History

Merge tag 'selinux-pr-20221003' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull SELinux updates from Paul Moore: "Six SELinux patches, all are simple and easily understood, but a list of the highlights is below: - Use 'grep -E' instead of 'egrep' in the SELinux policy install script. Fun fact, this seems to be GregKH's *second* dedicated SELinux patch since we transitioned to git (ignoring merges, the SPDX stuff, and a trivial fs reference removal when lustre was yanked); the first was back in 2011 when selinuxfs was placed in /sys/fs/selinux. Oh, the memories ... - Convert the SELinux policy boolean values to use signed integer types throughout the SELinux kernel code. Prior to this we were using a mix of signed and unsigned integers which was probably okay in this particular case, but it is definitely not a good idea in general. - Remove a reference to the SELinux runtime disable functionality in /etc/selinux/config as we are in the process of deprecating that. See [1] for more background on this if you missed the previous notes on the deprecation. - Minor cleanups: remove unneeded variables and function parameter constification" Link: https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable [1] * tag 'selinux-pr-20221003' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: remove runtime disable message in the install_policy.sh script selinux: use "grep -E" instead of "egrep" selinux: remove the unneeded result variable selinux: declare read-only parameters const selinux: use int arrays for boolean values selinux: remove an unneeded variable in sel_make_class_dir_entries()

Linus Torvalds committed 4 years ago

Commit e816da22 parents eafb121 2fe2fb47 files · +48 −56Browse files

Unified · Split

7 files
  1. scripts/selinux/install_policy.sh +2 −3
  2. security/selinux/hooks.c +9 −15
  3. security/selinux/selinuxfs.c +6 −9
  4. security/selinux/ss/context.h +9 −8
  5. security/selinux/ss/ebitmap.c +11 −10
  6. security/selinux/ss/ebitmap.h +9 −9
  7. security/selinux/ss/mls_types.h +2 −2
scripts/selinux/install_policy.sh+2−3
@@ -31,8 +31,7 @@ fi · 30 unmodified lines
31if selinuxenabled; then31if selinuxenabled; then
32 echo "SELinux is already enabled"32 echo "SELinux is already enabled"
33 echo "This prevents safely relabeling all files."33 echo "This prevents safely relabeling all files."
34 echo "Boot with selinux=0 on the kernel command-line or"34 echo "Boot with selinux=0 on the kernel command-line."
35 echo "SELINUX=disabled in /etc/selinux/config."
36 exit 135 exit 1
37fi36fi
38 37
@@ -78,7 +77,7 @@ cd /etc/selinux/dummy/contexts/files · 39 unmodified lines
78$SF -F file_contexts /77$SF -F file_contexts /
79 78
80mounts=`cat /proc/$$/mounts | \79mounts=`cat /proc/$$/mounts | \
81 egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \80 grep -E "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \
82 awk '{ print $2 '}`81 awk '{ print $2 '}`
83$SF -F file_contexts $mounts82$SF -F file_contexts $mounts
84 83
security/selinux/hooks.c+9−15
@@ -5987,7 +5987,6 @@ static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq) · 5986 unmodified lines
5987 struct ipc_security_struct *isec;5987 struct ipc_security_struct *isec;
5988 struct common_audit_data ad;5988 struct common_audit_data ad;
5989 u32 sid = current_sid();5989 u32 sid = current_sid();
5990 int rc;
5991 5990
5992 isec = selinux_ipc(msq);5991 isec = selinux_ipc(msq);
5993 ipc_init_security(isec, SECCLASS_MSGQ);5992 ipc_init_security(isec, SECCLASS_MSGQ);
@@ -5995,10 +5994,9 @@ static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq) · 1 unmodified line
5995 ad.type = LSM_AUDIT_DATA_IPC;5994 ad.type = LSM_AUDIT_DATA_IPC;
5996 ad.u.ipc_id = msq->key;5995 ad.u.ipc_id = msq->key;
5997 5996
5998 rc = avc_has_perm(&selinux_state,5997 return avc_has_perm(&selinux_state,
5999 sid, isec->sid, SECCLASS_MSGQ,5998 sid, isec->sid, SECCLASS_MSGQ,
6000 MSGQ__CREATE, &ad);5999 MSGQ__CREATE, &ad);
6001 return rc;
6002}6000}
6003 6001
6004static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)6002static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
@@ -6126,7 +6124,6 @@ static int selinux_shm_alloc_security(struct kern_ipc_perm *shp) · 121 unmodified lines
6126 struct ipc_security_struct *isec;6124 struct ipc_security_struct *isec;
6127 struct common_audit_data ad;6125 struct common_audit_data ad;
6128 u32 sid = current_sid();6126 u32 sid = current_sid();
6129 int rc;
6130 6127
6131 isec = selinux_ipc(shp);6128 isec = selinux_ipc(shp);
6132 ipc_init_security(isec, SECCLASS_SHM);6129 ipc_init_security(isec, SECCLASS_SHM);
@@ -6134,10 +6131,9 @@ static int selinux_shm_alloc_security(struct kern_ipc_perm *shp) · 1 unmodified line
6134 ad.type = LSM_AUDIT_DATA_IPC;6131 ad.type = LSM_AUDIT_DATA_IPC;
6135 ad.u.ipc_id = shp->key;6132 ad.u.ipc_id = shp->key;
6136 6133
6137 rc = avc_has_perm(&selinux_state,6134 return avc_has_perm(&selinux_state,
6138 sid, isec->sid, SECCLASS_SHM,6135 sid, isec->sid, SECCLASS_SHM,
6139 SHM__CREATE, &ad);6136 SHM__CREATE, &ad);
6140 return rc;
6141}6137}
6142 6138
6143static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)6139static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
@@ -6211,7 +6207,6 @@ static int selinux_sem_alloc_security(struct kern_ipc_perm *sma) · 67 unmodified lines
6211 struct ipc_security_struct *isec;6207 struct ipc_security_struct *isec;
6212 struct common_audit_data ad;6208 struct common_audit_data ad;
6213 u32 sid = current_sid();6209 u32 sid = current_sid();
6214 int rc;
6215 6210
6216 isec = selinux_ipc(sma);6211 isec = selinux_ipc(sma);
6217 ipc_init_security(isec, SECCLASS_SEM);6212 ipc_init_security(isec, SECCLASS_SEM);
@@ -6219,10 +6214,9 @@ static int selinux_sem_alloc_security(struct kern_ipc_perm *sma) · 1 unmodified line
6219 ad.type = LSM_AUDIT_DATA_IPC;6214 ad.type = LSM_AUDIT_DATA_IPC;
6220 ad.u.ipc_id = sma->key;6215 ad.u.ipc_id = sma->key;
6221 6216
6222 rc = avc_has_perm(&selinux_state,6217 return avc_has_perm(&selinux_state,
6223 sid, isec->sid, SECCLASS_SEM,6218 sid, isec->sid, SECCLASS_SEM,
6224 SEM__CREATE, &ad);6219 SEM__CREATE, &ad);
6225 return rc;
6226}6220}
6227 6221
6228static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)6222static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
security/selinux/selinuxfs.c+6−9
@@ -71,7 +71,7 @@ struct selinux_fs_info { · 70 unmodified lines
71 struct dentry *bool_dir;71 struct dentry *bool_dir;
72 unsigned int bool_num;72 unsigned int bool_num;
73 char **bool_pending_names;73 char **bool_pending_names;
74 unsigned int *bool_pending_values;74 int *bool_pending_values;
75 struct dentry *class_dir;75 struct dentry *class_dir;
76 unsigned long last_class_ino;76 unsigned long last_class_ino;
77 bool policy_opened;77 bool policy_opened;
@@ -356,7 +356,7 @@ static const struct file_operations sel_policyvers_ops = { · 278 unmodified lines
356/* declaration for sel_write_load */356/* declaration for sel_write_load */
357static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,357static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,
358 unsigned int *bool_num, char ***bool_pending_names,358 unsigned int *bool_num, char ***bool_pending_names,
359 unsigned int **bool_pending_values);359 int **bool_pending_values);
360static int sel_make_classes(struct selinux_policy *newpolicy,360static int sel_make_classes(struct selinux_policy *newpolicy,
361 struct dentry *class_dir,361 struct dentry *class_dir,
362 unsigned long *last_class_ino);362 unsigned long *last_class_ino);
@@ -527,7 +527,7 @@ static const struct file_operations sel_policy_ops = { · 164 unmodified lines
527};527};
528 528
529static void sel_remove_old_bool_data(unsigned int bool_num, char **bool_names,529static void sel_remove_old_bool_data(unsigned int bool_num, char **bool_names,
530 unsigned int *bool_values)530 int *bool_values)
531{531{
532 u32 i;532 u32 i;
533 533
@@ -545,7 +545,7 @@ static int sel_make_policy_nodes(struct selinux_fs_info *fsi, · 11 unmodified lines
545 struct dentry *tmp_parent, *tmp_bool_dir, *tmp_class_dir, *old_dentry;545 struct dentry *tmp_parent, *tmp_bool_dir, *tmp_class_dir, *old_dentry;
546 unsigned int tmp_bool_num, old_bool_num;546 unsigned int tmp_bool_num, old_bool_num;
547 char **tmp_bool_names, **old_bool_names;547 char **tmp_bool_names, **old_bool_names;
548 unsigned int *tmp_bool_values, *old_bool_values;548 int *tmp_bool_values, *old_bool_values;
549 unsigned long tmp_ino = fsi->last_ino; /* Don't increment last_ino in this function */549 unsigned long tmp_ino = fsi->last_ino; /* Don't increment last_ino in this function */
550 550
551 tmp_parent = sel_make_disconnected_dir(fsi->sb, &tmp_ino);551 tmp_parent = sel_make_disconnected_dir(fsi->sb, &tmp_ino);
@@ -1423,7 +1423,7 @@ static void sel_remove_entries(struct dentry *de) · 871 unmodified lines
1423 1423
1424static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,1424static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,
1425 unsigned int *bool_num, char ***bool_pending_names,1425 unsigned int *bool_num, char ***bool_pending_names,
1426 unsigned int **bool_pending_values)1426 int **bool_pending_values)
1427{1427{
1428 int ret;1428 int ret;
1429 ssize_t len;1429 ssize_t len;
@@ -1917,7 +1917,6 @@ static int sel_make_class_dir_entries(struct selinux_policy *newpolicy, · 487 unmodified lines
1917 struct selinux_fs_info *fsi = sb->s_fs_info;1917 struct selinux_fs_info *fsi = sb->s_fs_info;
1918 struct dentry *dentry = NULL;1918 struct dentry *dentry = NULL;
1919 struct inode *inode = NULL;1919 struct inode *inode = NULL;
1920 int rc;
1921 1920
1922 dentry = d_alloc_name(dir, "index");1921 dentry = d_alloc_name(dir, "index");
1923 if (!dentry)1922 if (!dentry)
@@ -1937,9 +1936,7 @@ static int sel_make_class_dir_entries(struct selinux_policy *newpolicy, · 13 unmodified lines
1937 if (IS_ERR(dentry))1936 if (IS_ERR(dentry))
1938 return PTR_ERR(dentry);1937 return PTR_ERR(dentry);
1939 1938
1940 rc = sel_make_perm_files(newpolicy, classname, index, dentry);1939 return sel_make_perm_files(newpolicy, classname, index, dentry);
1941
1942 return rc;
1943}1940}
1944 1941
1945static int sel_make_classes(struct selinux_policy *newpolicy,1942static int sel_make_classes(struct selinux_policy *newpolicy,
security/selinux/ss/context.h+9−8
@@ -38,7 +38,7 @@ static inline void mls_context_init(struct context *c) · 37 unmodified lines
38 memset(&c->range, 0, sizeof(c->range));38 memset(&c->range, 0, sizeof(c->range));
39}39}
40 40
41static inline int mls_context_cpy(struct context *dst, struct context *src)41static inline int mls_context_cpy(struct context *dst, const struct context *src)
42{42{
43 int rc;43 int rc;
44 44
@@ -58,7 +58,7 @@ out: · 13 unmodified lines
58/*58/*
59 * Sets both levels in the MLS range of 'dst' to the low level of 'src'.59 * Sets both levels in the MLS range of 'dst' to the low level of 'src'.
60 */60 */
61static inline int mls_context_cpy_low(struct context *dst, struct context *src)61static inline int mls_context_cpy_low(struct context *dst, const struct context *src)
62{62{
63 int rc;63 int rc;
64 64
@@ -78,7 +78,7 @@ out: · 13 unmodified lines
78/*78/*
79 * Sets both levels in the MLS range of 'dst' to the high level of 'src'.79 * Sets both levels in the MLS range of 'dst' to the high level of 'src'.
80 */80 */
81static inline int mls_context_cpy_high(struct context *dst, struct context *src)81static inline int mls_context_cpy_high(struct context *dst, const struct context *src)
82{82{
83 int rc;83 int rc;
84 84
@@ -97,9 +97,10 @@ out: · 12 unmodified lines
97 97
98 98
99static inline int mls_context_glblub(struct context *dst,99static inline int mls_context_glblub(struct context *dst,
100 struct context *c1, struct context *c2)100 const struct context *c1, const struct context *c2)
101{101{
102 struct mls_range *dr = &dst->range, *r1 = &c1->range, *r2 = &c2->range;102 struct mls_range *dr = &dst->range;
103 const struct mls_range *r1 = &c1->range, *r2 = &c2->range;
103 int rc = 0;104 int rc = 0;
104 105
105 if (r1->level[1].sens < r2->level[0].sens ||106 if (r1->level[1].sens < r2->level[0].sens ||
@@ -127,7 +128,7 @@ out: · 21 unmodified lines
127 return rc;128 return rc;
128}129}
129 130
130static inline int mls_context_cmp(struct context *c1, struct context *c2)131static inline int mls_context_cmp(const struct context *c1, const struct context *c2)
131{132{
132 return ((c1->range.level[0].sens == c2->range.level[0].sens) &&133 return ((c1->range.level[0].sens == c2->range.level[0].sens) &&
133 ebitmap_cmp(&c1->range.level[0].cat, &c2->range.level[0].cat) &&134 ebitmap_cmp(&c1->range.level[0].cat, &c2->range.level[0].cat) &&
@@ -147,7 +148,7 @@ static inline void context_init(struct context *c) · 13 unmodified lines
147 memset(c, 0, sizeof(*c));148 memset(c, 0, sizeof(*c));
148}149}
149 150
150static inline int context_cpy(struct context *dst, struct context *src)151static inline int context_cpy(struct context *dst, const struct context *src)
151{152{
152 int rc;153 int rc;
153 154
@@ -180,7 +181,7 @@ static inline void context_destroy(struct context *c) · 26 unmodified lines
180 mls_context_destroy(c);181 mls_context_destroy(c);
181}182}
182 183
183static inline int context_cmp(struct context *c1, struct context *c2)184static inline int context_cmp(const struct context *c1, const struct context *c2)
184{185{
185 if (c1->len && c2->len)186 if (c1->len && c2->len)
186 return (c1->len == c2->len && !strcmp(c1->str, c2->str));187 return (c1->len == c2->len && !strcmp(c1->str, c2->str));
security/selinux/ss/ebitmap.c+11−10
@@ -28,9 +28,9 @@ · 27 unmodified lines
28 28
29static struct kmem_cache *ebitmap_node_cachep __ro_after_init;29static struct kmem_cache *ebitmap_node_cachep __ro_after_init;
30 30
31int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2)31int ebitmap_cmp(const struct ebitmap *e1, const struct ebitmap *e2)
32{32{
33 struct ebitmap_node *n1, *n2;33 const struct ebitmap_node *n1, *n2;
34 34
35 if (e1->highbit != e2->highbit)35 if (e1->highbit != e2->highbit)
36 return 0;36 return 0;
@@ -50,9 +50,10 @@ int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2) · 13 unmodified lines
50 return 1;50 return 1;
51}51}
52 52
53int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src)53int ebitmap_cpy(struct ebitmap *dst, const struct ebitmap *src)
54{54{
55 struct ebitmap_node *n, *new, *prev;55 struct ebitmap_node *new, *prev;
56 const struct ebitmap_node *n;
56 57
57 ebitmap_init(dst);58 ebitmap_init(dst);
58 n = src->node;59 n = src->node;
@@ -78,7 +79,7 @@ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src) · 19 unmodified lines
78 return 0;79 return 0;
79}80}
80 81
81int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2)82int ebitmap_and(struct ebitmap *dst, const struct ebitmap *e1, const struct ebitmap *e2)
82{83{
83 struct ebitmap_node *n;84 struct ebitmap_node *n;
84 int bit, rc;85 int bit, rc;
@@ -217,9 +218,9 @@ netlbl_import_failure: · 132 unmodified lines
217 * if last_e2bit is non-zero, the highest set bit in e2 cannot exceed218 * if last_e2bit is non-zero, the highest set bit in e2 cannot exceed
218 * last_e2bit.219 * last_e2bit.
219 */220 */
220int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit)221int ebitmap_contains(const struct ebitmap *e1, const struct ebitmap *e2, u32 last_e2bit)
221{222{
222 struct ebitmap_node *n1, *n2;223 const struct ebitmap_node *n1, *n2;
223 int i;224 int i;
224 225
225 if (e1->highbit < e2->highbit)226 if (e1->highbit < e2->highbit)
@@ -258,9 +259,9 @@ int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit) · 32 unmodified lines
258 return 1;259 return 1;
259}260}
260 261
261int ebitmap_get_bit(struct ebitmap *e, unsigned long bit)262int ebitmap_get_bit(const struct ebitmap *e, unsigned long bit)
262{263{
263 struct ebitmap_node *n;264 const struct ebitmap_node *n;
264 265
265 if (e->highbit < bit)266 if (e->highbit < bit)
266 return 0;267 return 0;
@@ -467,7 +468,7 @@ bad: · 200 unmodified lines
467 goto out;468 goto out;
468}469}
469 470
470int ebitmap_write(struct ebitmap *e, void *fp)471int ebitmap_write(const struct ebitmap *e, void *fp)
471{472{
472 struct ebitmap_node *n;473 struct ebitmap_node *n;
473 u32 count;474 u32 count;
security/selinux/ss/ebitmap.h+9−9
@@ -44,7 +44,7 @@ struct ebitmap { · 43 unmodified lines
44 44
45#define ebitmap_length(e) ((e)->highbit)45#define ebitmap_length(e) ((e)->highbit)
46 46
47static inline unsigned int ebitmap_start_positive(struct ebitmap *e,47static inline unsigned int ebitmap_start_positive(const struct ebitmap *e,
48 struct ebitmap_node **n)48 struct ebitmap_node **n)
49{49{
50 unsigned int ofs;50 unsigned int ofs;
@@ -62,7 +62,7 @@ static inline void ebitmap_init(struct ebitmap *e) · 11 unmodified lines
62 memset(e, 0, sizeof(*e));62 memset(e, 0, sizeof(*e));
63}63}
64 64
65static inline unsigned int ebitmap_next_positive(struct ebitmap *e,65static inline unsigned int ebitmap_next_positive(const struct ebitmap *e,
66 struct ebitmap_node **n,66 struct ebitmap_node **n,
67 unsigned int bit)67 unsigned int bit)
68{68{
@@ -85,7 +85,7 @@ static inline unsigned int ebitmap_next_positive(struct ebitmap *e, · 16 unmodified lines
85#define EBITMAP_NODE_OFFSET(node, bit) \85#define EBITMAP_NODE_OFFSET(node, bit) \
86 (((bit) - (node)->startbit) % EBITMAP_UNIT_SIZE)86 (((bit) - (node)->startbit) % EBITMAP_UNIT_SIZE)
87 87
88static inline int ebitmap_node_get_bit(struct ebitmap_node *n,88static inline int ebitmap_node_get_bit(const struct ebitmap_node *n,
89 unsigned int bit)89 unsigned int bit)
90{90{
91 unsigned int index = EBITMAP_NODE_INDEX(n, bit);91 unsigned int index = EBITMAP_NODE_INDEX(n, bit);
@@ -122,15 +122,15 @@ static inline void ebitmap_node_clr_bit(struct ebitmap_node *n, · 30 unmodified lines
122 (bit) < ebitmap_length(e); \122 (bit) < ebitmap_length(e); \
123 (bit) = ebitmap_next_positive(e, &(n), bit)) \123 (bit) = ebitmap_next_positive(e, &(n), bit)) \
124 124
125int ebitmap_cmp(struct ebitmap *e1, struct ebitmap *e2);125int ebitmap_cmp(const struct ebitmap *e1, const struct ebitmap *e2);
126int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src);126int ebitmap_cpy(struct ebitmap *dst, const struct ebitmap *src);
127int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2);127int ebitmap_and(struct ebitmap *dst, const struct ebitmap *e1, const struct ebitmap *e2);
128int ebitmap_contains(struct ebitmap *e1, struct ebitmap *e2, u32 last_e2bit);128int ebitmap_contains(const struct ebitmap *e1, const struct ebitmap *e2, u32 last_e2bit);
129int ebitmap_get_bit(struct ebitmap *e, unsigned long bit);129int ebitmap_get_bit(const struct ebitmap *e, unsigned long bit);
130int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);130int ebitmap_set_bit(struct ebitmap *e, unsigned long bit, int value);
131void ebitmap_destroy(struct ebitmap *e);131void ebitmap_destroy(struct ebitmap *e);
132int ebitmap_read(struct ebitmap *e, void *fp);132int ebitmap_read(struct ebitmap *e, void *fp);
133int ebitmap_write(struct ebitmap *e, void *fp);133int ebitmap_write(const struct ebitmap *e, void *fp);
134u32 ebitmap_hash(const struct ebitmap *e, u32 hash);134u32 ebitmap_hash(const struct ebitmap *e, u32 hash);
135 135
136#ifdef CONFIG_NETLABEL136#ifdef CONFIG_NETLABEL
security/selinux/ss/mls_types.h+2−2
@@ -27,13 +27,13 @@ struct mls_range { · 26 unmodified lines
27 struct mls_level level[2]; /* low == level[0], high == level[1] */27 struct mls_level level[2]; /* low == level[0], high == level[1] */
28};28};
29 29
30static inline int mls_level_eq(struct mls_level *l1, struct mls_level *l2)30static inline int mls_level_eq(const struct mls_level *l1, const struct mls_level *l2)
31{31{
32 return ((l1->sens == l2->sens) &&32 return ((l1->sens == l2->sens) &&
33 ebitmap_cmp(&l1->cat, &l2->cat));33 ebitmap_cmp(&l1->cat, &l2->cat));
34}34}
35 35
36static inline int mls_level_dom(struct mls_level *l1, struct mls_level *l2)36static inline int mls_level_dom(const struct mls_level *l1, const struct mls_level *l2)
37{37{
38 return ((l1->sens >= l2->sens) &&38 return ((l1->sens >= l2->sens) &&
39 ebitmap_contains(&l1->cat, &l2->cat, 0));39 ebitmap_contains(&l1->cat, &l2->cat, 0));