Policies are not generated in order/not reproduceable #84
Description
Describe the bug
When generating selinux policies in CI, one expects that subsequent calls to Udica will generate the same policy, however, this doesn't seem to be the case. While the policies are equivalent, the order of the items in the policy differs. This makes it really hard to detect if new changes come in the policy as the container evolves, and thus, prevents us from checking this in CI.
For instance:
$ diff /tmp/ci/selinuxd.cil selinuxd/security/selinuxd.cil
5,7d4
< (allow process sysfs_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
< (allow process sysfs_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
< (allow process sysfs_t ( sock_file ( append getattr open read write )))
22a20,22
> (allow process sysfs_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
> (allow process sysfs_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
> (allow process sysfs_t ( sock_file ( append getattr open read write ))) While that diff doesn't differ in content, the issue there is that that section was created a different order in the policy.
To Reproduce
Steps to reproduce the behavior:
- generate a policy for a container and store the file
- run the policy generation again and store the file
- diff them
Expected behavior
Running Udica for a container should always generate the same policy in the same order (so commands like diff show they're equivalent.