compile success for libsepl in kernel

kernel/libsepol/tests/.gitignore

@@ -0,0 +1 @@
+libsepol-tests

kernel/libsepol/tests/Makefile

@@ -0,0 +1,60 @@
+ENV ?= env
+M4 ?= m4
+MKDIR ?= mkdir
+EXE ?= libsepol-tests
+
+CFLAGS += -g3 -gdwarf-2 -O0 -Wall -W -Wundef -Wmissing-noreturn -Wmissing-format-attribute -Wno-unused-parameter -Werror
+
+# Statically link libsepol on the assumption that we are going to
+# be testing internal functions.
+LIBSEPOL := ../src/libsepol.a
+
+# In order to load source policies we need to link in the checkpolicy/checkmodule parser and util code.
+# This is less than ideal, but it makes the tests easier to maintain by allowing source policies
+# to be loaded directly.
+CHECKPOLICY := ../../checkpolicy/
+override CPPFLAGS += -I../include/ -I$(CHECKPOLICY)
+
+# test program object files
+objs := $(patsubst %.c,%.o,$(sort $(wildcard *.c)))
+parserobjs := $(CHECKPOLICY)queue.o $(CHECKPOLICY)y.tab.o \
+	$(CHECKPOLICY)parse_util.o $(CHECKPOLICY)lex.yy.o \
+	$(CHECKPOLICY)policy_define.o $(CHECKPOLICY)module_compiler.o
+
+# test policy pieces
+m4support := $(wildcard policies/support/*.spt)
+testsuites := $(wildcard policies/test-*)
+policysrc := $(foreach path,$(testsuites),$(wildcard $(path)/*.conf))
+stdpol := $(addsuffix .std,$(policysrc))
+mlspol := $(addsuffix .mls,$(policysrc))
+policies := $(stdpol) $(mlspol)
+
+all: $(EXE) $(policies)
+policies: $(policies)
+
+$(EXE): $(objs) $(parserobjs) $(LIBSEPOL)
+	$(CC) $(LDFLAGS) $(objs) $(parserobjs) -lcunit $(LIBSEPOL) -o $@
+
+%.conf.std: $(m4support) %.conf
+	$(M4) $(M4PARAMS) $^ > $@
+
+%.conf.mls: $(m4support) %.conf
+	$(M4) $(M4PARAMS) -D enable_mls $^ > $@
+
+clean: 
+	rm -f $(objs) $(EXE)
+	rm -f $(policies)
+	rm -f policies/test-downgrade/policy.hi policies/test-downgrade/policy.lo
+
+# mkdir is run in a clean environment created by env -i to avoid failing under ASan with:
+#
+#   ASan runtime does not come first in initial library list;
+#   you should either link runtime to your application or manually preload it with LD_PRELOAD
+#
+# when the source code is built with ASan
+test: $(EXE) $(policies)
+	$(ENV) -i $(MKDIR) -p policies/test-downgrade
+	../../checkpolicy/checkpolicy -M policies/test-cond/refpolicy-base.conf -o policies/test-downgrade/policy.hi	
+	./$(EXE)
+
+.PHONY: all policies clean test

kernel/libsepol/tests/debug.c

@@ -0,0 +1,69 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This includes functions used to debug tests (display bitmaps, conditional expressions, etc */
+
+#include "debug.h"
+
+#include <stdlib.h>
+
+void print_ebitmap(ebitmap_t * bitmap, FILE * fp)
+{
+	uint32_t i;
+	for (i = 0; i < bitmap->highbit; i++) {
+		fprintf(fp, "%d", ksu_ebitmap_get_bit(bitmap, i));
+	}
+	fprintf(fp, "\n");
+}
+
+/* stolen from dispol.c */
+void display_expr(policydb_t * p, cond_expr_t * exp, FILE * fp)
+{
+
+	cond_expr_t *cur;
+	for (cur = exp; cur != NULL; cur = cur->next) {
+		switch (cur->expr_type) {
+		case COND_BOOL:
+			fprintf(fp, "%s ", p->p_bool_val_to_name[cur->bool - 1]);
+			break;
+		case COND_NOT:
+			fprintf(fp, "! ");
+			break;
+		case COND_OR:
+			fprintf(fp, "|| ");
+			break;
+		case COND_AND:
+			fprintf(fp, "&& ");
+			break;
+		case COND_XOR:
+			fprintf(fp, "^ ");
+			break;
+		case COND_EQ:
+			fprintf(fp, "== ");
+			break;
+		case COND_NEQ:
+			fprintf(fp, "!= ");
+			break;
+		default:
+			fprintf(fp, "error! (%d)", cur->expr_type);
+			break;
+		}
+	}
+}

kernel/libsepol/tests/debug.h

@@ -0,0 +1,27 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This includes functions used to debug tests (display bitmaps, conditional expressions, etc */
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/conditional.h>
+
+extern void print_ebitmap(ebitmap_t * bitmap, FILE * fp);
+extern void display_expr(policydb_t * p, cond_expr_t * exp, FILE * fp);

kernel/libsepol/tests/helpers.c

@@ -0,0 +1,81 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *         Chad Sellers <csellers@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This has helper functions that are common between tests */
+
+#include "helpers.h"
+#include "parse_util.h"
+
+#include <sepol/policydb/expand.h>
+#include <sepol/policydb/avrule_block.h>
+
+#include <CUnit/Basic.h>
+
+#include <stdlib.h>
+#include <limits.h>
+
+int test_load_policy(policydb_t * p, int policy_type, int mls, const char *test_name, const char *policy_name)
+{
+	char filename[PATH_MAX];
+
+	if (mls) {
+		if (snprintf(filename, PATH_MAX, "policies/%s/%s.mls", test_name, policy_name) < 0) {
+			return -1;
+		}
+	} else {
+		if (snprintf(filename, PATH_MAX, "policies/%s/%s.std", test_name, policy_name) < 0) {
+			return -1;
+		}
+	}
+
+	if (policydb_init(p)) {
+		fprintf(stderr, "Out of memory");
+		return -1;
+	}
+
+	p->policy_type = policy_type;
+	p->mls = mls;
+
+	if (read_source_policy(p, filename, test_name)) {
+		fprintf(stderr, "failed to read policy %s\n", filename);
+		ksu_policydb_destroy(p);
+		return -1;
+	}
+
+	return 0;
+}
+
+avrule_decl_t *test_find_decl_by_sym(policydb_t * p, int symtab, const char *sym)
+{
+	scope_datum_t *scope = (scope_datum_t *) hashtab_search(p->scope[symtab].table, sym);
+
+	if (scope == NULL) {
+		return NULL;
+	}
+	if (scope->scope != SCOPE_DECL) {
+		return NULL;
+	}
+	if (scope->decl_ids_len != 1) {
+		return NULL;
+	}
+
+	return p->decl_val_to_struct[scope->decl_ids[0] - 1];
+}

kernel/libsepol/tests/helpers.h

@@ -0,0 +1,88 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *         Chad Sellers <csellers@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __COMMON_H__
+#define __COMMON_H__
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/conditional.h>
+#include <CUnit/Basic.h>
+
+/* helper functions */
+
+/* Override CU_*_FATAL() in order to help static analyzers by really asserting that an assertion holds */
+#ifdef __CHECKER__
+
+#include <assert.h>
+
+#undef CU_ASSERT_FATAL
+#define CU_ASSERT_FATAL(value) do { \
+		int _value = (value); \
+		CU_ASSERT(_value); \
+		assert(_value); \
+	} while (0)
+
+#undef CU_FAIL_FATAL
+#define CU_FAIL_FATAL(msg) do { \
+		CU_FAIL(msg); \
+		assert(0); \
+	} while (0)
+
+#undef CU_ASSERT_PTR_NOT_NULL_FATAL
+#define CU_ASSERT_PTR_NOT_NULL_FATAL(value) do { \
+		const void *_value = (value); \
+		CU_ASSERT_PTR_NOT_NULL(_value); \
+		assert(_value != NULL); \
+	} while (0)
+
+#endif /* __CHECKER__ */
+
+
+/* Load a source policy into p. policydb_init will called within this function.
+ * 
+ * Example: test_load_policy(p, POLICY_BASE, 1, "foo", "base.conf") will load the
+ *  policy "policies/foo/mls/base.conf" into p.
+ *
+ * Arguments:
+ *  p            policydb_t into which the policy will be read. This should be
+ *                malloc'd but not passed to policydb_init.
+ *  policy_type  Type of policy expected - POLICY_BASE or POLICY_MOD.
+ *  mls          Boolean value indicating whether an mls policy is expected.
+ *  test_name    Name of the test which will be the name of the directory in
+ *                which the policies are stored.
+ *  policy_name  Name of the policy in the directory.
+ *
+ * Returns:
+ *  0            success
+ * -1            error - the policydb will be destroyed but not freed.
+ */
+extern int test_load_policy(policydb_t * p, int policy_type, int mls, const char *test_name, const char *policy_name);
+
+/* Find an avrule_decl_t by a unique symbol. If the symbol is declared in more
+ * than one decl an error is returned.
+ *
+ * Returns:
+ *  decl      success 
+ *  NULL      error (including more than one declaration)
+ */
+extern avrule_decl_t *test_find_decl_by_sym(policydb_t * p, int symtab, const char *sym);
+
+#endif

kernel/libsepol/tests/libsepol-tests.c

@@ -0,0 +1,125 @@
+/*
+ * Author: Karl MacMillan <kmacmillan@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-cond.h"
+#include "test-linker.h"
+#include "test-expander.h"
+#include "test-deps.h"
+#include "test-downgrade.h"
+
+#include <CUnit/Basic.h>
+#include <CUnit/Console.h>
+#include <CUnit/TestDB.h>
+
+#include <stdbool.h>
+#include <stdio.h>
+#include <getopt.h>
+#include <stdlib.h>
+
+int mls;
+
+#define DECLARE_SUITE(name) \
+	do { \
+		suite = CU_add_suite(#name, name##_test_init, name##_test_cleanup); \
+		if (NULL == suite) { \
+			CU_cleanup_registry(); \
+			return CU_get_error(); \
+		} \
+		if (name##_add_tests(suite)) { \
+			CU_cleanup_registry(); \
+			return CU_get_error(); \
+		} \
+	} while (0)
+
+static void usage(char *progname)
+{
+	printf("usage:  %s [options]\n", progname);
+	printf("options:\n");
+	printf("\t-v, --verbose\t\t\tverbose output\n");
+	printf("\t-i, --interactive\t\tinteractive console\n");
+}
+
+static bool do_tests(int interactive, int verbose)
+{
+	CU_pSuite suite = NULL;
+	unsigned int num_failures;
+
+	if (CUE_SUCCESS != CU_initialize_registry())
+		return CU_get_error();
+
+	DECLARE_SUITE(cond);
+	DECLARE_SUITE(linker);
+	DECLARE_SUITE(expander);
+	DECLARE_SUITE(deps);
+	DECLARE_SUITE(downgrade);
+
+	if (verbose)
+		CU_basic_set_mode(CU_BRM_VERBOSE);
+	else
+		CU_basic_set_mode(CU_BRM_NORMAL);
+
+	if (interactive)
+		CU_console_run_tests();
+	else
+		CU_basic_run_tests();
+	num_failures = CU_get_number_of_tests_failed();
+	CU_cleanup_registry();
+	return CU_get_error() == CUE_SUCCESS && num_failures == 0;
+
+}
+
+int main(int argc, char **argv)
+{
+	int i, verbose = 1, interactive = 0;
+
+	struct option opts[] = {
+		{"verbose", 0, NULL, 'v'},
+		{"interactive", 0, NULL, 'i'},
+		{NULL, 0, NULL, 0}
+	};
+
+	while ((i = getopt_long(argc, argv, "vi", opts, NULL)) != -1) {
+		switch (i) {
+		case 'v':
+			verbose = 1;
+			break;
+		case 'i':
+			interactive = 1;
+			break;
+		case 'h':
+		default:{
+				usage(argv[0]);
+				exit(1);
+			}
+		}
+	}
+
+	/* first do the non-mls tests */
+	mls = 0;
+	if (!do_tests(interactive, verbose))
+		return -1;
+
+	/* then with mls */
+	mls = 1;
+	if (!do_tests(interactive, verbose))
+		return -1;
+
+	return 0;
+}

kernel/libsepol/tests/policies/.gitignore

@@ -0,0 +1,3 @@
+test-downgrade/
+test-*/*.mls
+test-*/*.std

kernel/libsepol/tests/policies/support/misc_macros.spt

@@ -0,0 +1,23 @@
+
+########################################
+#
+# Helper macros
+#
+
+########################################
+#
+# gen_user(username, prefix, role_set, mls_defaultlevel, mls_range, [mcs_categories])
+#
+define(`gen_user',`dnl
+ifdef(`users_extra',`dnl
+ifelse(`$2',,,`user $1 prefix $2;')
+',`dnl
+user $1 roles { $3 }`'ifdef(`enable_mls', ` level $4 range $5')`'ifdef(`enable_mcs',` level s0 range s0`'ifelse(`$6',,,` - s0:$6')');
+')dnl
+')
+
+########################################
+#
+# gen_context(context,mls_sensitivity,[mcs_categories])
+#
+define(`gen_context',`$1`'ifdef(`enable_mls',`:$2')`'ifdef(`enable_mcs',`:s0`'ifelse(`$3',,,`:$3')')') dnl

kernel/libsepol/tests/policies/test-deps/base-metreq.conf

@@ -0,0 +1,523 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+# TE RULES
+attribute domain;
+attribute system;
+attribute foo;
+attribute num;
+attribute num_exec;
+attribute files;
+
+type net_foo_t, foo;
+type sys_foo_t, foo, system;
+role system_r;
+role system_r types sys_foo_t;
+
+type user_t, domain;
+role user_r;
+role user_r types user_t;
+
+type sysadm_t, domain, system;
+role sysadm_r;
+role sysadm_r types sysadm_t;
+
+type system_t, domain, system, foo;
+role system_r;
+role system_r types { system_t sys_foo_t };
+
+type file_t;
+type file_exec_t, files;
+type fs_t;
+
+# Make this decl easy to find
+type base_global_decl_t;
+
+# Actually used in module tests
+type type_req_t;
+attribute attr_req;
+bool bool_req false;
+role role_req_r;
+
+
+allow sysadm_t file_exec_t: file { execute read write ioctl lock entrypoint };
+
+optional {
+	require {
+		type base_optional_1, base_optional_2;
+	}
+	allow base_optional_1 base_optional_2 : file { read write };
+}
+
+#####################################
+# Role Allow
+allow user_r sysadm_r;
+
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:sys_foo_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:sys_foo_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:net_foo_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-deps/base-notmetreq.conf

@@ -0,0 +1,510 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+# TE RULES
+attribute domain;
+attribute system;
+attribute foo;
+attribute num;
+attribute num_exec;
+attribute files;
+
+type net_foo_t, foo;
+type sys_foo_t, foo, system;
+role system_r;
+role system_r types sys_foo_t;
+
+type user_t, domain;
+role user_r;
+role user_r types user_t;
+
+type sysadm_t, domain, system;
+role sysadm_r;
+role sysadm_r types sysadm_t;
+
+type system_t, domain, system, foo;
+role system_r;
+role system_r types { system_t sys_foo_t };
+
+type file_t;
+type file_exec_t, files;
+type fs_t;
+type base_optional_1;
+type base_optional_2;
+
+allow sysadm_t file_exec_t: file { execute read write ioctl lock entrypoint };
+
+optional {
+	require {
+		type base_optional_1, base_optional_2;
+	}
+	allow base_optional_1 base_optional_2 : file { read write };
+}
+
+#####################################
+# Role Allow
+allow user_r sysadm_r;
+
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:sys_foo_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:sys_foo_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:net_foo_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-deps/modreq-attr-global.conf

@@ -0,0 +1,10 @@
+module modreq_attr_global 1.0;
+
+require { 
+	attribute attr_req;
+}
+
+type mod_global_t;
+
+type new_t, attr_req;
+

kernel/libsepol/tests/policies/test-deps/modreq-attr-opt.conf

@@ -0,0 +1,16 @@
+module modreq_attr_opt 1.0;
+
+require { 
+	class file {read write};
+	
+}
+
+type mod_global_t;
+
+optional {
+	require {
+		attribute attr_req;
+	}
+	type mod_opt_t;
+	type new_t, attr_req;
+}

kernel/libsepol/tests/policies/test-deps/modreq-bool-global.conf

@@ -0,0 +1,15 @@
+module modreq_bool_global 1.0;
+
+require { 
+	bool bool_req;
+	class file { read write };
+}
+
+type mod_global_t;
+
+type a_t;
+type b_t;
+
+if (bool_req) {
+	allow a_t b_t : file { read write };
+}

kernel/libsepol/tests/policies/test-deps/modreq-bool-opt.conf

@@ -0,0 +1,22 @@
+module modreq_bool_opt 1.0;
+
+require { 
+	class file {read write};
+	
+}
+
+type mod_global_t;
+
+optional {
+	require {
+		bool bool_req;
+	}
+	
+	type a_t;
+	type b_t;
+	type mod_opt_t;
+
+	if (bool_req) {
+		allow a_t b_t : file { read write };
+	}
+}

kernel/libsepol/tests/policies/test-deps/modreq-obj-global.conf

@@ -0,0 +1,13 @@
+module modreq_obj_global 1.0;
+
+require { 
+	class sem { create destroy };
+}
+
+type mod_global_t;
+
+type mod_foo_t;
+type mod_bar_t;
+
+allow mod_foo_t mod_bar_t : sem { create destroy };
+

kernel/libsepol/tests/policies/test-deps/modreq-obj-opt.conf

@@ -0,0 +1,20 @@
+module modreq_obj_global 1.0;
+
+require { 
+	class file { read };
+}
+
+type mod_global_t;
+
+type mod_foo_t;
+type mod_bar_t;
+
+optional {
+	require {
+		class sem { create destroy };
+	}
+	
+	type mod_opt_t;
+
+	allow mod_foo_t mod_bar_t : sem { create destroy };
+}

kernel/libsepol/tests/policies/test-deps/modreq-perm-global.conf

@@ -0,0 +1,10 @@
+module modreq_perm_global 1.0;
+
+require { 
+	class msg { send receive };
+}
+
+type mod_global_t;
+type a_t;
+type b_t;
+allow a_t b_t: msg { send receive };

kernel/libsepol/tests/policies/test-deps/modreq-perm-opt.conf

@@ -0,0 +1,18 @@
+module modreq_perm_opt 1.0;
+
+require { 
+	class file { read write };
+}
+
+type mod_global_t;
+
+optional {
+	require {
+		class msg { send receive };
+	}
+
+	type mod_opt_t;
+	type a_mod_t;
+	type b_mod_t;
+	allow a_mod_t b_mod_t: msg { send receive };
+}

kernel/libsepol/tests/policies/test-deps/modreq-role-global.conf

@@ -0,0 +1,13 @@
+module modreq_role_global 1.0;
+
+require { 
+	role role_req_r, user_r;
+}
+
+type mod_global_t;
+
+type a_t;
+
+# role role_req_r types a_t;
+allow role_req_r user_r;
+

kernel/libsepol/tests/policies/test-deps/modreq-role-opt.conf

@@ -0,0 +1,17 @@
+module modreq_role_opt 1.0;
+
+require { 
+	class file {read write};
+	
+}
+
+type mod_global_t;
+
+optional {
+	require {
+		role role_req_r, user_r;
+	}
+	type mod_opt_t;
+
+	allow role_req_r user_r;
+}

kernel/libsepol/tests/policies/test-deps/modreq-type-global.conf

@@ -0,0 +1,12 @@
+module modreq_type_global 1.0;
+
+require { 
+	type type_req_t;
+	class file { read write };
+}
+
+type mod_global_t;
+
+type test_t;
+
+allow test_t type_req_t : file { read write };

kernel/libsepol/tests/policies/test-deps/modreq-type-opt.conf

@@ -0,0 +1,16 @@
+module modreq_type_opt 1.0;
+
+require { 
+	type file_t;
+	class file { read write };
+}
+
+type mod_global_t;
+
+optional {
+	require {
+		type type_req_t;
+	}
+	type mod_opt_t;
+	allow type_req_t file_t : file { read write };
+}

kernel/libsepol/tests/policies/test-deps/module.conf

@@ -0,0 +1,20 @@
+module my_module 1.0;
+
+require { 
+	bool secure_mode;
+	type system_t, sysadm_t, file_t;
+	attribute domain;
+	role system_r;
+	class file {read write};
+	
+}
+
+type new_t, domain;
+role system_r types new_t;
+
+allow system_t file_t : file { read write };
+
+if (secure_mode)
+{
+	allow sysadm_t file_t : file { read write };
+}

kernel/libsepol/tests/policies/test-deps/small-base.conf

@@ -0,0 +1,511 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+# TE RULES
+attribute domain;
+attribute system;
+attribute foo;
+attribute num;
+attribute num_exec;
+attribute files;
+
+type net_foo_t, foo;
+type sys_foo_t, foo, system;
+role system_r types sys_foo_t;
+
+type user_t, domain;
+role user_r types user_t;
+
+type sysadm_t, domain, system;
+role sysadm_r types sysadm_t;
+
+type system_t, domain, system, foo;
+role system_r types { system_t sys_foo_t };
+
+type file_t;
+type file_exec_t, files;
+type fs_t;
+type base_optional_1;
+type base_optional_2;
+
+allow sysadm_t file_exec_t: file { execute read write ioctl lock entrypoint };
+
+optional {
+	require {
+		type base_optional_1, base_optional_2;
+	}
+	allow base_optional_1 base_optional_2 : file { read write };
+}
+
+#####################################
+# Role Allow
+allow user_r sysadm_r;
+
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:sys_foo_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:sys_foo_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:net_foo_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-expander/alias-base.conf

@@ -0,0 +1,501 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+type enable_optional;
+
+# Alias tests
+type alias_check_1_t;
+type alias_check_2_t;
+type alias_check_3_t;
+
+typealias alias_check_1_t alias alias_check_1_a;
+
+optional {
+	require {
+		type alias_check_2_t;
+	}
+	typealias alias_check_2_t alias alias_check_2_a;
+}
+
+optional {
+	require {
+		type alias_check_3_a;
+	}
+	allow alias_check_3_a enable_optional:file read;
+}
+
+########
+type fs_t;
+type system_t;
+type user_t;
+role system_r;
+role user_r;
+role sysadm_r;
+role system_r types system_t;
+role user_r types user_t;
+role sysadm_r types system_t;
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:system_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:system_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:system_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-expander/alias-module.conf

@@ -0,0 +1,8 @@
+module my_module 1.0;
+
+require { 
+	type alias_check_3_t;
+}
+
+typealias alias_check_3_t alias alias_check_3_a;
+

kernel/libsepol/tests/policies/test-expander/base-base-only.conf

@@ -0,0 +1,44 @@
+class security
+class file
+
+sid kernel
+
+common file
+{
+	read
+}
+
+class file
+inherits file
+{
+	entrypoint
+}
+
+class security
+{
+	compute_av
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+dominance { s0 }
+
+category c0;
+
+level s0:c0;
+
+mlsconstrain file { read }
+	( h1 dom h2 );
+')
+
+attribute myattr;
+type mytype_t;
+role myrole_r;
+role myrole_r types mytype_t;
+bool mybool true;
+gen_user(myuser_u,, myrole_r, s0, s0 - s0:c0)
+
+sid kernel	gen_context(myuser_u:myrole_r:mytype_t, s0)
+
+

kernel/libsepol/tests/policies/test-expander/module.conf

@@ -0,0 +1,228 @@
+module my_module 1.0;
+
+require { 
+	bool allow_ypbind, secure_mode, allow_execstack;
+	type system_t, sysadm_t;
+	class file {read write};
+	attribute attr_check_base_2, attr_check_base_3;
+	attribute attr_check_base_optional_2;
+}
+
+bool module_1_bool true;
+
+if (module_1_bool && allow_ypbind && secure_mode && allow_execstack) {
+	allow system_t sysadm_t : file { read write };
+}
+
+optional {
+	bool module_1_bool_2 false;
+	require {
+		bool optional_bool_1, optional_bool_2;
+		class file { execute ioctl };
+	}
+	if (optional_bool_1 && optional_bool_2 || module_1_bool_2) {
+		allow system_t sysadm_t : file {execute ioctl};
+	}
+}
+# Type - attribute mapping test
+type module_t;
+attribute attr_check_mod_1;
+attribute attr_check_mod_2;
+attribute attr_check_mod_3;
+attribute attr_check_mod_4;
+attribute attr_check_mod_5;
+attribute attr_check_mod_6;
+attribute attr_check_mod_7;
+attribute attr_check_mod_8;
+attribute attr_check_mod_9;
+attribute attr_check_mod_10;
+attribute attr_check_mod_11;
+optional {
+	require {
+		type base_t;
+	}
+	attribute attr_check_mod_optional_1;
+	attribute attr_check_mod_optional_2;
+	attribute attr_check_mod_optional_3;
+	attribute attr_check_mod_optional_4;
+	attribute attr_check_mod_optional_5;
+	attribute attr_check_mod_optional_6;
+	attribute attr_check_mod_optional_7;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	attribute attr_check_mod_optional_disabled_4;
+	attribute attr_check_mod_optional_disabled_7;
+}
+type attr_check_base_2_1_t, attr_check_base_2;
+type attr_check_base_2_2_t;
+typeattribute attr_check_base_2_2_t attr_check_base_2;
+type attr_check_base_3_3_t, attr_check_base_3;
+type attr_check_base_3_4_t;
+typeattribute attr_check_base_3_4_t attr_check_base_3;
+optional {
+	require {
+		attribute attr_check_base_5;
+	}
+	type attr_check_base_5_1_t, attr_check_base_5;
+	type attr_check_base_5_2_t;
+	typeattribute attr_check_base_5_2_t attr_check_base_5;
+}
+optional {
+	require {
+		attribute attr_check_base_6;
+	}
+	type attr_check_base_6_3_t, attr_check_base_6;
+	type attr_check_base_6_4_t;
+	typeattribute attr_check_base_6_4_t attr_check_base_6;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_base_8;
+	}
+	type attr_check_base_8_1_t, attr_check_base_8;
+	type attr_check_base_8_2_t;
+	typeattribute attr_check_base_8_2_t attr_check_base_8;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_base_9;
+	}
+	type attr_check_base_9_3_t, attr_check_base_9;
+	type attr_check_base_9_4_t;
+	typeattribute attr_check_base_9_4_t attr_check_base_9;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_base_10;
+	}
+	type attr_check_base_10_3_t, attr_check_base_10;
+	type attr_check_base_10_4_t;
+	typeattribute attr_check_base_10_4_t attr_check_base_10;
+}
+optional {
+	require {
+		attribute attr_check_base_11;
+	}
+	type attr_check_base_11_3_t, attr_check_base_11;
+	type attr_check_base_11_4_t;
+	typeattribute attr_check_base_11_4_t attr_check_base_11;
+}
+type attr_check_base_optional_2_1_t, attr_check_base_optional_2;
+type attr_check_base_optional_2_2_t;
+typeattribute attr_check_base_optional_2_2_t attr_check_base_optional_2;
+optional {
+	require {
+		attribute attr_check_base_optional_5;
+	}
+	type attr_check_base_optional_5_1_t, attr_check_base_optional_5;
+	type attr_check_base_optional_5_2_t;
+	typeattribute attr_check_base_optional_5_2_t attr_check_base_optional_5;
+}
+#optional {
+#	require {
+#		attribute attr_check_base_optional_6;
+#	}
+#	type attr_check_base_optional_6_3_t, attr_check_base_optional_6;
+#	type attr_check_base_optional_6_4_t;
+#	typeattribute attr_check_base_optional_6_4_t attr_check_base_optional_6;
+#}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_base_optional_8;
+	}
+	type attr_check_base_optional_8_1_t, attr_check_base_optional_8;
+	type attr_check_base_optional_8_2_t;
+	typeattribute attr_check_base_optional_8_2_t attr_check_base_optional_8;
+}
+type attr_check_mod_2_1_t, attr_check_mod_2;
+type attr_check_mod_2_2_t;
+typeattribute attr_check_mod_2_2_t attr_check_mod_2;
+optional {
+	require {
+		attribute attr_check_mod_5;
+	}
+	type attr_check_mod_5_1_t, attr_check_mod_5;
+	type attr_check_mod_5_2_t;
+	typeattribute attr_check_mod_5_2_t attr_check_mod_5;
+}
+optional {
+	require {
+		attribute attr_check_mod_6;
+	}
+	type attr_check_mod_6_3_t, attr_check_mod_6;
+	type attr_check_mod_6_4_t;
+	typeattribute attr_check_mod_6_4_t attr_check_mod_6;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	type attr_check_mod_8_1_t, attr_check_mod_8;
+	type attr_check_mod_8_2_t;
+	typeattribute attr_check_mod_8_2_t attr_check_mod_8;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	type attr_check_mod_9_3_t, attr_check_mod_9;
+	type attr_check_mod_9_4_t;
+	typeattribute attr_check_mod_9_4_t attr_check_mod_9;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	type attr_check_mod_10_3_t, attr_check_mod_10;
+	type attr_check_mod_10_4_t;
+	typeattribute attr_check_mod_10_4_t attr_check_mod_10;
+}
+optional {
+	require {
+		type base_t;
+	}
+	type attr_check_mod_11_3_t, attr_check_mod_11;
+	type attr_check_mod_11_4_t;
+	typeattribute attr_check_mod_11_4_t attr_check_mod_11;
+}
+#optional {
+#	require {
+#		attribute attr_check_mod_optional_5;
+#	}
+#	type attr_check_mod_optional_5_1_t, attr_check_mod_optional_5;
+#	type attr_check_mod_optional_5_2_t;
+#	typeattribute attr_check_mod_optional_5_2_t attr_check_mod_optional_5;
+#}
+#optional {
+#	require {
+#		attribute attr_check_mod_optional_6;
+#	}
+#	type attr_check_mod_optional_6_3_t, attr_check_mod_optional_6;
+#	type attr_check_mod_optional_6_4_t;
+#	typeattribute attr_check_mod_optional_6_4_t attr_check_mod_optional_6;
+#}
+optional {
+	require {
+		attribute attr_check_base_optional_disabled_5;
+	}
+	type attr_check_base_optional_disabled_5_1_t, attr_check_base_optional_disabled_5;
+	type attr_check_base_optional_disabled_5_2_t;
+	typeattribute attr_check_base_optional_disabled_5_2_t attr_check_base_optional_disabled_5;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_base_optional_disabled_8;
+	}
+	type attr_check_base_optional_disabled_8_1_t, attr_check_base_optional_disabled_8;
+	type attr_check_base_optional_disabled_8_2_t;
+	typeattribute attr_check_base_optional_disabled_8_2_t attr_check_base_optional_disabled_8;
+}
+

kernel/libsepol/tests/policies/test-expander/role-base.conf

@@ -0,0 +1,483 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+# Role mapping test
+type role_check_1_1_t;
+role role_check_1;
+role role_check_1 types role_check_1_1_t;
+
+########
+type fs_t;
+type system_t;
+type user_t;
+role system_r;
+role user_r;
+role sysadm_r;
+role system_r types system_t;
+role user_r types user_t;
+role sysadm_r types system_t;
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:system_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:system_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:system_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-expander/role-module.conf

@@ -0,0 +1,9 @@
+module my_module 1.0;
+
+require { 
+	class file {read write};
+	role role_check_1;
+}
+
+type role_check_1_2_t;
+role role_check_1 types role_check_1_2_t;

kernel/libsepol/tests/policies/test-expander/small-base.conf

@@ -0,0 +1,721 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+# TE RULES
+attribute domain;
+attribute system;
+attribute foo;
+attribute num;
+attribute num_exec;
+attribute files;
+
+# Type - attribute mapping test
+# Shorthand tests
+# 1 = types in base, 2 = types in mod, 3 = types in both
+# 4 = types in optional in base, 5 = types in optional in mod
+# 6 = types in optional in both
+# 7 = types in disabled optional in base
+# 8 = types in disabled optional in module
+# 9 = types in disabled optional in both
+# 10 = types in enabled optional in base, disabled optional in module
+# 11 = types in disabled optional in base, enabled optional in module
+attribute attr_check_base_1;
+attribute attr_check_base_2;
+attribute attr_check_base_3;
+attribute attr_check_base_4;
+attribute attr_check_base_5;
+attribute attr_check_base_6;
+attribute attr_check_base_7;
+attribute attr_check_base_8;
+attribute attr_check_base_9;
+attribute attr_check_base_10;
+attribute attr_check_base_11;
+optional {
+	require {
+		type module_t;
+	}
+	attribute attr_check_base_optional_1;
+	attribute attr_check_base_optional_2;
+	attribute attr_check_base_optional_3;
+	attribute attr_check_base_optional_4;
+	attribute attr_check_base_optional_5;
+	attribute attr_check_base_optional_6;
+	attribute attr_check_base_optional_8;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	attribute attr_check_base_optional_disabled_5;
+	attribute attr_check_base_optional_disabled_8;
+}
+
+type net_foo_t, foo;
+type sys_foo_t, foo, system;
+role system_r;
+role system_r types sys_foo_t;
+
+type user_t, domain;
+role user_r;
+role user_r types user_t;
+
+type sysadm_t, domain, system;
+role sysadm_r;
+role sysadm_r types sysadm_t;
+
+type system_t, domain, system, foo;
+role system_r types { system_t sys_foo_t };
+
+type file_t;
+type file_exec_t, files;
+type fs_t;
+type base_optional_1;
+type base_optional_2;
+
+allow sysadm_t file_exec_t: file { execute read write ioctl lock entrypoint };
+
+optional {
+	require {
+		type base_optional_1, base_optional_2;
+	}
+	allow base_optional_1 base_optional_2 : file { read write };
+}
+
+# Type - attribute mapping test
+type base_t;
+type attr_check_base_1_1_t, attr_check_base_1;
+type attr_check_base_1_2_t;
+typeattribute attr_check_base_1_2_t attr_check_base_1;
+type attr_check_base_3_1_t, attr_check_base_3;
+type attr_check_base_3_2_t;
+typeattribute attr_check_base_3_2_t attr_check_base_3;
+optional {
+	require {
+		attribute attr_check_base_4;
+	}
+	type attr_check_base_4_1_t, attr_check_base_4;
+	type attr_check_base_4_2_t;
+	typeattribute attr_check_base_4_2_t attr_check_base_4;
+}
+optional {
+	require {
+		type module_t;
+	}
+	type attr_check_base_6_1_t, attr_check_base_6;
+	type attr_check_base_6_2_t;
+	typeattribute attr_check_base_6_2_t attr_check_base_6;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	type attr_check_base_7_1_t, attr_check_base_7;
+	type attr_check_base_7_2_t;
+	typeattribute attr_check_base_7_2_t attr_check_base_7;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	type attr_check_base_9_1_t, attr_check_base_9;
+	type attr_check_base_9_2_t;
+	typeattribute attr_check_base_9_2_t attr_check_base_9;
+}
+optional {
+	require {
+		type module_t;
+	}
+	type attr_check_base_10_1_t, attr_check_base_10;
+	type attr_check_base_10_2_t;
+	typeattribute attr_check_base_10_2_t attr_check_base_10;
+}
+optional {
+	require {
+		type does_not_exist_t;
+	}
+	type attr_check_base_11_1_t, attr_check_base_11;
+	type attr_check_base_11_2_t;
+	typeattribute attr_check_base_11_2_t attr_check_base_11;
+}
+#optional {
+#	require {
+#		attribute attr_check_base_optional_4;
+#	}
+#	type attr_check_base_optional_4_1_t, attr_check_base_optional_4;
+#	type attr_check_base_optional_4_2_t;
+#	typeattribute attr_check_base_optional_4_2_t attr_check_base_optional_4;
+#}
+#optional {
+#	require {
+#		attribute attr_check_base_optional_6;
+#	}
+#	type attr_check_base_optional_6_1_t, attr_check_base_optional_6;
+#	type attr_check_base_optional_6_2_t;
+#	typeattribute attr_check_base_optional_6_2_t attr_check_base_optional_6;
+#}
+optional {
+	require {
+		attribute attr_check_mod_4;
+	}
+	type attr_check_mod_4_1_t, attr_check_mod_4;
+	type attr_check_mod_4_2_t;
+	typeattribute attr_check_mod_4_2_t attr_check_mod_4;
+}
+optional {
+	require {
+		attribute attr_check_mod_6;
+	}
+	type attr_check_mod_6_1_t, attr_check_mod_6;
+	type attr_check_mod_6_2_t;
+	typeattribute attr_check_mod_6_2_t attr_check_mod_6;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_mod_7;
+	}
+	type attr_check_mod_7_1_t, attr_check_mod_7;
+	type attr_check_mod_7_2_t;
+	typeattribute attr_check_mod_7_2_t attr_check_mod_7;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_mod_9;
+	}
+	type attr_check_mod_9_1_t, attr_check_mod_9;
+	type attr_check_mod_9_2_t;
+	typeattribute attr_check_mod_9_2_t attr_check_mod_9;
+}
+optional {
+	require {
+		attribute attr_check_mod_10;
+	}
+	type attr_check_mod_10_1_t, attr_check_mod_10;
+	type attr_check_mod_10_2_t;
+	typeattribute attr_check_mod_10_2_t attr_check_mod_10;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_mod_11;
+	}
+	type attr_check_mod_11_1_t, attr_check_mod_11;
+	type attr_check_mod_11_2_t;
+	typeattribute attr_check_mod_11_2_t attr_check_mod_11;
+}
+optional {
+	require {
+		attribute attr_check_mod_optional_4;
+	}
+	type attr_check_mod_optional_4_1_t, attr_check_mod_optional_4;
+	type attr_check_mod_optional_4_2_t;
+	typeattribute attr_check_mod_optional_4_2_t attr_check_mod_optional_4;
+}
+optional {
+	require {
+		attribute attr_check_mod_optional_6;
+	}
+	type attr_check_mod_optional_6_1_t, attr_check_mod_optional_6;
+	type attr_check_mod_optional_6_2_t;
+	typeattribute attr_check_mod_optional_6_2_t attr_check_mod_optional_6;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_mod_optional_7;
+	}
+	type attr_check_mod_optional_7_1_t, attr_check_mod_optional_7;
+	type attr_check_mod_optional_7_2_t;
+	typeattribute attr_check_mod_optional_7_2_t attr_check_mod_optional_7;
+}
+optional {
+	require {
+		attribute attr_check_mod_optional_disabled_4;
+	}
+	type attr_check_mod_optional_disabled_4_1_t, attr_check_mod_optional_disabled_4;
+	type attr_check_mod_optional_disabled_4_2_t;
+	typeattribute attr_check_mod_optional_disabled_4_2_t attr_check_mod_optional_disabled_4;
+}
+optional {
+	require {
+		type does_not_exist_t;
+		attribute attr_check_mod_optional_disabled_7;
+	}
+	type attr_check_mod_optional_disabled_7_1_t, attr_check_mod_optional_disabled_7;
+	type attr_check_mod_optional_disabled_7_2_t;
+	typeattribute attr_check_mod_optional_disabled_7_2_t attr_check_mod_optional_disabled_7;
+}
+
+#####################################
+# Role Allow
+allow user_r sysadm_r;
+
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:sys_foo_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:sys_foo_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:net_foo_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-expander/user-base.conf

@@ -0,0 +1,487 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+# User mapping test
+type user_check_1_1_t;
+type user_check_1_2_t;
+role user_check_1_1_r;
+role user_check_1_2_r;
+role user_check_1_1_r types user_check_1_1_t;
+role user_check_1_2_r types user_check_1_2_t;
+
+########
+type fs_t;
+type system_t;
+type user_t;
+role system_r;
+role user_r;
+role sysadm_r;
+role system_r types system_t;
+role user_r types user_t;
+role sysadm_r types system_t;
+####################################
+# Booleans
+bool allow_ypbind true;
+bool secure_mode false;
+bool allow_execheap false;
+bool allow_execmem true;
+bool allow_execmod false;
+bool allow_execstack true;
+bool optional_bool_1 true;
+bool optional_bool_2 false;
+
+#####################################
+# users
+gen_user(user_check_1,, user_check_1_1_r user_check_1_2_r, s0, s0 - s0:c0.c23)
+gen_user(system_u,, system_r, s0, s0 - s0:c0.c23)
+gen_user(root,, user_r sysadm_r, s0, s0 - s0:c0.c23)
+gen_user(joe,, user_r, s0, s0 - s0:c0.c23)
+
+#####################################
+# constraints
+
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(system_u:system_r:system_t, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr ext3 gen_context(system_u:object_r:fs_t, s0);
+fs_use_xattr reiserfs gen_context(system_u:object_r:fs_t, s0);
+
+
+genfscon proc /				gen_context(system_u:object_r:system_t, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 system_u:object_r:net_foo_t:s0
+
+#netifcon lo system_u:object_r:net_foo_t system_u:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 system_u:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(system_u:object_r:system_t, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-expander/user-module.conf

@@ -0,0 +1,9 @@
+module my_module 1.0;
+
+require { 
+	class file {read write};
+ifdef(`enable_mls',`
+	user user_check_1;
+')
+}
+

kernel/libsepol/tests/policies/test-hooks/cmp_policy.conf

@@ -0,0 +1,471 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+
+#g_b stands for global base
+
+type g_b_type_1;
+role g_b_role_1 types g_b_type_1;
+
+role g_b_role_2 types g_b_type_1;
+role g_b_role_3 types g_b_type_1;
+type g_b_type_2;
+
+optional {
+	require {
+		type invalid_type;
+	}
+	allow g_b_role_2 g_b_role_3;
+	role_transition g_b_role_2 g_b_type_2 g_b_role_3;
+}	
+
+
+gen_user(g_b_user_1,, g_b_role_1, s0, s0 - s0:c0.c23)
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(g_b_user_1:g_b_role_1:g_b_type_1, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+fs_use_xattr ext3 gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+fs_use_xattr reiserfs gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+
+
+genfscon proc /				gen_context(g_b_user_1:object_r:g_b_type_1, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 g_b_user_1:object_r:net_foo_t:s0
+
+#netifcon lo g_b_user_1:object_r:net_foo_t g_b_user_1:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 g_b_user_1:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(g_b_user_1:object_r:g_b_type_1, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-hooks/module_add_role_allow_trans.conf

@@ -0,0 +1,15 @@
+module add_symbol_test 1.0;
+
+require { class file { read }; }
+
+role role_a_1;
+role role_a_2;
+role role_t_1;
+role role_t_2;
+
+type type_rt_1;
+
+
+allow role_a_1 role_a_2;
+
+role_transition role_t_1 type_rt_1 role_t_2;

kernel/libsepol/tests/policies/test-hooks/module_add_symbols.conf

@@ -0,0 +1,12 @@
+module add_symbol_test 1.0;
+
+require { class file { read write }; }
+
+type type_add_1;
+attribute attrib_add_1;
+role role_add_1;
+bool bool_add_1 false;
+
+ifdef(`enable_mls',`',`
+user user_add_1 roles { role_add_1 };
+')

kernel/libsepol/tests/policies/test-hooks/small-base.conf

@@ -0,0 +1,471 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+
+#g_b stands for global base
+
+type g_b_type_1;
+role g_b_role_1 types g_b_type_1;
+
+role g_b_role_2 types g_b_type_1;
+role g_b_role_3 types g_b_type_1;
+type g_b_type_2;
+
+optional {
+	require {
+		type invalid_type;
+	}
+	allow g_b_role_2 g_b_role_3;
+	role_transition g_b_role_2 g_b_type_2 g_b_role_3;
+}	
+
+
+gen_user(g_b_user_1,, g_b_role_1, s0, s0 - s0:c0.c23)
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(g_b_user_1:g_b_role_1:g_b_type_1, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+fs_use_xattr ext3 gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+fs_use_xattr reiserfs gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+
+
+genfscon proc /				gen_context(g_b_user_1:object_r:g_b_type_1, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 g_b_user_1:object_r:net_foo_t:s0
+
+#netifcon lo g_b_user_1:object_r:net_foo_t g_b_user_1:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 g_b_user_1:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(g_b_user_1:object_r:g_b_type_1, s0)
+
+
+
+

kernel/libsepol/tests/policies/test-linker/module1.conf

@@ -0,0 +1,145 @@
+module linker_test_1 1.0;
+
+require { 
+	class file { read write };
+	class lnk_file append;
+	role g_b_role_2;
+	attribute g_b_attr_3;
+	attribute g_b_attr_5;
+	attribute o4_b_attr_1;
+	type g_b_type_3;
+}
+
+type tag_g_m1;
+
+#test for type in module and attr in module, added to in module
+attribute g_m1_attr_1;
+type g_m1_type_1, g_m1_attr_1;
+type g_m1_type_2;
+typeattribute g_m1_type_2 g_m1_attr_1;
+
+#add role in module test
+role g_m1_role_1;
+role g_m1_role_1 types g_m1_type_1;
+
+# test for attr declared in base, added to in module
+type g_m1_type_3;
+typeattribute g_m1_type_3 g_b_attr_3;
+
+# test for attr declared in base, added to in 2 modules
+type g_m1_type_4;
+typeattribute g_m1_type_4 g_b_attr_5;
+
+# test for attr declared in base optional, added to in module
+type g_m1_type_5;
+typeattribute g_m1_type_5 o4_b_attr_1;
+
+# test for attr declared in module, added to in base optional
+attribute g_m1_attr_2;
+
+#add type to base role test
+role g_b_role_2 types g_m1_type_1;
+role g_b_role_3;
+role g_b_role_3 types g_m1_type_2;
+
+#add type to base optional role test
+role o1_b_role_2;
+role o1_b_role_2 types g_m1_type_1;
+
+#optional base role w/ adds in 2 modules
+role o4_b_role_1;
+role o4_b_role_1 types g_m1_type_2;
+
+# attr a added to in base optional, declared/added to in module, added to in other module
+attribute g_m1_attr_3;
+type g_m1_type_6, g_m1_attr_3;
+
+# attr a added to in base optional, declared/added in module , added to in other module optional
+attribute g_m1_attr_4;
+type g_m1_type_7, g_m1_attr_4;
+
+# alias tests
+typealias g_b_type_3 alias g_m_alias_1;
+
+# single boolean in module
+bool g_m1_bool_1 true;
+if (g_m1_bool_1) {
+	allow g_m1_type_1 g_m1_type_2 : lnk_file append;
+}
+
+
+optional {
+	require {
+		type optional_type;
+		attribute g_b_attr_4;
+		attribute o1_b_attr_2;
+		class lnk_file { ioctl };
+	}
+
+	type tag_o1_m1;
+
+	attribute o1_m1_attr_1;
+	type o1_m1_type_2, o1_m1_attr_1;
+	
+	type o1_m1_type_1;
+	role o1_m1_role_1;
+	role o1_m1_role_1 types o1_m1_type_1;
+
+	type o1_m1_type_3;
+	typeattribute o1_m1_type_3 g_b_attr_4;
+
+	type o1_m1_type_5;
+	typeattribute o1_m1_type_5 o1_b_attr_2;	
+
+	bool o1_m1_bool_1 false;
+	if (o1_m1_bool_1) {
+		allow o1_m1_type_2 o1_m1_type_1 : lnk_file ioctl;
+	}
+	
+}
+
+optional {
+	require {
+		type optional_type;
+		#role g_b_role_4; // This causes a bug where the role scope doesn't get copied into base
+	}
+	
+	type tag_o2_m1;
+
+	role g_b_role_4;
+	role g_b_role_4 types g_m1_type_2;
+}
+
+optional {
+	require {
+		attribute g_b_attr_6;
+	}
+
+	type tag_o3_m1;
+
+	type o3_m1_type_1;	
+	role o3_b_role_1;
+        role o3_b_role_1 types o3_m1_type_1;
+
+	type o3_m1_type_2, g_b_attr_6;
+
+	attribute o3_m1_attr_1;	
+
+	# attr a added to in base optional, declared/added in module optional, added to in other module
+	attribute o3_m1_attr_2;
+	type o3_m1_type_3, o3_m1_attr_2;
+
+}
+
+optional {
+	require {
+		type enable_optional;
+	}
+	type tag_o4_m1;
+
+	attribute o4_m1_attr_1;
+	type o4_m1_type_1;
+	typeattribute o4_m1_type_1 o4_m1_attr_1;
+
+
+}

kernel/libsepol/tests/policies/test-linker/module2.conf

@@ -0,0 +1,66 @@
+module linker_test_2 1.0;
+
+require { 
+	class file { read write };
+	class lnk_file { unlink };
+	attribute g_b_attr_5;
+	attribute g_b_attr_6;
+	attribute g_m1_attr_3;
+	attribute o3_m1_attr_2;
+}
+
+type tag_g_m2;
+
+type g_m2_type_1;
+role g_m2_role_1;
+role g_m2_role_1 types g_m2_type_1;
+
+type g_m2_type_4, g_b_attr_5;
+type g_m2_type_5, g_b_attr_6;
+
+#add types to role declared in base test
+type g_m2_type_2;
+role g_b_role_3;
+role g_b_role_3 types g_m2_type_2;
+
+#optional base role w/ adds in 2 modules
+role o4_b_role_1;
+role o4_b_role_1 types g_m2_type_1;
+
+# attr a added to in base optional, declared/added to in module, added to in other module
+type g_m2_type_3, g_m1_attr_3;
+
+# attr a added to in base optional, declared/added in module optional, added to in other module
+type g_m2_type_6, o3_m1_attr_2;
+
+# cond mapping tests
+bool g_m2_bool_1 true;
+bool g_m2_bool_2 false;
+if (g_m2_bool_1 && g_m2_bool_2) {
+	allow g_m2_type_1 g_m2_type_2 : lnk_file unlink;
+}
+
+optional {
+	require {
+		type optional_type;
+	}
+
+	type tag_o1_m2;
+
+	type o1_m2_type_1;
+	role o1_m2_role_1;
+	role o1_m2_role_1 types o1_m2_type_1;
+}
+
+
+optional {
+	require {
+		attribute g_m1_attr_4;
+		attribute o4_m1_attr_1;
+	}
+	type tag_o2_m2;
+
+	type o2_m2_type_1, g_m1_attr_4;
+	type o2_m2_type_2, o4_m1_attr_1;
+
+}

kernel/libsepol/tests/policies/test-linker/small-base.conf

@@ -0,0 +1,600 @@
+# FLASK
+
+#
+# Define the security object classes 
+#
+
+class security
+class process
+class system
+class capability
+
+# file-related classes
+class filesystem
+class file
+class dir
+class fd
+class lnk_file
+class chr_file
+class blk_file
+class sock_file
+class fifo_file
+
+# network-related classes
+class socket
+class tcp_socket
+class udp_socket
+class rawip_socket
+class node
+class netif
+class netlink_socket
+class packet_socket
+class key_socket
+class unix_stream_socket
+class unix_dgram_socket
+
+# sysv-ipc-related clases
+class sem
+class msg
+class msgq
+class shm
+class ipc
+
+# FLASK
+# FLASK
+
+#
+# Define initial security identifiers 
+#
+
+sid kernel
+
+
+# FLASK
+#
+# Define common prefixes for access vectors
+#
+# common common_name { permission_name ... }
+
+
+#
+# Define a common prefix for file access vectors.
+#
+
+common file
+{
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+	unlink
+	link
+	rename
+	execute
+	swapon
+	quotaon
+	mounton
+}
+
+
+#
+# Define a common prefix for socket access vectors.
+#
+
+common socket
+{
+# inherited from file
+	ioctl
+	read
+	write
+	create
+	getattr
+	setattr
+	lock
+	relabelfrom
+	relabelto
+	append
+# socket-specific
+	bind
+	connect
+	listen
+	accept
+	getopt
+	setopt
+	shutdown
+	recvfrom
+	sendto
+	recv_msg
+	send_msg
+	name_bind
+}	
+
+#
+# Define a common prefix for ipc access vectors.
+#
+
+common ipc
+{
+	create
+	destroy
+	getattr
+	setattr
+	read
+	write
+	associate
+	unix_read
+	unix_write
+}
+
+#
+# Define the access vectors.
+#
+# class class_name [ inherits common_name ] { permission_name ... }
+
+
+#
+# Define the access vector interpretation for file-related objects.
+#
+
+class filesystem
+{
+	mount
+	remount
+	unmount
+	getattr
+	relabelfrom
+	relabelto
+	transition
+	associate
+	quotamod
+	quotaget
+}
+
+class dir
+inherits file
+{
+	add_name
+	remove_name
+	reparent
+	search
+	rmdir
+}
+
+class file
+inherits file
+{
+	execute_no_trans
+	entrypoint
+}
+
+class lnk_file
+inherits file
+
+class chr_file
+inherits file
+
+class blk_file
+inherits file
+
+class sock_file
+inherits file
+
+class fifo_file
+inherits file
+
+class fd
+{
+	use
+}
+
+
+#
+# Define the access vector interpretation for network-related objects.
+#
+
+class socket
+inherits socket
+
+class tcp_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class udp_socket
+inherits socket
+
+class rawip_socket
+inherits socket
+
+class node 
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+	enforce_dest
+}
+
+class netif
+{
+	tcp_recv
+	tcp_send
+	udp_recv
+	udp_send
+	rawip_recv
+	rawip_send
+}
+
+class netlink_socket
+inherits socket
+
+class packet_socket
+inherits socket
+
+class key_socket
+inherits socket
+
+class unix_stream_socket
+inherits socket
+{
+	connectto
+	newconn
+	acceptfrom
+}
+
+class unix_dgram_socket
+inherits socket
+
+
+#
+# Define the access vector interpretation for process-related objects
+#
+
+class process
+{
+	fork
+	transition
+	sigchld # commonly granted from child to parent
+	sigkill # cannot be caught or ignored
+	sigstop # cannot be caught or ignored
+	signull # for kill(pid, 0)
+	signal  # all other signals
+	ptrace
+	getsched
+	setsched
+	getsession
+	getpgid
+	setpgid
+	getcap
+	setcap
+	share
+}
+
+
+#
+# Define the access vector interpretation for ipc-related objects
+#
+
+class ipc
+inherits ipc
+
+class sem
+inherits ipc
+
+class msgq
+inherits ipc
+{
+	enqueue
+}
+
+class msg
+{
+	send
+	receive
+}
+
+class shm
+inherits ipc
+{
+	lock
+}
+
+
+#
+# Define the access vector interpretation for the security server. 
+#
+
+class security
+{
+	compute_av
+	transition_sid
+	member_sid
+	sid_to_context
+	context_to_sid
+	load_policy
+	get_sids
+	change_sid
+	get_user_sids
+}
+
+
+#
+# Define the access vector interpretation for system operations.
+#
+
+class system
+{
+	ipc_info
+	avc_toggle
+	nfsd_control
+	bdflush
+	syslog_read
+	syslog_mod
+	syslog_console
+	ichsid
+}
+
+#
+# Define the access vector interpretation for controlling capabilities
+#
+
+class capability
+{
+	# The capabilities are defined in include/linux/capability.h
+	# Care should be taken to ensure that these are consistent with
+	# those definitions. (Order matters)
+
+	chown           
+	dac_override    
+	dac_read_search 
+	fowner          
+	fsetid          
+	kill            
+	setgid           
+	setuid           
+	setpcap          
+	linux_immutable  
+	net_bind_service 
+	net_broadcast    
+	net_admin        
+	net_raw          
+	ipc_lock         
+	ipc_owner        
+	sys_module       
+	sys_rawio        
+	sys_chroot       
+	sys_ptrace       
+	sys_pacct        
+	sys_admin        
+	sys_boot         
+	sys_nice         
+	sys_resource     
+	sys_time         
+	sys_tty_config  
+	mknod
+	lease
+}
+
+ifdef(`enable_mls',`
+sensitivity s0;
+
+#
+# Define the ordering of the sensitivity levels (least to greatest)
+#
+dominance { s0 }
+
+
+#
+# Define the categories
+#
+# Each category has a name and zero or more aliases.
+#
+category c0; category c1; category c2; category c3;
+category c4; category c5; category c6; category c7;
+category c8; category c9; category c10; category c11;
+category c12; category c13; category c14; category c15;
+category c16; category c17; category c18; category c19;
+category c20; category c21; category c22; category c23;
+
+level s0:c0.c23;
+
+mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
+	( h1 dom h2 );
+')
+
+####################################
+####################################
+#####################################
+
+#g_b stands for global base
+
+type enable_optional;
+
+#decorative type for finding this decl, every block should have one
+type tag_g_b;
+
+attribute g_b_attr_1;
+attribute g_b_attr_2;
+attribute g_b_attr_3;
+attribute g_b_attr_4;
+attribute g_b_attr_5;
+attribute g_b_attr_6;
+
+type g_b_type_1, g_b_attr_1;
+type g_b_type_2, g_b_attr_2;
+type g_b_type_3;
+
+role g_b_role_1;
+role g_b_role_2;
+role g_b_role_3;
+role g_b_role_4;
+role g_b_role_1 types g_b_type_1;
+role g_b_role_2 types g_b_type_2;
+role g_b_role_3 types g_b_type_2;
+role g_b_role_4 types g_b_type_2;
+
+bool g_b_bool_1 false;
+bool g_b_bool_2 true;
+
+allow g_b_type_1 g_b_type_2 : security { compute_av load_policy };
+allow g_b_type_1 g_b_type_2 : file *; # test *
+allow g_b_type_1 g_b_type_2 : process ~ptrace; #test ~
+
+typealias g_b_type_3 alias g_b_alias_1;
+
+if (g_b_bool_1) {
+	allow g_b_type_1 g_b_type_2: lnk_file read;
+}
+
+
+optional {
+	require {
+		type enable_optional;
+		attribute g_m1_attr_2;
+	}
+	type tag_o1_b;
+
+	attribute o1_b_attr_1;
+	type o1_b_type_1, o1_b_attr_1;
+	bool o1_b_bool_1 true;
+	role o1_b_role_1;
+	role o1_b_role_1 types o1_b_type_1;
+	role o1_b_role_2;
+	role o1_b_role_2 types o1_b_type_1;
+
+	attribute o1_b_attr_2;
+
+	type o1_b_type_2, g_m1_attr_2;
+
+	if (o1_b_bool_1) {
+		allow o1_b_type_1 o1_b_type_2: lnk_file write;
+	}
+	
+}
+
+optional {
+	require {
+		# this should be activated by module 1
+		type g_m1_type_1;
+		attribute o3_m1_attr_2;
+	}	
+	type tag_o2_b;	
+
+	type o2_b_type_1, o3_m1_attr_2;
+}
+
+optional {
+	require {
+		#this block should not come on
+		type invalid_type;
+	}
+	type tag_o3_b;
+
+
+	attribute o3_b_attr_1;
+	type o3_b_type_1;
+	bool o3_b_bool_1 true;
+
+	role o3_b_role_1;
+	role o3_b_role_1 types o3_b_type_1;
+
+	allow g_b_type_1 invalid_type : sem { create destroy };
+}
+
+optional {
+	require {
+		# also should be enabled by module 1
+		type enable_optional;
+		type g_m1_type_1;
+		attribute o3_m1_attr_1;
+		attribute g_m1_attr_3;
+	}
+	
+	type tag_o4_b;
+
+	attribute o4_b_attr_1;
+
+	role o4_b_role_1;
+	role o4_b_role_1 types g_m1_type_1;
+
+	# test for attr declared in module optional, added to in base optional
+	type o4_b_type_1, o3_m1_attr_1;
+
+	type o4_b_type_2, g_m1_attr_3;
+}
+
+optional {
+	require {
+		attribute g_m1_attr_4;
+		attribute o4_m1_attr_1;
+	}
+	type tag_o5_b;
+
+	type o5_b_type_1, g_m1_attr_4;
+	type o5_b_type_2, o4_m1_attr_1;
+}
+
+optional {
+	require {
+		type enable_optional;
+	}
+	type tag_o6_b;
+
+	typealias g_b_type_3 alias g_b_alias_2;
+}
+
+optional {
+	require {
+		type g_m_alias_1;
+	}
+	type tag_o7_b;
+
+	allow g_m_alias_1 enable_optional:file read;
+}
+
+gen_user(g_b_user_1,, g_b_role_1, s0, s0 - s0:c0.c23)
+gen_user(g_b_user_2,, g_b_role_1, s0, s0 - s0:c0, c1, c3, c4, c5)
+
+####################################
+#line 1 "initial_sid_contexts"
+
+sid kernel	gen_context(g_b_user_1:g_b_role_1:g_b_type_1, s0)
+
+
+############################################
+#line 1 "fs_use"
+#
+fs_use_xattr ext2 gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+fs_use_xattr ext3 gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+fs_use_xattr reiserfs gen_context(g_b_user_1:object_r:g_b_type_1, s0);
+
+
+genfscon proc /				gen_context(g_b_user_1:object_r:g_b_type_1, s0)
+
+
+####################################
+#line 1 "net_contexts"
+
+#portcon tcp 21 g_b_user_1:object_r:net_foo_t:s0
+
+#netifcon lo g_b_user_1:object_r:net_foo_t g_b_user_1:object_r:net_foo_t:s0
+
+#
+#nodecon 127.0.0.1 255.255.255.255 g_b_user_1:object_r:net_foo_t:s0
+
+nodecon ::1 FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF gen_context(g_b_user_1:object_r:g_b_type_1, s0)
+
+
+
+

kernel/libsepol/tests/test-common.c

@@ -0,0 +1,265 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *         Chad Sellers <csellers@tresys.com>
+ *         Chris PeBenito <cpebenito@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This has tests that are common between test suites*/
+
+#include <sepol/policydb/avrule_block.h>
+
+#include <CUnit/Basic.h>
+
+#include "test-common.h"
+#include "helpers.h"
+
+void test_sym_presence(policydb_t * p, const char *id, int sym_type, unsigned int scope_type, unsigned int *decls, unsigned int len)
+{
+	scope_datum_t *scope;
+	int found;
+	unsigned int i, j;
+	/* make sure it is in global symtab */
+	if (!hashtab_search(p->symtab[sym_type].table, id)) {
+		fprintf(stderr, "symbol %s not found in table %d\n", id, sym_type);
+		CU_FAIL_FATAL();
+	}
+	/* make sure its scope is correct */
+	scope = hashtab_search(p->scope[sym_type].table, id);
+	CU_ASSERT_FATAL(scope != NULL);
+	CU_ASSERT(scope->scope == scope_type);
+	CU_ASSERT(scope->decl_ids_len == len);
+	if (scope->decl_ids_len != len)
+		fprintf(stderr, "sym %s has %d decls, %d expected\n", id, scope->decl_ids_len, len);
+	for (i = 0; i < len; i++) {
+		found = 0;
+		for (j = 0; j < len; j++) {
+			if (decls[i] == scope->decl_ids[j])
+				found++;
+		}
+		CU_ASSERT(found == 1);
+	}
+
+}
+
+static int common_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	common_datum_t *d = (common_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_COMMONS][d->s.value - 1] == (char *)key);
+	return 0;
+}
+
+static int class_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	class_datum_t *d = (class_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_CLASSES][d->s.value - 1] == (char *)key);
+	CU_ASSERT(p->class_val_to_struct[d->s.value - 1] == d);
+	return 0;
+}
+
+static int role_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	role_datum_t *d = (role_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_ROLES][d->s.value - 1] == (char *)key);
+	CU_ASSERT(p->role_val_to_struct[d->s.value - 1] == d);
+	return 0;
+}
+
+static int type_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	type_datum_t *d = (type_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	if (!d->primary)
+		return 0;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_TYPES][d->s.value - 1] == (char *)key);
+	CU_ASSERT(p->type_val_to_struct[d->s.value - 1] == d);
+
+	return 0;
+}
+
+static int user_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	user_datum_t *d = (user_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_USERS][d->s.value - 1] == (char *)key);
+	CU_ASSERT(p->user_val_to_struct[d->s.value - 1] == d);
+	return 0;
+}
+
+static int cond_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	cond_bool_datum_t *d = (cond_bool_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_BOOLS][d->s.value - 1] == (char *)key);
+	CU_ASSERT(p->bool_val_to_struct[d->s.value - 1] == d);
+	return 0;
+}
+
+static int level_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	level_datum_t *d = (level_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_LEVELS][d->level->sens - 1] == (char *)key);
+	return 0;
+}
+
+static int cat_test_index(hashtab_key_t key, hashtab_datum_t datum, void *data)
+{
+	cat_datum_t *d = (cat_datum_t *) datum;
+	policydb_t *p = (policydb_t *) data;
+
+	CU_ASSERT(p->sym_val_to_name[SYM_CATS][d->s.value - 1] == (char *)key);
+	return 0;
+}
+
+static int (*test_index_f[SYM_NUM]) (hashtab_key_t key, hashtab_datum_t datum, void *p) = {
+common_test_index, class_test_index, role_test_index, type_test_index, user_test_index, cond_test_index, level_test_index, cat_test_index,};
+
+void test_policydb_indexes(policydb_t * p)
+{
+	int i;
+
+	for (i = 0; i < SYM_NUM; i++) {
+		ksu_hashtab_map(p->symtab[i].table, test_index_f[i], p);
+	}
+}
+
+void test_alias_datum(policydb_t * p, const char *id, const char *primary_id, char mode, unsigned int flavor)
+{
+	type_datum_t *type, *primary;
+	unsigned int my_primary, my_flavor, my_value;
+
+	type = hashtab_search(p->p_types.table, id);
+	primary = hashtab_search(p->p_types.table, primary_id);
+
+	CU_ASSERT_PTR_NOT_NULL(type);
+	CU_ASSERT_PTR_NOT_NULL(primary);
+
+	if (type && primary) {
+		if (mode) {
+			my_flavor = type->flavor;
+		} else {
+			my_flavor = flavor;
+		}
+
+		if (my_flavor == TYPE_TYPE) {
+			my_primary = 0;
+			my_value = primary->s.value;
+		} else {
+			CU_ASSERT(my_flavor == TYPE_ALIAS);
+			my_primary = primary->s.value;
+			CU_ASSERT_NOT_EQUAL(type->s.value, primary->s.value);
+			my_value = type->s.value;
+		}
+
+		CU_ASSERT(type->primary == my_primary);
+		CU_ASSERT(type->flavor == my_flavor);
+		CU_ASSERT(type->s.value == my_value);
+	}
+}
+
+role_datum_t *test_role_type_set(policydb_t * p, const char *id, avrule_decl_t * decl, const char **types, unsigned int len, unsigned int flags)
+{
+	ebitmap_node_t *tnode;
+	unsigned int i, j, new, found = 0;
+	role_datum_t *role;
+
+	if (decl)
+		role = hashtab_search(decl->p_roles.table, id);
+	else
+		role = hashtab_search(p->p_roles.table, id);
+
+	if (!role)
+		printf("role %s can't be found! \n", id);
+
+	CU_ASSERT_FATAL(role != NULL);
+
+	ebitmap_for_each_positive_bit(&role->types.types, tnode, i) {
+		new = 0;
+		for (j = 0; j < len; j++) {
+			if (strcmp(p->sym_val_to_name[SYM_TYPES][i], types[j]) == 0) {
+				found++;
+				new = 1;
+			}
+		}
+		if (new == 0) {
+			printf("\nRole %s had type %s not in types array\n",
+			       id, p->sym_val_to_name[SYM_TYPES][i]);
+		}
+		CU_ASSERT(new == 1);
+	}
+	CU_ASSERT(found == len);
+	if (found != len)
+		printf("\nrole %s has %d types, %d expected\n", p->sym_val_to_name[SYM_ROLES][role->s.value - 1], found, len);
+	/* roles should never have anything in the negset */
+	CU_ASSERT(role->types.negset.highbit == 0);
+	CU_ASSERT(role->types.flags == flags);
+
+	return role;
+}
+
+void test_attr_types(policydb_t * p, const char *id, avrule_decl_t * decl, const char **types, int len)
+{
+	ebitmap_node_t *tnode;
+	int j, new, found = 0;
+	unsigned int i;
+	type_datum_t *attr;
+
+	if (decl) {
+		attr = hashtab_search(decl->p_types.table, id);
+		if (attr == NULL)
+			printf("could not find attr %s in decl %d\n", id, decl->decl_id);
+	} else {
+		attr = hashtab_search(p->p_types.table, id);
+		if (attr == NULL)
+			printf("could not find attr %s in policy\n", id);
+	}
+
+	CU_ASSERT_FATAL(attr != NULL);
+	CU_ASSERT(attr->flavor == TYPE_ATTRIB);
+	CU_ASSERT(attr->primary == 1);
+
+	ebitmap_for_each_positive_bit(&attr->types, tnode, i) {
+		new = 0;
+		for (j = 0; j < len; j++) {
+			if (strcmp(p->sym_val_to_name[SYM_TYPES][i], types[j]) == 0) {
+				found++;
+				new = 1;
+			}
+		}
+		if (new == 0) {
+			printf("\nattr %s had type %s not in types array\n",
+			       id, p->sym_val_to_name[SYM_TYPES][i]);
+		}
+		CU_ASSERT(new == 1);
+	}
+	CU_ASSERT(found == len);
+	if (found != len)
+		printf("\nattr %s has %d types, %d expected\n", id, found, len);
+}

kernel/libsepol/tests/test-common.h

@@ -0,0 +1,78 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *         Chad Sellers <csellers@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_COMMON_H__
+#define __TEST_COMMON_H__
+
+#include <sepol/policydb/policydb.h>
+
+/* p		the policy being inspected
+ * id		string symbol identifier
+ * sym_type	symbol type (eg., SYM_ROLES, SYM_TYPES)
+ * scope_type	what scope the role should have (eg., SCOPE_DECL or SCOPE_REQ)
+ * decls	integer array of decl id's that we expect the role to have in the scope table
+ * len		number of elements in decls
+ * 
+ * This is a utility function to test for the symbol's presence in the global symbol table, 
+ * the scope table, and that the decl blocks we think this symbol is in are correct
+ */
+extern void test_sym_presence(policydb_t * p, const char *id, int sym_type, unsigned int scope_type, unsigned int *decls, unsigned int len);
+
+/* Test the indexes in the policydb to ensure their correctness. These include
+ * the sym_val_to_name[], class_val_to_struct, role_val_to_struct, type_val_to_struct,
+ * user_val_to_struct, and bool_val_to_struct indexes.
+ */
+extern void test_policydb_indexes(policydb_t * p);
+
+/* Test alias datum to ensure that it is as expected
+ *
+ * id = the key for the alias
+ * primary_id = the key for its primary
+ * mode: 0 = test the datum according to the flavor value in the call
+         1 = automatically detect the flavor value and test the datum accordingly
+ * flavor = flavor value if in mode 0
+ */
+extern void test_alias_datum(policydb_t * p, const char *id, const char *primary_id, char mode, unsigned int flavor);
+
+/* p		the policy being inspected
+ * id		string role identifier
+ * decl		the decl block which we are looking in for the role datum
+ * types	the array of string types which we expect the role has in its type ebitmap
+ * len		number of elements in types
+ * flags	the expected flags in the role typeset (eg., * or ~)
+ *
+ * This is a utility function to test whether the type set associated with a role in a specific
+ * avrule decl block matches our expectations
+ */
+extern role_datum_t *test_role_type_set(policydb_t * p, const char *id, avrule_decl_t * decl, const char **types, unsigned int len, unsigned int flags);
+
+/* p		the policy being inspected
+ * id		string attribute identifier
+ * decl		the decl block which we are looking in for the attribute datum
+ * types	the array of string types which we expect the attribute has in its type ebitmap
+ * len		number of elements in types
+ *
+ * This is a utility function to test whether the type set associated with an attribute in a specific
+ * avrule decl block matches our expectations 
+ */
+extern void test_attr_types(policydb_t * p, const char *id, avrule_decl_t * decl, const char **types, int len);
+
+#endif

kernel/libsepol/tests/test-cond.c

@@ -0,0 +1,95 @@
+/*
+ * Author: Karl MacMillan <kmacmillan@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-cond.h"
+#include "parse_util.h"
+#include "helpers.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+#include <sepol/policydb/expand.h>
+#include <sepol/policydb/conditional.h>
+
+static policydb_t basemod;
+static policydb_t base_expanded;
+
+int cond_test_init(void)
+{
+	if (policydb_init(&base_expanded)) {
+		fprintf(stderr, "out of memory!\n");
+		ksu_policydb_destroy(&basemod);
+		return -1;
+	}
+
+	if (test_load_policy(&basemod, POLICY_BASE, 1, "test-cond", "refpolicy-base.conf"))
+		goto cleanup;
+
+	if (link_modules(NULL, &basemod, NULL, 0, 0)) {
+		fprintf(stderr, "link modules failed\n");
+		goto cleanup;
+	}
+
+	if (expand_module(NULL, &basemod, &base_expanded, 0, 1)) {
+		fprintf(stderr, "expand module failed\n");
+		goto cleanup;
+	}
+
+	return 0;
+
+      cleanup:
+	ksu_policydb_destroy(&basemod);
+	ksu_policydb_destroy(&base_expanded);
+	return -1;
+}
+
+int cond_test_cleanup(void)
+{
+	ksu_policydb_destroy(&basemod);
+	ksu_policydb_destroy(&base_expanded);
+
+	return 0;
+}
+
+static void test_cond_expr_equal(void)
+{
+	cond_node_t *a, *b;
+
+	a = base_expanded.cond_list;
+	while (a) {
+		b = base_expanded.cond_list;
+		while (b) {
+			if (a == b) {
+				CU_ASSERT(cond_expr_equal(a, b));
+			} else {
+				CU_ASSERT(cond_expr_equal(a, b) == 0);
+			}
+			b = b->next;
+		}
+		a = a->next;
+	}
+}
+
+int cond_add_tests(CU_pSuite suite)
+{
+	if (NULL == CU_add_test(suite, "cond_expr_equal", test_cond_expr_equal)) {
+		return CU_get_error();
+	}
+	return 0;
+}

kernel/libsepol/tests/test-cond.h

@@ -0,0 +1,30 @@
+/*
+ * Author: Karl MacMillan <kmacmillan@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_COND_H__
+#define __TEST_COND_H__
+
+#include <CUnit/Basic.h>
+
+int cond_test_init(void);
+int cond_test_cleanup(void);
+int cond_add_tests(CU_pSuite suite);
+
+#endif

kernel/libsepol/tests/test-deps.c

@@ -0,0 +1,306 @@
+/*
+ * Author: Karl MacMillan <kmacmillan@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-deps.h"
+#include "parse_util.h"
+#include "helpers.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+
+#include <stdlib.h>
+
+/* Tests for dependency checking / handling, specifically:
+ *
+ * 1 type in module global.
+ * 2 attribute in module global.
+ * 3 object class / perm in module global.
+ * 4 boolean in module global.
+ * 5 role in module global.
+ *
+ * 6 type in module optional.
+ * 7 attribute in module optional.
+ * 8 object class / perm in module optional.
+ * 9 boolean in module optional.
+ * 10 role in module optional.
+ *
+ * 11 type in base optional.
+ * 12 attribute in base optional.
+ * 13 object class / perm in base optional.
+ * 14 boolean in base optional.
+ * 15 role in base optional.
+ *
+ * Each of these tests are done with the dependency met and not
+ * met. Additionally, each of the required symbols is used in the
+ * scope it is required.
+ *
+ * In addition to the simple tests, we have test with more complex
+ * modules that test:
+ *
+ * 17 mutual dependencies between two modules.
+ * 18 circular dependency between three modules.
+ * 19 large number of dependencies in a module with a more complex base.
+ * 20 nested optionals with requires.
+ *
+ * Again, each of these tests is done with the requirements met and not
+ * met.
+ */
+
+#include <sepol/debug.h>
+#include <sepol/handle.h>
+
+#include "helpers.h"
+
+#define BASE_MODREQ_TYPE_GLOBAL    0
+#define BASE_MODREQ_ATTR_GLOBAL    1
+#define BASE_MODREQ_OBJ_GLOBAL     2
+#define BASE_MODREQ_BOOL_GLOBAL    3
+#define BASE_MODREQ_ROLE_GLOBAL    4
+#define BASE_MODREQ_PERM_GLOBAL    5
+#define BASE_MODREQ_TYPE_OPT       6
+#define BASE_MODREQ_ATTR_OPT       7
+#define BASE_MODREQ_OBJ_OPT        8
+#define BASE_MODREQ_BOOL_OPT       9
+#define BASE_MODREQ_ROLE_OPT       10
+#define BASE_MODREQ_PERM_OPT       11
+#define NUM_BASES                  12
+
+static policydb_t bases_met[NUM_BASES];
+static policydb_t bases_notmet[NUM_BASES];
+
+extern int mls;
+
+int deps_test_init(void)
+{
+	int i;
+
+	/* To test linking we need 1 base per link test and in
+	 * order to load them in the init function we have
+	 * to keep them all around. Not ideal, but it shouldn't
+	 * matter too much.
+	 */
+	for (i = 0; i < NUM_BASES; i++) {
+		if (test_load_policy(&bases_met[i], POLICY_BASE, mls, "test-deps", "base-metreq.conf"))
+			return -1;
+	}
+
+	for (i = 0; i < NUM_BASES; i++) {
+		if (test_load_policy(&bases_notmet[i], POLICY_BASE, mls, "test-deps", "base-notmetreq.conf"))
+			return -1;
+	}
+
+	return 0;
+}
+
+int deps_test_cleanup(void)
+{
+	int i;
+
+	for (i = 0; i < NUM_BASES; i++) {
+		ksu_policydb_destroy(&bases_met[i]);
+	}
+
+	for (i = 0; i < NUM_BASES; i++) {
+		ksu_policydb_destroy(&bases_notmet[i]);
+	}
+
+	return 0;
+}
+
+/* This function performs testing of the dependency handles for module global
+ * symbols. It is capable of testing 2 scenarios - the dependencies are met
+ * and the dependencies are not met.
+ *
+ * Parameters:
+ *  req_met            boolean indicating whether the base policy meets the
+ *                       requirements for the modules global block.
+ *  b                  index of the base policy in the global bases_met array.
+ *
+ *  policy             name of the policy module to load for this test.
+ *  decl_type          name of the unique type found in the module's global
+ *                       section is to find that avrule_decl.
+ */
+static void do_deps_modreq_global(int req_met, int b, const char *policy, const char *decl_type)
+{
+	policydb_t *base;
+	policydb_t mod;
+	policydb_t *mods[] = { &mod };
+	avrule_decl_t *decl;
+	int ret, link_ret;
+	sepol_handle_t *h;
+
+	/* suppress error reporting - this is because we know that we
+	 * are going to get errors and don't want libsepol complaining
+	 * about it constantly. */
+	h = sepol_handle_create();
+	CU_ASSERT_FATAL(h != NULL);
+	sepol_msg_set_callback(h, NULL, NULL);
+
+	if (req_met) {
+		base = &bases_met[b];
+		link_ret = 0;
+	} else {
+		base = &bases_notmet[b];
+		link_ret = -3;
+	}
+
+	CU_ASSERT_FATAL(test_load_policy(&mod, POLICY_MOD, mls, "test-deps", policy) == 0);
+
+	/* link the modules and check for the correct return value.
+	 */
+	ret = link_modules(h, base, mods, 1, 0);
+	CU_ASSERT_FATAL(ret == link_ret);
+	ksu_policydb_destroy(&mod);
+	sepol_handle_destroy(h);
+
+	if (!req_met)
+		return;
+
+	decl = test_find_decl_by_sym(base, SYM_TYPES, decl_type);
+	CU_ASSERT_FATAL(decl != NULL);
+
+	CU_ASSERT(decl->enabled == 1);
+}
+
+/* Test that symbol require statements in the global scope of a module
+ * work correctly. This will cover tests 1 - 5 (described above).
+ *
+ * Each of these policies will require as few symbols as possible to
+ * use the required symbol in addition requiring (for example, the type
+ * test also requires an object class for an allow rule).
+ */
+static void deps_modreq_global(void)
+{
+	/* object classes */
+	do_deps_modreq_global(1, BASE_MODREQ_OBJ_GLOBAL, "modreq-obj-global.conf", "mod_global_t");
+	do_deps_modreq_global(0, BASE_MODREQ_OBJ_GLOBAL, "modreq-obj-global.conf", "mod_global_t");
+	/* types */
+	do_deps_modreq_global(1, BASE_MODREQ_TYPE_GLOBAL, "modreq-type-global.conf", "mod_global_t");
+	do_deps_modreq_global(0, BASE_MODREQ_TYPE_GLOBAL, "modreq-type-global.conf", "mod_global_t");
+	/* attributes */
+	do_deps_modreq_global(1, BASE_MODREQ_ATTR_GLOBAL, "modreq-attr-global.conf", "mod_global_t");
+	do_deps_modreq_global(0, BASE_MODREQ_ATTR_GLOBAL, "modreq-attr-global.conf", "mod_global_t");
+	/* booleans */
+	do_deps_modreq_global(1, BASE_MODREQ_BOOL_GLOBAL, "modreq-bool-global.conf", "mod_global_t");
+	do_deps_modreq_global(0, BASE_MODREQ_BOOL_GLOBAL, "modreq-bool-global.conf", "mod_global_t");
+	/* roles */
+	do_deps_modreq_global(1, BASE_MODREQ_ROLE_GLOBAL, "modreq-role-global.conf", "mod_global_t");
+	do_deps_modreq_global(0, BASE_MODREQ_ROLE_GLOBAL, "modreq-role-global.conf", "mod_global_t");
+	do_deps_modreq_global(1, BASE_MODREQ_PERM_GLOBAL, "modreq-perm-global.conf", "mod_global_t");
+	do_deps_modreq_global(0, BASE_MODREQ_PERM_GLOBAL, "modreq-perm-global.conf", "mod_global_t");
+}
+
+/* This function performs testing of the dependency handles for module optional
+ * symbols. It is capable of testing 2 scenarios - the dependencies are met
+ * and the dependencies are not met.
+ *
+ * Parameters:
+ *  req_met            boolean indicating whether the base policy meets the
+ *                       requirements for the modules global block.
+ *  b                  index of the base policy in the global bases_met array.
+ *
+ *  policy             name of the policy module to load for this test.
+ *  decl_type          name of the unique type found in the module's global
+ *                       section is to find that avrule_decl.
+ */
+static void do_deps_modreq_opt(int req_met, int ret_val, int b, const char *policy, const char *decl_type)
+{
+	policydb_t *base;
+	policydb_t mod;
+	policydb_t *mods[] = { &mod };
+	avrule_decl_t *decl;
+	int ret;
+	sepol_handle_t *h;
+
+	/* suppress error reporting - this is because we know that we
+	 * are going to get errors and don't want libsepol complaining
+	 * about it constantly. */
+	h = sepol_handle_create();
+	CU_ASSERT_FATAL(h != NULL);
+	sepol_msg_set_callback(h, NULL, NULL);
+
+	if (req_met) {
+		base = &bases_met[b];
+	} else {
+		base = &bases_notmet[b];
+	}
+
+	CU_ASSERT_FATAL(test_load_policy(&mod, POLICY_MOD, mls, "test-deps", policy) == 0);
+
+	/* link the modules and check for the correct return value.
+	 */
+	ret = link_modules(h, base, mods, 1, 0);
+	CU_ASSERT_FATAL(ret == ret_val);
+	ksu_policydb_destroy(&mod);
+	sepol_handle_destroy(h);
+	if (ret_val < 0)
+		return;
+
+	decl = test_find_decl_by_sym(base, SYM_TYPES, decl_type);
+	CU_ASSERT_FATAL(decl != NULL);
+
+	if (req_met) {
+		CU_ASSERT(decl->enabled == 1);
+	} else {
+		CU_ASSERT(decl->enabled == 0);
+	}
+}
+
+/* Test that symbol require statements in the global scope of a module
+ * work correctly. This will cover tests 6 - 10 (described above).
+ *
+ * Each of these policies will require as few symbols as possible to
+ * use the required symbol in addition requiring (for example, the type
+ * test also requires an object class for an allow rule).
+ */
+static void deps_modreq_opt(void)
+{
+	/* object classes */
+	do_deps_modreq_opt(1, 0, BASE_MODREQ_OBJ_OPT, "modreq-obj-opt.conf", "mod_opt_t");
+	do_deps_modreq_opt(0, 0, BASE_MODREQ_OBJ_OPT, "modreq-obj-opt.conf", "mod_opt_t");
+	/* types */
+	do_deps_modreq_opt(1, 0, BASE_MODREQ_TYPE_OPT, "modreq-type-opt.conf", "mod_opt_t");
+	do_deps_modreq_opt(0, 0, BASE_MODREQ_TYPE_OPT, "modreq-type-opt.conf", "mod_opt_t");
+	/* attributes */
+	do_deps_modreq_opt(1, 0, BASE_MODREQ_ATTR_OPT, "modreq-attr-opt.conf", "mod_opt_t");
+	do_deps_modreq_opt(0, 0, BASE_MODREQ_ATTR_OPT, "modreq-attr-opt.conf", "mod_opt_t");
+	/* booleans */
+	do_deps_modreq_opt(1, 0, BASE_MODREQ_BOOL_OPT, "modreq-bool-opt.conf", "mod_opt_t");
+	do_deps_modreq_opt(0, 0, BASE_MODREQ_BOOL_OPT, "modreq-bool-opt.conf", "mod_opt_t");
+	/* roles */
+	do_deps_modreq_opt(1, 0, BASE_MODREQ_ROLE_OPT, "modreq-role-opt.conf", "mod_opt_t");
+	do_deps_modreq_opt(0, 0, BASE_MODREQ_ROLE_OPT, "modreq-role-opt.conf", "mod_opt_t");
+	/* permissions */
+	do_deps_modreq_opt(1, 0, BASE_MODREQ_PERM_OPT, "modreq-perm-opt.conf", "mod_opt_t");
+	do_deps_modreq_opt(0, -3, BASE_MODREQ_PERM_OPT, "modreq-perm-opt.conf", "mod_opt_t");
+}
+
+int deps_add_tests(CU_pSuite suite)
+{
+	if (NULL == CU_add_test(suite, "deps_modreq_global", deps_modreq_global)) {
+		return CU_get_error();
+	}
+
+	if (NULL == CU_add_test(suite, "deps_modreq_opt", deps_modreq_opt)) {
+		return CU_get_error();
+	}
+
+	return 0;
+}

kernel/libsepol/tests/test-deps.h

@@ -0,0 +1,30 @@
+/*
+ * Author: Karl MacMillan <kmacmillan@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_DEPS_H__
+#define __TEST_DEPS_H__
+
+#include <CUnit/Basic.h>
+
+int deps_test_init(void);
+int deps_test_cleanup(void);
+int deps_add_tests(CU_pSuite suite);
+
+#endif

kernel/libsepol/tests/test-downgrade.c

@@ -0,0 +1,271 @@
+/*
+ * Author: Mary Garvin <mgarvin@tresys.com>
+ *
+ * Copyright (C) 2007-2008 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-downgrade.h"
+#include "parse_util.h"
+#include "helpers.h"
+
+#include <sepol/debug.h>
+#include <sepol/handle.h>
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+#include <sepol/policydb/expand.h>
+#include <sepol/policydb/conditional.h>
+#include <limits.h>
+#include <CUnit/Basic.h>
+
+#define POLICY_BIN_HI	"policies/test-downgrade/policy.hi"
+#define POLICY_BIN_LO	"policies/test-downgrade/policy.lo"
+
+static policydb_t policydb;
+
+/*
+ * Function Name:  downgrade_test_init
+ *
+ * Input: None
+ *
+ * Output: None
+ *
+ * Description: Initialize the policydb (policy data base structure)
+ */
+int downgrade_test_init(void)
+{
+	/* Initialize the policydb_t structure */
+	if (policydb_init(&policydb)) {
+		fprintf(stderr, "%s:  Out of memory!\n", __FUNCTION__);
+		return -1;
+	}
+
+	return 0;
+}
+
+/*
+ * Function Name:  downgrade_test_cleanup
+ *
+ * Input: None
+ *
+ * Output: None
+ *
+ * Description: Destroys policydb structure
+ */
+int downgrade_test_cleanup(void)
+{
+	ksu_policydb_destroy(&policydb);
+
+	return 0;
+}
+
+/*
+ * Function Name: downgrade_add_tests
+ *
+ * Input: CU_pSuite
+ *
+ * Output: Returns 0 upon success.  Returns a CUnit error value on failure.
+ *
+ * Description:  Add the given downgrade tests to the downgrade suite.
+ */
+int downgrade_add_tests(CU_pSuite suite)
+{
+	if (CU_add_test(suite, "downgrade", test_downgrade) == NULL)
+		return CU_get_error();
+
+	return 0;
+}
+
+/*
+ * Function Name:  test_downgrade_possible
+ *
+ * Input: None
+ *
+ * Output: None
+ *
+ * Description:
+ * Tests the backward compatibility of MLS and Non-MLS binary policy versions.
+ */
+void test_downgrade(void)
+{
+	if (do_downgrade_test(0) < 0)
+		fprintf(stderr,
+		        "\nError during downgrade testing of Non-MLS policy\n");
+
+
+	if (do_downgrade_test(1) < 0)
+		fprintf(stderr,
+			"\nError during downgrade testing of MLS policy\n");
+}
+
+/*
+ * Function Name:  do_downgrade_test
+ *
+ * Input: 0 for Non-MLS policy and 1 for MLS policy downgrade testing
+ *
+ * Output: 0 on success, negative number upon failure
+ *
+ * Description: This function handles the downgrade testing.
+ *              A binary policy is read into the policydb structure, the
+ *              policy version is decreased by a specific amount, written
+ *              back out and then read back in again.  The process is
+ *              repeated until the minimum policy version is reached.
+ */
+int do_downgrade_test(int mls)
+{
+	policydb_t policydb_tmp;
+	int hi, lo, version;
+
+	/* Reset policydb for re-use */
+	ksu_policydb_destroy(&policydb);
+	downgrade_test_init();
+
+	/* Read in the hi policy from file */
+	if (read_binary_policy(POLICY_BIN_HI, &policydb) != 0) {
+		fprintf(stderr, "error reading %spolicy binary\n", mls ? "mls " : "");
+		CU_FAIL("Unable to read the binary policy");
+		return -1;
+	}
+
+	/* Change MLS value based on parameter */
+	policydb.mls = mls ? 1 : 0;
+
+	for (hi = policydb.policyvers; hi >= POLICYDB_VERSION_MIN; hi--) {
+		/* Stash old version number */
+		version = policydb.policyvers;
+
+		/* Try downgrading to each possible version. */
+		for (lo = hi - 1; lo >= POLICYDB_VERSION_MIN; lo--) {
+
+			/* Reduce policy version */
+			policydb.policyvers = lo;
+
+			/* Write out modified binary policy */
+			if (write_binary_policy(POLICY_BIN_LO, &policydb) != 0) {
+				/*
+				 * Error from MLS to pre-MLS is expected due
+				 * to MLS re-implementation in version 19.
+				 */
+				if (mls && lo < POLICYDB_VERSION_MLS)
+					continue;
+
+				fprintf(stderr, "error writing %spolicy binary, version %d (downgraded from %d)\n", mls ? "mls " : "", lo, hi);
+				CU_FAIL("Failed to write downgraded binary policy");
+					return -1;
+			}
+
+			/* Make sure we can read back what we wrote. */
+			if (policydb_init(&policydb_tmp)) {
+				fprintf(stderr, "%s:  Out of memory!\n",
+					__FUNCTION__);
+				return -1;
+			}
+			if (read_binary_policy(POLICY_BIN_LO, &policydb_tmp) != 0) {
+				fprintf(stderr, "error reading %spolicy binary, version %d (downgraded from %d)\n", mls ? "mls " : "", lo, hi);
+				CU_FAIL("Unable to read downgraded binary policy");
+				return -1;
+			}
+			ksu_policydb_destroy(&policydb_tmp);
+		}
+		/* Restore version number */
+		policydb.policyvers = version;
+    }
+
+    return 0;
+}
+
+/*
+ * Function Name: read_binary_policy
+ *
+ * Input: char * which is the path to the file containing the binary policy
+ *
+ * Output: Returns 0 upon success.  Upon failure, -1 is returned.
+ *	   Possible failures are, filename with given path does not exist,
+ *	   a failure to open the file, or a failure from prolicydb_read
+ *	   function call.
+ *
+ * Description:  Get a filename, open file and read binary policy into policydb
+ * 				 structure.
+ */
+int read_binary_policy(const char *path, policydb_t *p)
+{
+	FILE *in_fp = NULL;
+	struct policy_file f;
+	int rc;
+
+	/* Open the binary policy file */
+	if ((in_fp = fopen(path, "rb")) == NULL) {
+		fprintf(stderr, "Unable to open %s: %s\n", path,
+			strerror(errno));
+		return -1;
+	}
+
+	/* Read in the binary policy.  */
+	memset(&f, 0, sizeof(struct policy_file));
+	f.type = PF_USE_STDIO;
+	f.fp = in_fp;
+	rc = ksu_policydb_read(p, &f, 0);
+
+	fclose(in_fp);
+	return rc;
+}
+
+/*
+ * Function Name: write_binary_policy
+ *
+ * Input: char * which is the path to the file containing the binary policy
+ *
+ * Output: Returns 0 upon success.  Upon failure, -1 is returned.
+ *	   Possible failures are, filename with given path does not exist,
+ *	   a failure to open the file, or a failure from prolicydb_read
+ *	   function call.
+ *
+ * Description:  open file and write the binary policy from policydb structure.
+ */
+int write_binary_policy(const char *path, policydb_t *p)
+{
+	FILE *out_fp = NULL;
+	struct policy_file f;
+	sepol_handle_t *handle;
+	int rc;
+
+	/* We don't want libsepol to print warnings to stderr */
+	handle = sepol_handle_create();
+	if (handle == NULL) {
+		fprintf(stderr, "Out of memory!\n");
+		return -1;
+	}
+	sepol_msg_set_callback(handle, NULL, NULL);
+
+	/* Open the binary policy file for writing */
+	if ((out_fp = fopen(path, "w" )) == NULL) {
+		fprintf(stderr, "Unable to open %s: %s\n", path,
+			strerror(errno));
+		sepol_handle_destroy(handle);
+		return -1;
+	}
+
+	/* Write the binary policy */
+	memset(&f, 0, sizeof(struct policy_file));
+	f.type = PF_USE_STDIO;
+	f.fp = out_fp;
+	f.handle = handle;
+	rc = ksu_policydb_write(p, &f);
+
+	sepol_handle_destroy(f.handle);
+	fclose(out_fp);
+	return rc;
+}

kernel/libsepol/tests/test-downgrade.h

@@ -0,0 +1,119 @@
+/*
+ * Author: Mary Garvin <mgarvin@tresys.com>
+ *
+ * Copyright (C) 2007-2008 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_DOWNGRADE_H__
+#define __TEST_DOWNGRADE_H__
+
+#include <CUnit/Basic.h>
+#include <sepol/policydb/policydb.h>
+
+/*
+ * Function Name:  downgrade_test_init
+ * 
+ * Input: None
+ * 
+ * Output: None
+ * 
+ * Description: Initialize the policydb (policy data base structure)
+ */
+int downgrade_test_init(void);
+
+/*
+ * Function Name:  downgrade_test_cleanup
+ * 
+ * Input: None
+ * 
+ * Output: None
+ * 
+ * Description: Destroys policydb structure
+ */
+int downgrade_test_cleanup(void);
+
+/*
+ * Function Name: downgrade_add_tests
+ * 
+ * Input: CU_pSuite
+ * 
+ * Output: Returns 0 upon success.  Upon failure, a CUnit testing error
+ *	   value is returned
+ * 
+ * Description:  Add the given downgrade tests to the downgrade suite.
+ */
+int downgrade_add_tests(CU_pSuite suite);
+
+/*
+ * Function Name: test_downgrade_possible
+ * 
+ * Input: None
+ * 
+ * Output: None
+ * 
+ * Description: Tests the backward compatibility of MLS and Non-MLS binary
+ *		policy versions. 
+ */
+void test_downgrade(void);
+
+/*
+ * Function Name:  do_downgrade_test
+ * 
+ * Input: int that represents a 0 for Non-MLS policy and a 
+ * 		 1 for MLS policy downgrade testing
+ * 
+ * Output: (int) 0 on success, negative number upon failure
+ * 
+ * Description: This function handles the downgrade testing.  A binary policy
+ *		is read into the policydb structure, the policy version is
+ *		decreased by a specific amount, written back out and then read
+ *		back in again. The process is iterative until the minimum
+ *		policy version is reached. 
+ */
+int do_downgrade_test(int mls);
+
+/*
+ * Function Name: read_binary_policy
+ * 
+ * Input: char * which is the path to the file containing the binary policy
+ * 
+ * Output: Returns 0 upon success.  Upon failure, -1 is returned.
+ *	   Possible failures are, filename with given path does not exist,
+ *	   a failure to open the file, or a failure from prolicydb_read
+ *	   function call.
+ * 
+ * Description: Get a filename, open file and read in the binary policy
+ *		into the policydb structure.
+ */
+int read_binary_policy(const char *path, policydb_t *);
+
+/*
+ * Function Name: write_binary_policy
+ * 
+ * Input: char * which is the path to the file containing the binary policy
+ * 
+ * Output: Returns 0 upon success.  Upon failure, -1 is returned.
+ *	   Possible failures are, filename with given path does not exist,
+ *	   a failure to open the file, or a failure from prolicydb_read
+ *	   function call.
+ * 
+ * Description: Get a filename, open file and read in the binary policy
+ *		into the policydb structure.
+ */
+int write_binary_policy(const char *path, policydb_t *);
+
+#endif

kernel/libsepol/tests/test-expander-attr-map.c

@@ -0,0 +1,106 @@
+/*
+ * Authors: Chad Sellers <csellers@tresys.com>
+ *          Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-expander-attr-map.h"
+#include "test-common.h"
+#include "helpers.h"
+
+#include <sepol/policydb/policydb.h>
+#include <CUnit/Basic.h>
+#include <stdlib.h>
+
+extern policydb_t base_expanded2;
+
+void test_expander_attr_mapping(void)
+{
+	/* note that many cases are omitted because they don't make sense
+	   (i.e. declaring in an optional and then using it in the base) or
+	   because declare in optional then require in a different optional
+	   logic still doesn't work */
+
+	const char *typesb1[] = { "attr_check_base_1_1_t", "attr_check_base_1_2_t" };
+	const char *typesb2[] = { "attr_check_base_2_1_t", "attr_check_base_2_2_t" };
+	const char *typesb3[] = { "attr_check_base_3_1_t", "attr_check_base_3_2_t",
+		"attr_check_base_3_3_t", "attr_check_base_3_4_t"
+	};
+	const char *typesb4[] = { "attr_check_base_4_1_t", "attr_check_base_4_2_t" };
+	const char *typesb5[] = { "attr_check_base_5_1_t", "attr_check_base_5_2_t" };
+	const char *typesb6[] = { "attr_check_base_6_1_t", "attr_check_base_6_2_t",
+		"attr_check_base_6_3_t", "attr_check_base_6_4_t"
+	};
+	const char *typesbo2[] = { "attr_check_base_optional_2_1_t",
+		"attr_check_base_optional_2_2_t"
+	};
+	const char *typesbo5[] = { "attr_check_base_optional_5_1_t",
+		"attr_check_base_optional_5_2_t"
+	};
+	const char *typesm2[] = { "attr_check_mod_2_1_t", "attr_check_mod_2_2_t" };
+	const char *typesm4[] = { "attr_check_mod_4_1_t", "attr_check_mod_4_2_t" };
+	const char *typesm5[] = { "attr_check_mod_5_1_t", "attr_check_mod_5_2_t" };
+	const char *typesm6[] = { "attr_check_mod_6_1_t", "attr_check_mod_6_2_t",
+		"attr_check_mod_6_3_t", "attr_check_mod_6_4_t"
+	};
+	const char *typesmo2[] = { "attr_check_mod_optional_4_1_t",
+		"attr_check_mod_optional_4_2_t"
+	};
+	const char *typesb10[] = { "attr_check_base_10_1_t", "attr_check_base_10_2_t" };
+	const char *typesb11[] = { "attr_check_base_11_3_t", "attr_check_base_11_4_t" };
+	const char *typesm10[] = { "attr_check_mod_10_1_t", "attr_check_mod_10_2_t" };
+	const char *typesm11[] = { "attr_check_mod_11_3_t", "attr_check_mod_11_4_t" };
+
+	test_attr_types(&base_expanded2, "attr_check_base_1", NULL, typesb1, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_2", NULL, typesb2, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_3", NULL, typesb3, 4);
+	test_attr_types(&base_expanded2, "attr_check_base_4", NULL, typesb4, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_5", NULL, typesb5, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_6", NULL, typesb6, 4);
+	test_attr_types(&base_expanded2, "attr_check_base_optional_2", NULL, typesbo2, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_optional_5", NULL, typesbo5, 2);
+	test_attr_types(&base_expanded2, "attr_check_mod_2", NULL, typesm2, 2);
+	test_attr_types(&base_expanded2, "attr_check_mod_4", NULL, typesm4, 2);
+	test_attr_types(&base_expanded2, "attr_check_mod_5", NULL, typesm5, 2);
+	test_attr_types(&base_expanded2, "attr_check_mod_6", NULL, typesm6, 4);
+	test_attr_types(&base_expanded2, "attr_check_mod_optional_4", NULL, typesmo2, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_7", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_base_8", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_base_9", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_base_10", NULL, typesb10, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_11", NULL, typesb11, 2);
+	test_attr_types(&base_expanded2, "attr_check_mod_7", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_mod_8", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_mod_9", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_mod_10", NULL, typesm10, 2);
+	test_attr_types(&base_expanded2, "attr_check_mod_11", NULL, typesm11, 2);
+	test_attr_types(&base_expanded2, "attr_check_base_optional_8", NULL, NULL, 0);
+	test_attr_types(&base_expanded2, "attr_check_mod_optional_7", NULL, NULL, 0);
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_base_optional_disabled_5"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_base_optional_disabled_5_1_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_base_optional_disabled_5_2_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_base_optional_disabled_8"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_base_optional_disabled_8_1_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_base_optional_disabled_8_2_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_mod_optional_disabled_4"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_mod_optional_disabled_4_1_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_mod_optional_disabled_4_2_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_mod_optional_disabled_7"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_mod_optional_disabled_7_1_t"));
+	CU_ASSERT(!hashtab_search((&base_expanded2)->p_types.table, "attr_check_mod_optional_disabled_7_2_t"));
+}

kernel/libsepol/tests/test-expander-attr-map.h

@@ -0,0 +1,26 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_EXPANDER__ATTR_MAP_H__
+#define __TEST_EXPANDER__ATTR_MAP_H__
+
+void test_expander_attr_mapping(void);
+
+#endif

kernel/libsepol/tests/test-expander-roles.c

@@ -0,0 +1,38 @@
+/*
+ * Authors: Chad Sellers <csellers@tresys.com>
+ *          Joshua Brindle <jbrindle@tresys.com>
+ *          Chris PeBenito <cpebenito@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-expander-roles.h"
+#include "test-common.h"
+#include "helpers.h"
+
+#include <sepol/policydb/policydb.h>
+#include <CUnit/Basic.h>
+#include <stdlib.h>
+
+extern policydb_t role_expanded;
+
+void test_expander_role_mapping(void)
+{
+	const char *types1[] = { "role_check_1_1_t", "role_check_1_2_t" };
+
+	test_role_type_set(&role_expanded, "role_check_1", NULL, types1, 2, 0);
+}

kernel/libsepol/tests/test-expander-roles.h

@@ -0,0 +1,27 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ * Author: Chris PeBenito <cpebenito@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_EXPANDER_ROLE_H__
+#define __TEST_EXPANDER_ROLE_H__
+
+void test_expander_role_mapping(void);
+
+#endif

kernel/libsepol/tests/test-expander-users.c

@@ -0,0 +1,74 @@
+/*
+ * Authors: Chad Sellers <csellers@tresys.com>
+ *          Joshua Brindle <jbrindle@tresys.com>
+ *          Chris PeBenito <cpebenito@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-expander-users.h"
+#include "helpers.h"
+
+#include <sepol/policydb/policydb.h>
+#include <CUnit/Basic.h>
+#include <stdlib.h>
+
+extern policydb_t user_expanded;
+
+static void check_user_roles(policydb_t * p, const char *user_name, const char **role_names, int num_roles)
+{
+	user_datum_t *user;
+	ebitmap_node_t *tnode;
+	unsigned int i;
+	int j;
+	unsigned char *found;	/* array of booleans of roles found */
+	int extra = 0;		/* number of extra roles found */
+
+	user = (user_datum_t *) hashtab_search(p->p_users.table, user_name);
+	if (!user) {
+		printf("%s not found\n", user_name);
+		CU_FAIL("user not found");
+		return;
+	}
+	found = calloc(num_roles, sizeof(unsigned char));
+	CU_ASSERT_FATAL(found != NULL);
+	ebitmap_for_each_positive_bit(&user->roles.roles, tnode, i) {
+		extra++;
+		for (j = 0; j < num_roles; j++) {
+			if (strcmp(role_names[j], p->p_role_val_to_name[i]) == 0) {
+				extra--;
+				found[j] += 1;
+				break;
+			}
+		}
+	}
+	for (j = 0; j < num_roles; j++) {
+		if (found[j] != 1) {
+			printf("role %s associated with user %s %d times\n", role_names[j], user_name, found[j]);
+			CU_FAIL("user mapping failure\n");
+		}
+	}
+	free(found);
+	CU_ASSERT_EQUAL(extra, 0);
+}
+
+void test_expander_user_mapping(void)
+{
+	const char *roles1[] = { "user_check_1_1_r", "user_check_1_2_r" };
+
+	check_user_roles(&user_expanded, "user_check_1", roles1, 2);
+}

kernel/libsepol/tests/test-expander-users.h

@@ -0,0 +1,27 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ * Author: Chris PeBenito <cpebenito@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_EXPANDER_USER_H__
+#define __TEST_EXPANDER_USER_H__
+
+void test_expander_user_mapping(void);
+
+#endif

kernel/libsepol/tests/test-expander.c

@@ -0,0 +1,235 @@
+/*
+ * Authors: Chad Sellers <csellers@tresys.com>
+ *          Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This is where the expander tests should go, including:
+ * - check role, type, bool, user mapping
+ * - add symbols declared in enabled optionals
+ * - do not add symbols declared in disabled optionals
+ * - add rules from enabled optionals
+ * - do not add rules from disabled optionals
+ * - verify attribute mapping
+
+ * - check conditional expressions for correct mapping
+ */
+
+#include "test-expander.h"
+#include "parse_util.h"
+#include "helpers.h"
+#include "test-common.h"
+#include "test-expander-users.h"
+#include "test-expander-roles.h"
+#include "test-expander-attr-map.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/expand.h>
+#include <sepol/policydb/link.h>
+#include <sepol/policydb/conditional.h>
+#include <limits.h>
+#include <stdlib.h>
+
+policydb_t role_expanded;
+policydb_t user_expanded;
+policydb_t base_expanded2;
+static policydb_t basemod;
+static policydb_t basemod2;
+static policydb_t mod2;
+static policydb_t base_expanded;
+static policydb_t base_only_mod;
+static policydb_t base_only_expanded;
+static policydb_t role_basemod;
+static policydb_t role_mod;
+static policydb_t user_basemod;
+static policydb_t user_mod;
+static policydb_t alias_basemod;
+static policydb_t alias_mod;
+static policydb_t alias_expanded;
+static uint32_t *typemap;
+extern int mls;
+
+/* Takes base, some number of modules, links them, and expands them
+   reads source from myfiles array, which has the base string followed by
+   each module string */
+static int expander_policy_init(policydb_t * mybase, int num_modules, policydb_t ** mymodules, policydb_t * myexpanded, const char *const *myfiles)
+{
+	char *filename[num_modules + 1];
+	int i;
+
+	for (i = 0; i < num_modules + 1; i++) {
+		filename[i] = calloc(PATH_MAX, sizeof(char));
+		if (snprintf(filename[i], PATH_MAX, "policies/test-expander/%s%s", myfiles[i], mls ? ".mls" : ".std") < 0)
+			return -1;
+	}
+
+	if (policydb_init(mybase)) {
+		fprintf(stderr, "out of memory!\n");
+		return -1;
+	}
+
+	for (i = 0; i < num_modules; i++) {
+		if (policydb_init(mymodules[i])) {
+			fprintf(stderr, "out of memory!\n");
+			return -1;
+		}
+	}
+
+	if (policydb_init(myexpanded)) {
+		fprintf(stderr, "out of memory!\n");
+		return -1;
+	}
+
+	mybase->policy_type = POLICY_BASE;
+	mybase->mls = mls;
+
+	if (read_source_policy(mybase, filename[0], myfiles[0])) {
+		fprintf(stderr, "read source policy failed %s\n", filename[0]);
+		return -1;
+	}
+
+	for (i = 1; i < num_modules + 1; i++) {
+		mymodules[i - 1]->policy_type = POLICY_MOD;
+		mymodules[i - 1]->mls = mls;
+		if (read_source_policy(mymodules[i - 1], filename[i], myfiles[i])) {
+			fprintf(stderr, "read source policy failed %s\n", filename[i]);
+			return -1;
+		}
+	}
+
+	if (link_modules(NULL, mybase, mymodules, num_modules, 0)) {
+		fprintf(stderr, "link modules failed\n");
+		return -1;
+	}
+
+	if (expand_module(NULL, mybase, myexpanded, 0, 0)) {
+		fprintf(stderr, "expand modules failed\n");
+		return -1;
+	}
+
+	for (i = 0; i < num_modules + 1; i++) {
+		free(filename[i]);
+	}
+	return 0;
+}
+
+int expander_test_init(void)
+{
+	const char *small_base_file = "small-base.conf";
+	const char *base_only_file = "base-base-only.conf";
+	int rc;
+	policydb_t *mymod2;
+	const char *files2[] = { "small-base.conf", "module.conf" };
+	const char *role_files[] = { "role-base.conf", "role-module.conf" };
+	const char *user_files[] = { "user-base.conf", "user-module.conf" };
+	const char *alias_files[] = { "alias-base.conf", "alias-module.conf" };
+
+	rc = expander_policy_init(&basemod, 0, NULL, &base_expanded, &small_base_file);
+	if (rc != 0)
+		return rc;
+
+	mymod2 = &mod2;
+	rc = expander_policy_init(&basemod2, 1, &mymod2, &base_expanded2, files2);
+	if (rc != 0)
+		return rc;
+
+	rc = expander_policy_init(&base_only_mod, 0, NULL, &base_only_expanded, &base_only_file);
+	if (rc != 0)
+		return rc;
+
+	mymod2 = &role_mod;
+	rc = expander_policy_init(&role_basemod, 1, &mymod2, &role_expanded, role_files);
+	if (rc != 0)
+		return rc;
+
+	/* Just init the base for now, until we figure out how to separate out
+	   mls and non-mls tests since users can't be used in mls module */
+	mymod2 = &user_mod;
+	rc = expander_policy_init(&user_basemod, 0, NULL, &user_expanded, user_files);
+	if (rc != 0)
+		return rc;
+
+	mymod2 = &alias_mod;
+	rc = expander_policy_init(&alias_basemod, 1, &mymod2, &alias_expanded, alias_files);
+	if (rc != 0)
+		return rc;
+
+	return 0;
+}
+
+int expander_test_cleanup(void)
+{
+	ksu_policydb_destroy(&basemod);
+	ksu_policydb_destroy(&base_expanded);
+	ksu_policydb_destroy(&basemod2);
+	ksu_policydb_destroy(&base_expanded2);
+	ksu_policydb_destroy(&mod2);
+	ksu_policydb_destroy(&base_only_mod);
+	ksu_policydb_destroy(&base_only_expanded);
+	ksu_policydb_destroy(&role_basemod);
+	ksu_policydb_destroy(&role_expanded);
+	ksu_policydb_destroy(&role_mod);
+	ksu_policydb_destroy(&user_basemod);
+	ksu_policydb_destroy(&user_expanded);
+	ksu_policydb_destroy(&user_mod);
+	ksu_policydb_destroy(&alias_basemod);
+	ksu_policydb_destroy(&alias_expanded);
+	ksu_policydb_destroy(&alias_mod);
+	free(typemap);
+
+	return 0;
+}
+
+static void test_expander_indexes(void)
+{
+	test_policydb_indexes(&base_expanded);
+}
+
+static void test_expander_alias(void)
+{
+	test_alias_datum(&alias_expanded, "alias_check_1_a", "alias_check_1_t", 1, 0);
+	test_alias_datum(&alias_expanded, "alias_check_2_a", "alias_check_2_t", 1, 0);
+	test_alias_datum(&alias_expanded, "alias_check_3_a", "alias_check_3_t", 1, 0);
+}
+
+int expander_add_tests(CU_pSuite suite)
+{
+	if (NULL == CU_add_test(suite, "expander_indexes", test_expander_indexes)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+
+	if (NULL == CU_add_test(suite, "expander_attr_mapping", test_expander_attr_mapping)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+
+	if (NULL == CU_add_test(suite, "expander_role_mapping", test_expander_role_mapping)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	if (NULL == CU_add_test(suite, "expander_user_mapping", test_expander_user_mapping)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	if (NULL == CU_add_test(suite, "expander_alias", test_expander_alias)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	return 0;
+}

kernel/libsepol/tests/test-expander.h

@@ -0,0 +1,30 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_EXPANDER_H__
+#define __TEST_EXPANDER_H__
+
+#include <CUnit/Basic.h>
+
+int expander_test_init(void);
+int expander_test_cleanup(void);
+int expander_add_tests(CU_pSuite suite);
+
+#endif

kernel/libsepol/tests/test-linker-cond-map.c

@@ -0,0 +1,160 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-linker-cond-map.h"
+#include "parse_util.h"
+#include "helpers.h"
+#include "test-common.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+#include <sepol/policydb/conditional.h>
+
+#include <CUnit/Basic.h>
+#include <stdlib.h>
+
+/* Tests for conditionals
+ * Test each cond/bool for these
+ * - boolean copied correctly (state is correct)
+ * - conditional expression is correct
+ * Tests: 
+ * - single boolean in base
+ * - single boolean in module
+ * - single boolean in base optional
+ * - single boolean in module optional
+ * - 2 booleans in base
+ * - 2 booleans in module
+ * - 2 booleans in base optional
+ * - 2 booleans in module optional
+ * - 2 booleans, base and module
+ * - 2 booleans, base optional and module
+ * - 2 booleans, base optional and module optional
+ * - 3 booleans, base, base optional, module
+ * - 4 boolean, base, base optional, module, module optional
+ */
+
+typedef struct test_cond_expr {
+	const char *bool;
+	uint32_t expr_type;
+} test_cond_expr_t;
+
+static void test_cond_expr_mapping(policydb_t * p, avrule_decl_t * d, test_cond_expr_t * bools, int len)
+{
+	int i;
+	cond_expr_t *expr;
+
+	CU_ASSERT_FATAL(d->cond_list != NULL);
+	CU_ASSERT_FATAL(d->cond_list->expr != NULL);
+
+	expr = d->cond_list->expr;
+
+	for (i = 0; i < len; i++) {
+		CU_ASSERT_FATAL(expr != NULL);
+
+		CU_ASSERT(expr->expr_type == bools[i].expr_type);
+		if (bools[i].bool) {
+			CU_ASSERT(strcmp(p->sym_val_to_name[SYM_BOOLS][expr->bool - 1], bools[i].bool) == 0);
+		}
+		expr = expr->next;
+	}
+}
+
+static void test_bool_state(policydb_t * p, const char *bool, int state)
+{
+	cond_bool_datum_t *b;
+
+	b = hashtab_search(p->p_bools.table, bool);
+	CU_ASSERT_FATAL(b != NULL);
+	CU_ASSERT(b->state == state);
+}
+
+void base_cond_tests(policydb_t * base)
+{
+	avrule_decl_t *d;
+	unsigned int decls[1];
+	test_cond_expr_t bools[2];
+
+	/* these tests look at booleans and conditionals in the base only
+	 * to ensure that they aren't altered or removed during the link process */
+
+	/* bool existence and state, global scope */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "g_b_bool_1", SYM_BOOLS, SCOPE_DECL, decls, 1);
+	test_bool_state(base, "g_b_bool_1", 0);
+	/* conditional expression mapped correctly */
+	bools[0].bool = "g_b_bool_1";
+	bools[0].expr_type = COND_BOOL;
+	test_cond_expr_mapping(base, d, bools, 1);
+
+	/* bool existence and state, optional scope */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "o1_b_bool_1", SYM_BOOLS, SCOPE_DECL, decls, 1);
+	test_bool_state(base, "o1_b_bool_1", 1);
+	/* conditional expression mapped correctly */
+	bools[0].bool = "o1_b_bool_1";
+	bools[0].expr_type = COND_BOOL;
+	test_cond_expr_mapping(base, d, bools, 1);
+
+}
+
+void module_cond_tests(policydb_t * base)
+{
+	avrule_decl_t *d;
+	unsigned int decls[1];
+	test_cond_expr_t bools[3];
+
+	/* bool existence and state, module 1 global scope */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "g_m1_bool_1", SYM_BOOLS, SCOPE_DECL, decls, 1);
+	test_bool_state(base, "g_m1_bool_1", 1);
+	/* conditional expression mapped correctly */
+	bools[0].bool = "g_m1_bool_1";
+	bools[0].expr_type = COND_BOOL;
+	test_cond_expr_mapping(base, d, bools, 1);
+
+	/* bool existence and state, module 1 optional scope */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_m1");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "o1_m1_bool_1", SYM_BOOLS, SCOPE_DECL, decls, 1);
+	test_bool_state(base, "o1_m1_bool_1", 0);
+	/* conditional expression mapped correctly */
+	bools[0].bool = "o1_m1_bool_1";
+	bools[0].expr_type = COND_BOOL;
+	test_cond_expr_mapping(base, d, bools, 1);
+
+	/* bool existence and state, module 2 global scope */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m2");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "g_m2_bool_1", SYM_BOOLS, SCOPE_DECL, decls, 1);
+	test_sym_presence(base, "g_m2_bool_2", SYM_BOOLS, SCOPE_DECL, decls, 1);
+	test_bool_state(base, "g_m2_bool_1", 1);
+	test_bool_state(base, "g_m2_bool_2", 0);
+	/* conditional expression mapped correctly */
+	bools[0].bool = "g_m2_bool_1";
+	bools[0].expr_type = COND_BOOL;
+	bools[1].bool = "g_m2_bool_2";
+	bools[1].expr_type = COND_BOOL;
+	bools[2].bool = NULL;
+	bools[2].expr_type = COND_AND;
+	test_cond_expr_mapping(base, d, bools, 3);
+}

kernel/libsepol/tests/test-linker-cond-map.h

@@ -0,0 +1,29 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_LINKER_COND_MAP_H__
+#define __TEST_LINKER_COND_MAP_H__
+
+#include <sepol/policydb/policydb.h>
+
+extern void base_cond_tests(policydb_t * base);
+extern void module_cond_tests(policydb_t * base);
+
+#endif

kernel/libsepol/tests/test-linker-roles.c

@@ -0,0 +1,204 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-linker-roles.h"
+#include "parse_util.h"
+#include "helpers.h"
+#include "test-common.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+
+#include <CUnit/Basic.h>
+#include <stdlib.h>
+
+/* Tests for roles:
+ * Test for each of these for 
+ * - role in appropriate symtab (global and decl)
+ * - datum in the decl symtab has correct type_set
+ * - scope datum has correct decl ids
+ * - dominates bitmap is correct
+ * Tests:
+ * - role in base, no modules
+ * - role in base optional, no modules
+ * - role a in base, b in module
+ * - role a in base and module (additive)
+ * - role a in base and 2 module
+ * - role a in base optional, b in module
+ * - role a in base, b in module optional
+ * - role a in base optional, b in module optional
+ * - role a in base optional and module
+ * - role a in base and module optional
+ * - role a in base optional and module optional
+ * - role a in base optional and 2 modules
+ * - role a and b in base, b dom a, are types correct (TODO)
+ */
+
+/* this simply tests whether the passed in role only has its own 
+ * value in its dominates ebitmap */
+static void only_dominates_self(policydb_t * p, role_datum_t * role)
+{
+	ebitmap_node_t *tnode;
+	unsigned int i;
+	int found = 0;
+
+	ebitmap_for_each_positive_bit(&role->dominates, tnode, i) {
+		found++;
+		CU_ASSERT(i == role->s.value - 1);
+	}
+	CU_ASSERT(found == 1);
+}
+
+void base_role_tests(policydb_t * base)
+{
+	avrule_decl_t *decl;
+	role_datum_t *role;
+	unsigned int decls[2];
+	const char *types[2];
+
+	/* These tests look at roles in the base only, the desire is to ensure that
+	 * roles are not destroyed or otherwise removed during the link process */
+
+	/**** test for g_b_role_1 in base and decl 1 (global) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
+	/* make sure it has the correct type set (g_b_type_1, no negset, no flags) */
+	types[0] = "g_b_type_1";
+	role = test_role_type_set(base, "g_b_role_1", NULL, types, 1, 0);
+	/* This role should only dominate itself */
+	only_dominates_self(base, role);
+
+	/**** test for o1_b_role_1 in optional (decl 2) ****/
+	decl = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b");
+	decls[0] = decl->decl_id;
+	test_sym_presence(base, "o1_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
+	/* make sure it has the correct type set (o1_b_type_1, no negset, no flags) */
+	types[0] = "o1_b_type_1";
+	role = test_role_type_set(base, "o1_b_role_1", decl, types, 1, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+}
+
+void module_role_tests(policydb_t * base)
+{
+	role_datum_t *role;
+	avrule_decl_t *decl;
+	unsigned int decls[3];
+	const char *types[3];
+
+	/* These tests are run when the base is linked with 2 modules,
+	 * They should test whether the roles get copied correctly from the 
+	 * modules into the base */
+
+	/**** test for role in module 1 (global) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "g_m1_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
+	/* make sure it has the correct type set (g_m1_type_1, no negset, no flags) */
+	types[0] = "g_m1_type_1";
+	role = test_role_type_set(base, "g_m1_role_1", NULL, types, 1, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/**** test for role in module 1 (optional) ****/
+	decl = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_m1");
+	decls[0] = decl->decl_id;
+	test_sym_presence(base, "o1_m1_role_1", SYM_ROLES, SCOPE_DECL, decls, 1);
+	/* make sure it has the correct type set (o1_m1_type_1, no negset, no flags) */
+	types[0] = "o1_m1_type_1";
+	role = test_role_type_set(base, "o1_m1_role_1", decl, types, 1, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/* These test whether the type sets are copied to the right place and
+	 * correctly unioned when they should be */
+
+	/**** test for type added to base role in module 1 (global) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_role_2", SYM_ROLES, SCOPE_DECL, decls, 1);
+	/* make sure it has the correct type set (g_m1_type_1, no negset, no flags) */
+	types[0] = "g_b_type_2";	/* added in base when declared */
+	types[1] = "g_m1_type_1";	/* added in module */
+	role = test_role_type_set(base, "g_b_role_2", NULL, types, 2, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/**** test for type added to base role in module 1 & 2 (global) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	decls[2] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m2"))->decl_id;
+	test_sym_presence(base, "g_b_role_3", SYM_ROLES, SCOPE_DECL, decls, 3);
+	/* make sure it has the correct type set (g_b_type_2, g_m1_type_2, g_m2_type_2, no negset, no flags) */
+	types[0] = "g_b_type_2";	/* added in base when declared */
+	types[1] = "g_m1_type_2";	/* added in module 1 */
+	types[2] = "g_m2_type_2";	/* added in module 2 */
+	role = test_role_type_set(base, "g_b_role_3", NULL, types, 3, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/**** test for role in base optional and module 1 (additive) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b"))->decl_id;
+	decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "o1_b_role_2", SYM_ROLES, SCOPE_DECL, decls, 2);
+	/* this one will have 2 type sets, one in the global symtab and one in the base optional 1 */
+	types[0] = "g_m1_type_1";
+	role = test_role_type_set(base, "o1_b_role_2", NULL, types, 1, 0);
+	types[0] = "o1_b_type_1";
+	role = test_role_type_set(base, "o1_b_role_2", test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b"), types, 1, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/**** test for role in base and module 1 optional (additive) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_m1"))->decl_id;
+	test_sym_presence(base, "g_b_role_4", SYM_ROLES, SCOPE_DECL, decls, 2);
+	/* this one will have 2 type sets, one in the global symtab and one in the base optional 1 */
+	types[0] = "g_b_type_2";
+	role = test_role_type_set(base, "g_b_role_4", NULL, types, 1, 0);
+	types[0] = "g_m1_type_2";
+	role = test_role_type_set(base, "g_b_role_4", test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_m1"), types, 1, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/**** test for role in base and module 1 optional (additive) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_b"))->decl_id;
+	decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1"))->decl_id;
+	test_sym_presence(base, "o3_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 2);
+	/* this one will have 2 type sets, one in the 3rd base optional and one in the 3rd module optional */
+	types[0] = "o3_b_type_1";
+	role = test_role_type_set(base, "o3_b_role_1", test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_b"), types, 1, 0);
+	types[0] = "o3_m1_type_1";
+	role = test_role_type_set(base, "o3_b_role_1", test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1"), types, 1, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+
+	/**** test for role in base and module 1 optional (additive) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b"))->decl_id;
+	decls[1] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	decls[2] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m2"))->decl_id;
+	test_sym_presence(base, "o4_b_role_1", SYM_ROLES, SCOPE_DECL, decls, 3);
+	/* this one will have 2 type sets, one in the global symtab (with both module types) and one in the 4th optional of base */
+	types[0] = "g_m1_type_1";
+	role = test_role_type_set(base, "o4_b_role_1", test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b"), types, 1, 0);
+	types[0] = "g_m2_type_1";
+	types[1] = "g_m1_type_2";
+	role = test_role_type_set(base, "o4_b_role_1", NULL, types, 2, 0);
+	/* and only dominates itself */
+	only_dominates_self(base, role);
+}

kernel/libsepol/tests/test-linker-roles.h

@@ -0,0 +1,29 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_LINKER_ROLES_H__
+#define __TEST_LINKER_ROLES_H__
+
+#include <sepol/policydb/policydb.h>
+
+extern void base_role_tests(policydb_t * base);
+extern void module_role_tests(policydb_t * base);
+
+#endif

kernel/libsepol/tests/test-linker-types.c

@@ -0,0 +1,318 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *         Chad Sellers <csellers@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "test-linker-types.h"
+#include "parse_util.h"
+#include "helpers.h"
+#include "test-common.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+
+#include <CUnit/Basic.h>
+#include <stdlib.h>
+
+/* Tests for types:
+ * Test for each of these for 
+ * - type in appropriate symtab (global and decl)
+ * - datum in the decl symtab has correct type bitmap (if attr)
+ * - primary is set correctly
+ * - scope datum has correct decl ids
+ * Tests:
+ * - type in base, no modules
+ * - type in base optional, no modules
+ * - type a in base, b in module
+ * - type a in base optional, b in module
+ * - type a in base, b in module optional
+ * - type a in base optional, b in module optional
+ * - attr in base, no modules
+ * - attr in base optional, no modules
+ * - attr a in base, b in module
+ * - attr a in base optional, b in module
+ * - attr a in base, b in module optional
+ * - attr a in base optional, b in module optional
+ * - attr a declared in base, added to in module
+ * - attr a declared in base, added to in module optional
+ * - attr a declared in base, added to in 2 modules 
+ * - attr a declared in base, added to in 2 modules (optional and global)
+ * - attr a declared in base optional, added to in module
+ * - attr a declared in base optional, added to in module optional
+ * - attr a added to in base optional, declared in module
+ * - attr a added to in base optional, declared in module optional
+ * - attr a added to in base optional, declared in module, added to in other module
+ * - attr a added to in base optional, declared in module optional, added to in other module
+ * - attr a added to in base optional, declared in module , added to in other module optional
+ * - attr a added to in base optional, declared in module optional, added to in other module optional
+ * - alias in base of primary type in base, no modules
+ * - alias in base optional of primary type in base, no modules
+ * - alias in base optional of primary type in base optional
+ * - alias in module of primary type in base
+ * - alias in module optional of primary type in base
+ * - alias in module optional of primary type in base optional
+ * - alias in module of primary type in module
+ * - alias in module optional of primary type in module
+ * - alias in module optional of primary type in module optional
+ * - alias a in base, b in module, primary type in base
+ * - alias a in base, b in module, primary type in module
+ * - alias a in base optional, b in module, primary type in base
+ * - alias a in base optional, b in module, primary type in module
+ * - alias a in base, b in module optional, primary type in base
+ * - alias a in base, b in module optional, primary type in module
+ * - alias a in base optional, b in module optional, primary type in base
+ * - alias a in base optional, b in module optional, primary type in module
+ * - alias a in base, required in module, primary type in base
+ * - alias a in base, required in base optional, primary type in base
+ * - alias a in base, required in module optional, primary type in base
+ * - alias a in module, required in base optional, primary type in base
+ * - alias a in module, required in module optional, primary type in base
+ * - alias a in base optional, required in module, primary type in base
+ * - alias a in base optional, required in different base optional, primary type in base
+ * - alias a in base optional, required in module optional, primary type in base
+ * - alias a in module optional, required in base optional, primary type in base
+ * - alias a in module optional, required in module optional, primary type in base
+ * - alias a in module, required in base optional, primary type in module
+ * - alias a in module, required in module optional, primary type in module
+ * - alias a in base optional, required in module, primary type in module
+ * - alias a in base optional, required in different base optional, primary type in module
+ * - alias a in base optional, required in module optional, primary type in module
+ * - alias a in module optional, required in base optional, primary type in module
+ * - alias a in module optional, required in module optional, primary type in module
+ */
+
+/* Don't pass in decls from global blocks since symbols aren't stored in their symtab */
+static void test_type_datum(policydb_t * p, const char *id, unsigned int *decls, int len, unsigned int primary)
+{
+	int i;
+	unsigned int value;
+	type_datum_t *type;
+
+	/* just test the type datums for each decl to see if it is what we expect */
+	type = hashtab_search(p->p_types.table, id);
+
+	CU_ASSERT_FATAL(type != NULL);
+	CU_ASSERT(type->primary == primary);
+	CU_ASSERT(type->flavor == TYPE_TYPE);
+
+	value = type->s.value;
+
+	for (i = 0; i < len; i++) {
+		type = hashtab_search(p->decl_val_to_struct[decls[i] - 1]->p_types.table, id);
+		CU_ASSERT_FATAL(type != NULL);
+		CU_ASSERT(type->primary == primary);
+		CU_ASSERT(type->flavor == TYPE_TYPE);
+		CU_ASSERT(type->s.value == value);
+	}
+
+}
+
+void base_type_tests(policydb_t * base)
+{
+	unsigned int decls[2];
+	const char *types[2];
+
+	/* These tests look at types in the base only, the desire is to ensure that
+	 * types are not destroyed or otherwise removed during the link process.
+	 * if this happens these tests won't work anyway since we are using types to 
+	 * mark blocks */
+
+	/**** test for g_b_type_1 in base and decl 1 (global) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_type_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_type_datum(base, "g_b_type_1", NULL, 0, 1);
+	/* this attr is in the same decl as the type */
+	test_sym_presence(base, "g_b_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_b_type_1";
+	test_attr_types(base, "g_b_attr_1", NULL, types, 1);
+
+	/**** test for o1_b_type_1 in optional (decl 2) ****/
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b"))->decl_id;
+	test_sym_presence(base, "o1_b_type_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_type_datum(base, "o1_b_type_1", NULL, 0, 1);
+	/* this attr is in the same decl as the type */
+	test_sym_presence(base, "o1_b_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "o1_b_type_1";
+	test_attr_types(base, "o1_b_attr_1", base->decl_val_to_struct[decls[0] - 1], types, 1);
+
+	/* tests for aliases */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_alias_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_alias_datum(base, "g_b_alias_1", "g_b_type_3", 1, 0);
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o6_b"))->decl_id;
+	test_sym_presence(base, "g_b_alias_2", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_alias_datum(base, "g_b_alias_2", "g_b_type_3", 1, 0);
+
+}
+
+void module_type_tests(policydb_t * base)
+{
+	unsigned int decls[2];
+	const char *types[2];
+	avrule_decl_t *d;
+
+	/* These tests look at types that were copied from modules or attributes
+	 * that were modified and declared in modules and base. These apply to 
+	 * declarations and modifications in and out of optionals. These tests
+	 * should ensure that types and attributes are correctly copied from modules
+	 * and that attribute type sets are correctly copied and mapped. */
+
+	/* note: scope for attributes is currently smashed if the attribute is declared 
+	 * somewhere so the scope test only looks at global, the type bitmap test looks
+	 * at the appropriate decl symtab */
+
+	/* test for type in module 1 (global) */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "g_m1_type_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_type_datum(base, "g_m1_type_1", NULL, 0, 1);
+	/* attr has is in the same decl as the above type */
+	test_sym_presence(base, "g_m1_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_m1_type_1";
+	types[1] = "g_m1_type_2";
+	test_attr_types(base, "g_m1_attr_1", NULL, types, 2);
+
+	/* test for type in module 1 (optional) */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_m1"))->decl_id;
+	test_sym_presence(base, "o1_m1_type_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_type_datum(base, "o1_m1_type_1", NULL, 0, 1);
+	/* attr has is in the same decl as the above type */
+	test_sym_presence(base, "o1_m1_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "o1_m1_type_2";
+	test_attr_types(base, "o1_m1_attr_1", base->decl_val_to_struct[decls[0] - 1], types, 1);
+
+	/* test for attr declared in base, added to in module (global). 
+	 * Since these are both global it'll be merged in the main symtab */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_attr_3", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_m1_type_3";
+	test_attr_types(base, "g_b_attr_3", NULL, types, 1);
+
+	/* test for attr declared in base, added to in module (optional). */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_attr_4", SYM_TYPES, SCOPE_DECL, decls, 1);
+
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_m1"))->decl_id;
+	types[0] = "o1_m1_type_3";
+	test_attr_types(base, "g_b_attr_4", base->decl_val_to_struct[decls[0] - 1], types, 1);
+
+	/* test for attr declared in base, added to in 2 modules (global). (merged in main symtab) */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_attr_5", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_m1_type_4";
+	types[1] = "g_m2_type_4";
+	test_attr_types(base, "g_b_attr_5", NULL, types, 2);
+
+	/* test for attr declared in base, added to in 2 modules (optional/global). */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_b"))->decl_id;
+	test_sym_presence(base, "g_b_attr_6", SYM_TYPES, SCOPE_DECL, decls, 1);
+	/* module 2 was global to its type is in main symtab */
+	types[0] = "g_m2_type_5";
+	test_attr_types(base, "g_b_attr_6", NULL, types, 1);
+	d = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1"));
+	types[0] = "o3_m1_type_2";
+	test_attr_types(base, "g_b_attr_6", d, types, 1);
+
+	/* test for attr declared in base optional, added to in module (global). */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b"))->decl_id;
+	test_sym_presence(base, "o4_b_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_m1_type_5";
+	test_attr_types(base, "o4_b_attr_1", NULL, types, 1);
+
+	/* test for attr declared in base optional, added to in module (optional). */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b"))->decl_id;
+	test_sym_presence(base, "o1_b_attr_2", SYM_TYPES, SCOPE_DECL, decls, 1);
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_m1");
+	types[0] = "o1_m1_type_5";
+	test_attr_types(base, "o1_b_attr_2", d, types, 1);
+
+	/* test for attr declared in module, added to in base optional */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "g_m1_attr_2", SYM_TYPES, SCOPE_DECL, decls, 1);
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o1_b");
+	types[0] = "o1_b_type_2";
+	test_attr_types(base, "g_m1_attr_2", d, types, 1);
+
+	/* test for attr declared in module optional, added to in base optional */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1"))->decl_id;
+	test_sym_presence(base, "o3_m1_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b");
+	types[0] = "o4_b_type_1";
+	test_attr_types(base, "o3_m1_attr_1", d, types, 1);
+
+	/* attr a added to in base optional, declared/added to in module, added to in other module */
+	/* first the module declare/add and module 2 add (since its global it'll be in the main symtab */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "g_m1_attr_3", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_m1_type_6";
+	types[1] = "g_m2_type_3";
+	test_attr_types(base, "g_m1_attr_3", NULL, types, 2);
+	/* base add */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_b");
+	types[0] = "o4_b_type_2";
+	test_attr_types(base, "g_m1_attr_3", d, types, 1);
+
+	/* attr a added to in base optional, declared/added in module optional, added to in other module */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o3_m1");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "o3_m1_attr_2", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "o3_m1_type_3";
+	test_attr_types(base, "o3_m1_attr_2", d, types, 1);
+	/* module 2's type will be in the main symtab */
+	types[0] = "g_m2_type_6";
+	test_attr_types(base, "o3_m1_attr_2", NULL, types, 1);
+	/* base add */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_b");
+	types[0] = "o2_b_type_1";
+	test_attr_types(base, "o3_m1_attr_2", d, types, 1);
+
+	/* attr a added to in base optional, declared/added in module , added to in other module optional */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "g_m1_attr_4", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "g_m1_type_7";
+	test_attr_types(base, "g_m1_attr_4", NULL, types, 1);
+	/* module 2 */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_m2");
+	types[0] = "o2_m2_type_1";
+	test_attr_types(base, "g_m1_attr_4", d, types, 1);
+	/* base add */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o5_b");
+	types[0] = "o5_b_type_1";
+	test_attr_types(base, "g_m1_attr_4", d, types, 1);
+
+	/* attr a added to in base optional, declared/added in module optional, added to in other module optional */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o4_m1");
+	decls[0] = d->decl_id;
+	test_sym_presence(base, "o4_m1_attr_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	types[0] = "o4_m1_type_1";
+	test_attr_types(base, "o4_m1_attr_1", d, types, 1);
+	/* module 2 */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o2_m2");
+	types[0] = "o2_m2_type_2";
+	test_attr_types(base, "o4_m1_attr_1", d, types, 1);
+	/* base add */
+	d = test_find_decl_by_sym(base, SYM_TYPES, "tag_o5_b");
+	types[0] = "o5_b_type_2";
+	test_attr_types(base, "o4_m1_attr_1", d, types, 1);
+
+	/* tests for aliases */
+	decls[0] = (test_find_decl_by_sym(base, SYM_TYPES, "tag_g_m1"))->decl_id;
+	test_sym_presence(base, "g_m_alias_1", SYM_TYPES, SCOPE_DECL, decls, 1);
+	test_alias_datum(base, "g_m_alias_1", "g_b_type_3", 1, 0);
+
+}

kernel/libsepol/tests/test-linker-types.h

@@ -0,0 +1,29 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_LINKER_TYPES_H__
+#define __TEST_LINKER_TYPES_H__
+
+#include <sepol/policydb/policydb.h>
+
+extern void base_type_tests(policydb_t * base);
+extern void module_type_tests(policydb_t * base);
+
+#endif

kernel/libsepol/tests/test-linker.c

@@ -0,0 +1,154 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+/* This is where the linker tests should go, including:
+ * - check role, type, bool, user, attr mapping
+ * - check for properly enabled optional
+ * - check for properly disabled optional
+ * - check for non-optional disabled blocks
+ * - properly add symbols declared in optionals
+ */
+
+#include "test-linker.h"
+#include "parse_util.h"
+#include "helpers.h"
+#include "test-common.h"
+#include "test-linker-roles.h"
+#include "test-linker-types.h"
+#include "test-linker-cond-map.h"
+
+#include <sepol/policydb/policydb.h>
+#include <sepol/policydb/link.h>
+#include <sepol/policydb/conditional.h>
+#include <sepol/policydb/expand.h>
+#include <limits.h>
+#include <stdlib.h>
+
+#define NUM_MODS 2
+#define NUM_POLICIES NUM_MODS+1
+
+#define BASEMOD NUM_MODS
+const char *policies[NUM_POLICIES] = {
+	"module1.conf",
+	"module2.conf",
+	"small-base.conf",
+};
+
+static policydb_t basenomods;
+static policydb_t linkedbase;
+static policydb_t *modules[NUM_MODS];
+extern int mls;
+
+int linker_test_init(void)
+{
+	int i;
+
+	if (test_load_policy(&linkedbase, POLICY_BASE, mls, "test-linker", policies[BASEMOD]))
+		return -1;
+
+	if (test_load_policy(&basenomods, POLICY_BASE, mls, "test-linker", policies[BASEMOD]))
+		return -1;
+
+	for (i = 0; i < NUM_MODS; i++) {
+
+		modules[i] = calloc(1, sizeof(*modules[i]));
+		if (!modules[i]) {
+			fprintf(stderr, "out of memory!\n");
+			return -1;
+		}
+
+		if (test_load_policy(modules[i], POLICY_MOD, mls, "test-linker", policies[i]))
+			return -1;
+
+	}
+
+	if (link_modules(NULL, &linkedbase, modules, NUM_MODS, 0)) {
+		fprintf(stderr, "link modules failed\n");
+		return -1;
+	}
+
+	if (link_modules(NULL, &basenomods, NULL, 0, 0)) {
+		fprintf(stderr, "link modules failed\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+int linker_test_cleanup(void)
+{
+	int i;
+
+	ksu_policydb_destroy(&basenomods);
+	ksu_policydb_destroy(&linkedbase);
+
+	for (i = 0; i < NUM_MODS; i++) {
+		ksu_policydb_destroy(modules[i]);
+		free(modules[i]);
+	}
+	return 0;
+}
+
+static void test_linker_indexes(void)
+{
+	test_policydb_indexes(&linkedbase);
+}
+
+static void test_linker_roles(void)
+{
+	base_role_tests(&basenomods);
+	base_role_tests(&linkedbase);
+	module_role_tests(&linkedbase);
+}
+
+static void test_linker_types(void)
+{
+	base_type_tests(&basenomods);
+	base_type_tests(&linkedbase);
+	module_type_tests(&linkedbase);
+}
+
+static void test_linker_cond(void)
+{
+	base_cond_tests(&basenomods);
+	base_cond_tests(&linkedbase);
+	module_cond_tests(&linkedbase);
+}
+
+int linker_add_tests(CU_pSuite suite)
+{
+	if (NULL == CU_add_test(suite, "linker_indexes", test_linker_indexes)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	if (NULL == CU_add_test(suite, "linker_types", test_linker_types)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	if (NULL == CU_add_test(suite, "linker_roles", test_linker_roles)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	if (NULL == CU_add_test(suite, "linker_cond", test_linker_cond)) {
+		CU_cleanup_registry();
+		return CU_get_error();
+	}
+	return 0;
+}

kernel/libsepol/tests/test-linker.h

@@ -0,0 +1,30 @@
+/*
+ * Author: Joshua Brindle <jbrindle@tresys.com>
+ *
+ * Copyright (C) 2006 Tresys Technology, LLC
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef __TEST_LINKER_H__
+#define __TEST_LINKER_H__
+
+#include <CUnit/Basic.h>
+
+int linker_test_init(void);
+int linker_test_cleanup(void);
+int linker_add_tests(CU_pSuite suite);
+
+#endif