %d not in range %d-%d\n",
+                               policyvers, POLICYDB_VERSION_MIN,
+                               POLICYDB_VERSION_MAX);
+                               usage(argv[0]);
+                               exit(1);
+               }
+               if (show_version) {
+                       printf("%d (compatibility range %d-%d)\n", policyvers,
+                                  POLICYDB_VERSION_MAX, POLICYDB_VERSION_MIN);
+                       exit(0);
+               }
+               break;
+       case SEPOL_TARGET_XEN:
+               if (policyvers == 0) {
+                       policyvers = POLICYDB_XEN_VERSION_MAX;
+               } else if (policyvers < POLICYDB_XEN_VERSION_MIN
+                               || policyvers > POLICYDB_XEN_VERSION_MAX) {
+                       fprintf(stderr,
+                               "policyvers value %d not in range %d-%d\n",
+                               policyvers, POLICYDB_XEN_VERSION_MIN,
+                               POLICYDB_XEN_VERSION_MAX);
+                               usage(argv[0]);
+                               exit(1);
+               }
+               if (show_version) {
+                       printf("Xen policy compatibility range: %d %d\n",
+                               POLICYDB_XEN_VERSION_MIN,
+                               POLICYDB_XEN_VERSION_MAX);
+                       exit(0);
+               }
+               break;
+       default:
+               usage(argv[0]);
+               exit(1);
        }
 
        if (optind != argc) {
diff --git a/libsepol/include/sepol/policydb/policydb.h 
b/libsepol/include/sepol/policydb/policydb.h
index d574d4b..8150765 100644
--- a/libsepol/include/sepol/policydb/policydb.h
+++ b/libsepol/include/sepol/policydb/policydb.h
@@ -691,13 +691,16 @@ extern int policydb_set_target_platform(policydb_t *p, 
int platform);
 #define POLICYDB_VERSION_DEFAULT_TYPE  28
 #define POLICYDB_VERSION_CONSTRAINT_NAMES      29
 
-#define POLICYDB_XEN_VERSION_BASE   24
-#define POLICYDB_XEN_VERSION_AARCH  25
-
 /* Range of policy versions we understand*/
 #define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE
 #define POLICYDB_VERSION_MAX   POLICYDB_VERSION_CONSTRAINT_NAMES
 
+#define POLICYDB_XEN_VERSION_BASE   24
+#define POLICYDB_XEN_VERSION_AARCH  25
+
+#define POLICYDB_XEN_VERSION_MIN       POLICYDB_XEN_VERSION_BASE
+#define POLICYDB_XEN_VERSION_MAX       POLICYDB_XEN_VERSION_AARCH
+
 /* Module versions and specific changes*/
 #define MOD_POLICYDB_VERSION_BASE              4
 #define MOD_POLICYDB_VERSION_VALIDATETRANS     5
-- 
2.1.0


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel