checkpolicy: implement handling of unknown classes and permissions

Add a new command line options, -U (allow,reject,deny), to checkmodule and checkpolicy which sets the handle_unknown config flag. Default to deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

diff -Naupr checkpolicy-2.0.3.orig/checkmodule.c checkpolicy-2.0.3/checkmodule.c

checkmodule.c +29 -2

@@ -39,6 +39,7 @@ extern int optind;
 static sidtab_t sidtab;
 
 extern int mlspol;
+extern int handle_unknown;
 
 static char *txtfile = "policy.conf";
 static char *binfile = "policy";

@@ -121,6 +122,7 @@ static int write_binary_policy(policydb_
 
 	p->policy_type = policy_type;
 	p->policyvers = policyvers;
+	p->handle_unknown = handle_unknown;
 
 	pf.type = PF_USE_STDIO;
 	pf.fp = outfp;

@@ -135,13 +137,17 @@ static int write_binary_policy(policydb_
 
 static void usage(char *progname)
 {
-	printf("usage:  %s [-V] [-b] [-m] [-M] [-o FILE] [INPUT]\n", progname);
+	printf("usage:  %s [-V] [-b] [-U handle_unknown] [-m] [-M] [-o FILE] [INPUT]\n", progname);
 	printf("Build base and policy modules.\n");
 	printf("Options:\n");
 	printf("  INPUT      build module from INPUT (else read from \"%s\")\n",
 	       txtfile);
 	printf("  -V         show policy versions created by this program\n");
 	printf("  -b         treat input as a binary policy file\n");
+	printf("  -U OPTION  How to handle unknown classes and permissions\n");
+	printf("               deny: Deny unknown kernel checks\n");
+	printf("               reject: Reject loading of policy with unknowns\n");
+	printf("               allow: Allow unknown kernel checks\n");
 	printf("  -m         build a policy module instead of a base module\n");
 	printf("  -M         enable MLS policy\n");
 	printf("  -o FILE    write module to FILE (else just check syntax)\n");

@@ -156,7 +162,7 @@ int main(int argc, char **argv)
 	int show_version = 0;
 	policydb_t modpolicydb;
 
-	while ((ch = getopt(argc, argv, "ho:dbVmM")) != EOF) {
+	while ((ch = getopt(argc, argv, "ho:dbVU:mM")) != EOF) {
 		switch (ch) {
 		case 'h':
 			usage(argv[0]);

@@ -171,6 +177,20 @@ int main(int argc, char **argv)
 		case 'V':
 			show_version = 1;
 			break;
+		case 'U':
+			if (!strcasecmp(optarg, "deny")) {
+				handle_unknown = DENY_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "reject")) {
+				handle_unknown = REJECT_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "allow")) {
+				handle_unknown = ALLOW_UNKNOWN;
+				break;
+			}
+			usage(argv[0]);
 		case 'm':
 			policy_type = POLICY_MOD;
 			policyvers = MOD_POLICYDB_VERSION_MAX;

@@ -189,6 +209,12 @@ int main(int argc, char **argv)
 		exit(0);
 	}
 
+	if (handle_unknown && (policy_type != POLICY_BASE)) {
+		printf("Handling of unknown classes and permissions is only ");
+		printf("valid in the base module\n");
+		exit(1);
+	}
+
 	if (optind != argc) {
 		file = argv[optind++];
 		if (optind != argc)

@@ -214,6 +240,7 @@ int main(int argc, char **argv)
 
 		modpolicydb.policy_type = policy_type;
 		modpolicydb.mls = mlspol;
+		modpolicydb.handle_unknown = handle_unknown;
 
 		if (read_source_policy(&modpolicydb, file, argv[0]) == -1) {
 			exit(1);

diff -Naupr checkpolicy-2.0.3.orig/checkpolicy.c checkpolicy-2.0.3/checkpolicy.c

checkpolicy.c +18 -2

@@ -90,6 +90,7 @@ static sidtab_t sidtab;
 
 extern policydb_t *policydbp;
 extern int mlspol;
+extern int handle_unknown;
 
 static char *txtfile = "policy.conf";
 static char *binfile = "policy";

@@ -99,7 +100,7 @@ unsigned int policyvers = POLICYDB_VERSI
 void usage(char *progname)
 {
 	printf
-	    ("usage:  %s [-b] [-d] [-M] [-c policyvers (%d-%d)] [-o output_file] [input_file]\n",
+	    ("usage:  %s [-b] [-d] [-U handle_unknown (allow,deny,reject) [-M] [-c policyvers (%d-%d)] [-o output_file] [input_file]\n",
 	     progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
 	exit(1);
 }

@@ -390,7 +391,7 @@ int main(int argc, char **argv)
 	int show_version = 0;
 	struct policy_file pf;
 
-	while ((ch = getopt(argc, argv, "o:dbMVc:")) != EOF) {
+	while ((ch = getopt(argc, argv, "o:dbU:MVc:")) != EOF) {
 		switch (ch) {
 		case 'o':
 			outfile = optarg;

@@ -405,6 +406,20 @@ int main(int argc, char **argv)
 		case 'V':
 			show_version = 1;
 			break;
+		case 'U':
+			if (!strcasecmp(optarg, "deny")) {
+				handle_unknown = DENY_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "allow")) {
+				handle_unknown = ALLOW_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "reject")) {
+				handle_unknown = REJECT_UNKNOWN;
+				break;
+			}
+			usage(argv[0]);
 		case 'M':
 			mlspol = 1;
 			break;

@@ -515,6 +530,7 @@ int main(int argc, char **argv)
 
 		/* Let sepol know if we are dealing with MLS support */
 		parse_policy.mls = mlspol;
+		parse_policy.handle_unknown = handle_unknown;
 
 		policydbp = &parse_policy;
 

diff -Naupr checkpolicy-2.0.3.orig/policy_parse.y checkpolicy-2.0.3/policy_parse.y

policy_parse.y +1 -0

@@ -67,6 +67,7 @@ queue_t id_queue = 0;
 static unsigned int pass;
 char *curfile = 0;
 int mlspol = 0;
+int handle_unknown = 0;
 
 extern unsigned long policydb_lineno;
 extern unsigned long source_lineno;

diff -Naupr checkpolicy-2.0.3.orig/test/dismod.c checkpolicy-2.0.3/test/dismod.c

test/dismod.c +16 -0

@@ -665,6 +665,17 @@ int display_avblock(int field, uint32_t 
 	return 0;
 }
 
+int display_handle_unknown(policydb_t * policydb, FILE * out_fp)
+{
+	if (policydb->handle_unknown == ALLOW_UNKNOWN)
+		fprintf(out_fp, "Allow unknown classes and perms\n");
+	else if (policydb->handle_unknown == DENY_UNKNOWN)
+		fprintf(out_fp, "Deny unknown classes and perms\n");
+	else if (policydb->handle_unknown == REJECT_UNKNOWN)
+		fprintf(out_fp, "Reject unknown classes and perms\n");
+	return 0;
+}
+
 static int read_policy(char *filename, policydb_t * policy)
 {
 	FILE *in_fp;

@@ -771,6 +782,7 @@ int menu()
 	printf("a)  Display avrule requirements\n");
 	printf("b)  Display avrule declarations\n");
 	printf("l)  Link in a module\n");
+	printf("u)  Display the unknown handling setting\n");
 	printf("\n");
 	printf("f)  set output file\n");
 	printf("m)  display menu\n");

@@ -879,6 +891,10 @@ int main(int argc, char **argv)
 			fprintf(out_fp, "avrule block declarations:\n");
 			display_avblock(6, 0, &policydb, out_fp);
 			break;
+		case 'u':
+		case 'U':
+			display_handle_unknown(&policydb, out_fp);
+			break;
 		case 'f':
 			printf
 			    ("\nFilename for output (<CR> for screen output): ");

diff -Naupr checkpolicy-2.0.3.orig/test/dispol.c checkpolicy-2.0.3/test/dispol.c

test/dispol.c +16 -1

@@ -273,6 +273,17 @@ int display_cond_expressions(policydb_t 
 	return 1;
 }
 
+int display_handle_unknown(policydb_t * policydb, FILE * out_fp)
+{
+	if (policydb->handle_unknown == ALLOW_UNKNOWN)
+		fprintf(out_fp, "Allow unknown classes and permisions\n");
+	else if (policydb->handle_unknown == DENY_UNKNOWN)
+		fprintf(out_fp, "Deny unknown classes and permisions\n");
+	else if (policydb->handle_unknown == REJECT_UNKNOWN)
+		fprintf(out_fp, "Reject unknown classes and permisions\n");
+	return 0;
+}
+
 int change_bool(char *name, int state, policydb_t * p, FILE * fp)
 {
 	cond_bool_datum_t *bool;

@@ -298,6 +309,7 @@ int menu()
 	printf("6)  display conditional expressions\n");
 	printf("7)  change a boolean value\n");
 	printf("\n");
+	printf("u)  display unknown handling setting\n");
 	printf("f)  set output file\n");
 	printf("m)  display menu\n");
 	printf("q)  quit\n");

@@ -409,6 +421,10 @@ int main(int argc, char **argv)
 			change_bool(name, state, &policydb, out_fp);
 			free(name);
 			break;
+		case 'u':
+		case 'U':
+			display_handle_unknown(&policydb, out_fp);
+			break;
 		case 'f':
 			printf
 			    ("\nFilename for output (<CR> for screen output): ");
 
 
 
--

This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Add a new command line options, -U (allow,reject,deny), to checkmodule and checkpolicy which sets the handle_unknown config flag. Default to deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

diff -Naupr checkpolicy-2.0.3.orig/checkmodule.c checkpolicy-2.0.3/checkmodule.c

checkmodule.c +29 -2

@@ -39,6 +39,7 @@ extern int optind;
 static sidtab_t sidtab;
 
 extern int mlspol;
+extern int handle_unknown;
 
 static char *txtfile = "policy.conf";
 static char *binfile = "policy";

@@ -121,6 +122,7 @@ static int write_binary_policy(policydb_
 
 	p->policy_type = policy_type;
 	p->policyvers = policyvers;
+	p->handle_unknown = handle_unknown;
 
 	pf.type = PF_USE_STDIO;
 	pf.fp = outfp;

@@ -135,13 +137,17 @@ static int write_binary_policy(policydb_
 
 static void usage(char *progname)
 {
-	printf("usage:  %s [-V] [-b] [-m] [-M] [-o FILE] [INPUT]\n", progname);
+	printf("usage:  %s [-V] [-b] [-U handle_unknown] [-m] [-M] [-o FILE] [INPUT]\n", progname);
 	printf("Build base and policy modules.\n");
 	printf("Options:\n");
 	printf("  INPUT      build module from INPUT (else read from \"%s\")\n",
 	       txtfile);
 	printf("  -V         show policy versions created by this program\n");
 	printf("  -b         treat input as a binary policy file\n");
+	printf("  -U OPTION  How to handle unknown classes and permissions\n");
+	printf("               deny: Deny unknown kernel checks\n");
+	printf("               reject: Reject loading of policy with unknowns\n");
+	printf("               allow: Allow unknown kernel checks\n");
 	printf("  -m         build a policy module instead of a base module\n");
 	printf("  -M         enable MLS policy\n");
 	printf("  -o FILE    write module to FILE (else just check syntax)\n");

@@ -156,7 +162,7 @@ int main(int argc, char **argv)
 	int show_version = 0;
 	policydb_t modpolicydb;
 
-	while ((ch = getopt(argc, argv, "ho:dbVmM")) != EOF) {
+	while ((ch = getopt(argc, argv, "ho:dbVU:mM")) != EOF) {
 		switch (ch) {
 		case 'h':
 			usage(argv[0]);

@@ -171,6 +177,20 @@ int main(int argc, char **argv)
 		case 'V':
 			show_version = 1;
 			break;
+		case 'U':
+			if (!strcasecmp(optarg, "deny")) {
+				handle_unknown = DENY_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "reject")) {
+				handle_unknown = REJECT_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "allow")) {
+				handle_unknown = ALLOW_UNKNOWN;
+				break;
+			}
+			usage(argv[0]);
 		case 'm':
 			policy_type = POLICY_MOD;
 			policyvers = MOD_POLICYDB_VERSION_MAX;

@@ -189,6 +209,12 @@ int main(int argc, char **argv)
 		exit(0);
 	}
 
+	if (handle_unknown && (policy_type != POLICY_BASE)) {
+		printf("Handling of unknown classes and permissions is only ");
+		printf("valid in the base module\n");
+		exit(1);
+	}
+
 	if (optind != argc) {
 		file = argv[optind++];
 		if (optind != argc)

@@ -214,6 +240,7 @@ int main(int argc, char **argv)
 
 		modpolicydb.policy_type = policy_type;
 		modpolicydb.mls = mlspol;
+		modpolicydb.handle_unknown = handle_unknown;
 
 		if (read_source_policy(&modpolicydb, file, argv[0]) == -1) {
 			exit(1);

diff -Naupr checkpolicy-2.0.3.orig/checkpolicy.c checkpolicy-2.0.3/checkpolicy.c

checkpolicy.c +18 -2

@@ -90,6 +90,7 @@ static sidtab_t sidtab;
 
 extern policydb_t *policydbp;
 extern int mlspol;
+extern int handle_unknown;
 
 static char *txtfile = "policy.conf";
 static char *binfile = "policy";

@@ -99,7 +100,7 @@ unsigned int policyvers = POLICYDB_VERSI
 void usage(char *progname)
 {
 	printf
-	    ("usage:  %s [-b] [-d] [-M] [-c policyvers (%d-%d)] [-o output_file] [input_file]\n",
+	    ("usage:  %s [-b] [-d] [-U handle_unknown (allow,deny,reject) [-M] [-c policyvers (%d-%d)] [-o output_file] [input_file]\n",
 	     progname, POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);
 	exit(1);
 }

@@ -390,7 +391,7 @@ int main(int argc, char **argv)
 	int show_version = 0;
 	struct policy_file pf;
 
-	while ((ch = getopt(argc, argv, "o:dbMVc:")) != EOF) {
+	while ((ch = getopt(argc, argv, "o:dbU:MVc:")) != EOF) {
 		switch (ch) {
 		case 'o':
 			outfile = optarg;

@@ -405,6 +406,20 @@ int main(int argc, char **argv)
 		case 'V':
 			show_version = 1;
 			break;
+		case 'U':
+			if (!strcasecmp(optarg, "deny")) {
+				handle_unknown = DENY_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "allow")) {
+				handle_unknown = ALLOW_UNKNOWN;
+				break;
+			}
+			if (!strcasecmp(optarg, "reject")) {
+				handle_unknown = REJECT_UNKNOWN;
+				break;
+			}
+			usage(argv[0]);
 		case 'M':
 			mlspol = 1;
 			break;

@@ -515,6 +530,7 @@ int main(int argc, char **argv)
 
 		/* Let sepol know if we are dealing with MLS support */
 		parse_policy.mls = mlspol;
+		parse_policy.handle_unknown = handle_unknown;
 
 		policydbp = &parse_policy;
 

diff -Naupr checkpolicy-2.0.3.orig/policy_parse.y checkpolicy-2.0.3/policy_parse.y

policy_parse.y +1 -0

@@ -67,6 +67,7 @@ queue_t id_queue = 0;
 static unsigned int pass;
 char *curfile = 0;
 int mlspol = 0;
+int handle_unknown = 0;
 
 extern unsigned long policydb_lineno;
 extern unsigned long source_lineno;

diff -Naupr checkpolicy-2.0.3.orig/test/dismod.c checkpolicy-2.0.3/test/dismod.c

test/dismod.c +16 -0

@@ -665,6 +665,17 @@ int display_avblock(int field, uint32_t 
 	return 0;
 }
 
+int display_handle_unknown(policydb_t * policydb, FILE * out_fp)
+{
+	if (policydb->handle_unknown == ALLOW_UNKNOWN)
+		fprintf(out_fp, "Allow unknown classes and perms\n");
+	else if (policydb->handle_unknown == DENY_UNKNOWN)
+		fprintf(out_fp, "Deny unknown classes and perms\n");
+	else if (policydb->handle_unknown == REJECT_UNKNOWN)
+		fprintf(out_fp, "Reject unknown classes and perms\n");
+	return 0;
+}
+
 static int read_policy(char *filename, policydb_t * policy)
 {
 	FILE *in_fp;

@@ -771,6 +782,7 @@ int menu()
 	printf("a)  Display avrule requirements\n");
 	printf("b)  Display avrule declarations\n");
 	printf("l)  Link in a module\n");
+	printf("u)  Display the unknown handling setting\n");
 	printf("\n");
 	printf("f)  set output file\n");
 	printf("m)  display menu\n");

@@ -879,6 +891,10 @@ int main(int argc, char **argv)
 			fprintf(out_fp, "avrule block declarations:\n");
 			display_avblock(6, 0, &policydb, out_fp);
 			break;
+		case 'u':
+		case 'U':
+			display_handle_unknown(&policydb, out_fp);
+			break;
 		case 'f':
 			printf
 			    ("\nFilename for output (<CR> for screen output): ");

diff -Naupr checkpolicy-2.0.3.orig/test/dispol.c checkpolicy-2.0.3/test/dispol.c

test/dispol.c +16 -1

@@ -273,6 +273,17 @@ int display_cond_expressions(policydb_t 
 	return 1;
 }
 
+int display_handle_unknown(policydb_t * policydb, FILE * out_fp)
+{
+	if (policydb->handle_unknown == ALLOW_UNKNOWN)
+		fprintf(out_fp, "Allow unknown classes and permisions\n");
+	else if (policydb->handle_unknown == DENY_UNKNOWN)
+		fprintf(out_fp, "Deny unknown classes and permisions\n");
+	else if (policydb->handle_unknown == REJECT_UNKNOWN)
+		fprintf(out_fp, "Reject unknown classes and permisions\n");
+	return 0;
+}
+
 int change_bool(char *name, int state, policydb_t * p, FILE * fp)
 {
 	cond_bool_datum_t *bool;

@@ -298,6 +309,7 @@ int menu()
 	printf("6)  display conditional expressions\n");
 	printf("7)  change a boolean value\n");
 	printf("\n");
+	printf("u)  display unknown handling setting\n");
 	printf("f)  set output file\n");
 	printf("m)  display menu\n");
 	printf("q)  quit\n");

@@ -409,6 +421,10 @@ int main(int argc, char **argv)
 			change_bool(name, state, &policydb, out_fp);
 			free(name);
 			break;
+		case 'u':
+		case 'U':
+			display_handle_unknown(&policydb, out_fp);
+			break;
 		case 'f':
 			printf
 			    ("\nFilename for output (<CR> for screen output): ");
 
 
 
--

This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Quoted 1 line · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 1 line

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 4 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Quoted 10 lines · Stephen Smalley

Quoted 1 line · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 1 line

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 4 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Quoted 7 lines

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Here is a patch for this, I haven't committed this to trunk yet, as I'd prefer to wait for the next stable release of the toolchain (when its that, btw?).

Index: build.conf
===================================================================

build.conf +8 -0

@@ -31,6 +31,14 @@
 # Fedora users should enable redhat.
 #DISTRO = redhat
 
+# Unknown Permissions Handling
+# The behavior for handling permissions defined in the
+# kernel but missing from the policy.  The permissions
+# can either be allowed, denied, or the policy loading
+# can be rejected.
+# allow, deny, and reject are current options.
+UNK_PERMS = deny
+
 # Direct admin init
 # Setting this will allow sysadm to directly
 # run init scripts, instead of requring run_init.

Index: Rules.modular
===================================================================

Rules.modular +1 -1

@@ -98,7 +98,7 @@
 
 $(base_mod): $(base_conf)
 	@echo "Compiling $(NAME) base module"
-	$(verbose) $(CHECKMODULE) $^ -o $@
+	$(verbose) $(CHECKMODULE) -U $(UNK_PERMS) $^ -o $@
 
 $(tmpdir)/seusers: $(seusers)
 	@mkdir -p $(tmpdir)

Index: Makefile
===================================================================

Makefile +3 -0

@@ -201,6 +201,9 @@
 # if not set, use the type as the name.
 NAME ?= $(TYPE)
 
+# default unknown permissions setting
+UNK_PERMS ?= deny
+
 ifeq ($(DIRECT_INITRC),y)
 	M4PARAM += -D direct_sysadm_daemon
 endif

Index: Rules.monolithic
===================================================================

Rules.monolithic +2 -2

@@ -70,7 +70,7 @@
 	@echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
 	@echo
 endif
-	$(verbose) $(CHECKPOLICY) $^ -o $@
+	$(verbose) $(CHECKPOLICY) -U $(UNK_PERMS) $^ -o $@
 
 ########################################
 #

@@ -84,7 +84,7 @@
 	@echo "WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?"
 	@echo
 endif
-	$(verbose) $(CHECKPOLICY) $^ -o $@
+	$(verbose) $(CHECKPOLICY) -U $(UNK_PERMS) $^ -o $@
 
 ########################################
 #

Quoted 19 lines · Christopher J. PeBenito

Quoted 10 lines · Stephen Smalley

Quoted 1 line · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 1 line

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 4 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Quoted 7 lines

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Quoted 3 lines

Here is a patch for this, I haven't committed this to trunk yet, as I'd prefer to wait for the next stable release of the toolchain (when its that, btw?).

I was planning to do it early next week.

However, I only committed this change to the trunk version of checkpolicy/libsepol, not the stable branch, as it certainly isn't a bug fix or trivial cleanup. So by "stable release", do you just mean a release, or do you mean a release of the stable branch that includes this change?

Quoted 26 lines · Stephen Smalley

Quoted 19 lines · Christopher J. PeBenito

Quoted 10 lines · Stephen Smalley

Quoted 1 line · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 1 line

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 4 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Quoted 7 lines

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Quoted 3 lines

Here is a patch for this, I haven't committed this to trunk yet, as I'd prefer to wait for the next stable release of the toolchain (when its that, btw?).

I was planning to do it early next week.

Quoted 5 lines

However, I only committed this change to the trunk version of checkpolicy/libsepol, not the stable branch, as it certainly isn't a bug fix or trivial cleanup. So by "stable release", do you just mean a release, or do you mean a release of the stable branch that includes this change?

I suppose I just mean a release. A release off trunk still isn't going to be considered stable?

Quoted 35 lines · Christopher J. PeBenito

Quoted 33 lines · Stephen Smalley

Quoted 25 lines · Christopher J. PeBenito

Quoted 15 lines · Stephen Smalley

Quoted 2 lines · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 2 lines

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 5 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Quoted 8 lines

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Quoted 4 lines

Here is a patch for this, I haven't committed this to trunk yet, as I'd prefer to wait for the next stable release of the toolchain (when its that, btw?).

I was planning to do it early next week.

Quoted 9 lines

Quoted 6 lines

However, I only committed this change to the trunk version of checkpolicy/libsepol, not the stable branch, as it certainly isn't a bug fix or trivial cleanup. So by "stable release", do you just mean a release, or do you mean a release of the stable branch that includes this change?

I suppose I just mean a release. A release off trunk still isn't going to be considered stable?

Depends on what one means by stable ;)

In the first release made from the trunk, I explicitly warned that interfaces were still subject to change, but that was mostly to avoid locking sepolgen into fixed interfaces at the time. Karl, any thoughts on where things stand for sepolgen stability?

libsepol and checkpolicy are another matter; we'd have to increment .so version or introduce versioned symbols in libsepol for incompatible changes (as in the eventual merge of policyrep) and we'd have to provide some form of backward compatibility for any checkpolicy command line option once it has been released. So this particular change should be stable in the sense of preserving backward compatibility going forward.

Quoted 54 lines · Stephen Smalley

Quoted 35 lines · Christopher J. PeBenito

Quoted 33 lines · Stephen Smalley

Quoted 25 lines · Christopher J. PeBenito

Quoted 15 lines · Stephen Smalley

Quoted 2 lines · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 2 lines

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 5 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Quoted 8 lines

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Quoted 4 lines

Here is a patch for this, I haven't committed this to trunk yet, as I'd prefer to wait for the next stable release of the toolchain (when its that, btw?).

I was planning to do it early next week.

Quoted 9 lines

Quoted 6 lines

However, I only committed this change to the trunk version of checkpolicy/libsepol, not the stable branch, as it certainly isn't a bug fix or trivial cleanup. So by "stable release", do you just mean a release, or do you mean a release of the stable branch that includes this change?

I suppose I just mean a release. A release off trunk still isn't going to be considered stable?

Depends on what one means by stable ;)

In the first release made from the trunk, I explicitly warned that interfaces were still subject to change, but that was mostly to avoid locking sepolgen into fixed interfaces at the time. Karl, any thoughts on where things stand for sepolgen stability?

Quoted 8 lines

libsepol and checkpolicy are another matter; we'd have to increment .so version or introduce versioned symbols in libsepol for incompatible changes (as in the eventual merge of policyrep) and we'd have to provide some form of backward compatibility for any checkpolicy command line option once it has been released. So this particular change should be stable in the sense of preserving backward compatibility going forward.

The functionality in trunk vs. stable isn't that different, just a few features here and there so there is no reason to make another stable branch at this point. That brings up the question, when do we make another stable branch? Are we going to synchronize with rhel releases or are we going to do it when we think we are going to a new 'major' version of the toolchain? For example, are we going to make another stable branch when policyrep gets merged in?

Quoted 10 lines · Stephen Smalley

Quoted 1 line · Eric Paris

Add a new command line options, -U (allow,reject,deny), to

checkmodule

Quoted 1 line

and checkpolicy which sets the handle_unknown config flag. Default

to

Quoted 4 lines

deny unknowns which is how things have been in the past. Also add dismod and dispol support.

-Eric

Quoted 7 lines

Thanks, merged as of checkpolicy 2.0.4.

Chris/Dan: we need some way to select the flag setting for the policy build. The -U {allow,reject,deny} setting needs to be passed to checkmodule _only_ when building the base module, or to checkpolicy when
building a monolithic policy.

Here is a patch for this, I haven't committed this to trunk yet, as I'd prefer to wait for the next stable release of the toolchain (when its that, btw?).