checkpolicy,libsepol: add prefix/suffix matching to filename type transitions

[JurajMarcin]

Currently, filename transitions are stored separately from other type enforcement rules and only support exact name matching. However, in practice, the names contain variable parts. This leads to many duplicated rules in the policy that differ only in the part of the name, or it is even impossible to cover all possible combinations.

This patch implements the equivalent changes made by this kernel patch [1].

This patch updates the policydb structure to contain prefix and suffix filename transition tables along normal filename transitions table and updates the code that accesses those tables. Furthermore, it adds match_type attribute to module and CIL structures that store filename transitions and updates functions that parse conf and CIL policy files.

This patch does not significantly change the binary policy size when prefix/suffix rules are not used. On the other hand, with prefix/suffix rules, the number of filename transitions can be reduced, and therefore also binary policy size can be reduced.

Syntax of the new prefix/suffix filename transition rule:

type_transition source_type target_type : class default_type object_name match_type;

(typetransition source_type_id target_type_id class_id object_name match_type default_type_id)

where match_type is either keyword "prefix" or "suffix"

Examples:

type_transition ta tb:CLASS01 tc "file01" prefix;
type_transition td te:CLASS01 tf "file02" suffix;

(typetransition ta tb CLASS01 "file01" prefix td)
(typetransition td te CLASS01 "file02" suffix tf)

[1]: TODO: PASTE LINK

[WOnder93]

Just minor issues found.

[WOnder93]

The commit still does an unrelated whitespace change, which is often considered to be a bad practice. It's better to leave it as it is and submit the empty line removal as a separate patch.

[JurajMarcin]

Oh, I thought that the spaces and also the line was added by me by accident. Will remove it from the patch.