add sepolgen
PATCH 1/1 add sepolgen
The patch at [1] adds the sepolgen python library for policy generation and a new implementation of audit2allow based on this library. The library has facilities for:
* parsing audit messages
* parsing and representing policy (including refpolicy interfaces)
* manipulating / transforming policy (e.g., adding require statements)
* generating policy from access requests / audit messages (including calls to refpolicy interfaces)
* outputting policy as text
* compiling policy modules
All of the requested updates from the previous review have been made.
Notes for packaging:
* This adds a new dependency between policycoreutils and sepolgen
* The tool sepolgen-ifgen needs to be run to extract information from the reference policy headers for audit2allow to generate refpolicy. The rpm spec file at http://hg.et.redhat.com/selinux/madison?f=b26375c7641a;file=madison.spec shows how I did this.
* Audit2allow currently has a few regressions from the old version. This will be fixed soon.
[1] http://people.redhat.com/kmacmill/patches/selinux/sepolgen-initial-submission.patch.gz
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 25 lines · Karl MacMillan
The patch at [1] adds the sepolgen python library for policy generation and a new implementation of audit2allow based on this library. The library has facilities for:
* parsing audit messages
* parsing and representing policy (including refpolicy interfaces)
* manipulating / transforming policy (e.g., adding require statements)
* generating policy from access requests / audit messages (including calls to refpolicy interfaces)
* outputting policy as text
* compiling policy modulesAll of the requested updates from the previous review have been made.
Notes for packaging:
* This adds a new dependency between policycoreutils and sepolgen
* The tool sepolgen-ifgen needs to be run to extract information from the reference policy headers for audit2allow to generate refpolicy. The rpm spec file at
http://hg.et.redhat.com/selinux/madison?f=b26375c7641a;file=madison.spec
shows how I did this.
* Audit2allow currently has a few regressions from the old version. This will be fixed soon.
Quoted 4 lines
[1]
http://people.redhat.com/kmacmill/patches/selinux/sepolgen-initial-submission.patch.gzSigned-off-by Karl MacMillan <[email protected]>
Thanks, merged on the trunk. Please check that it is complete and up-to-date with your own tree.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 18 lines · Stephen Smalley
Quoted 17 lines · Karl MacMillan
The patch at [1] adds the sepolgen python library for policy generation and a new implementation of audit2allow based on this library. The library has facilities for:
* parsing audit messages
* parsing and representing policy (including refpolicy interfaces)
* manipulating / transforming policy (e.g., adding require statements)
* generating policy from access requests / audit messages (including calls to refpolicy interfaces)
* outputting policy as text
* compiling policy modulesAll of the requested updates from the previous review have been made.
Notes for packaging:
* This adds a new dependency between policycoreutils and sepolgen
* The tool sepolgen-ifgen needs to be run to extract information from the reference policy headers for audit2allow to generate refpolicy. The rpm spec file at http://hg.et.redhat.com/selinux/madison?f=b26375c7641a;file=madison.spec shows how I did this.
* Audit2allow currently has a few regressions from the old version. This will be fixed soon.
Quoted 7 lines
Quoted 3 lines
[1] http://people.redhat.com/kmacmill/patches/selinux/sepolgen-initial-submission.patch.gz
Signed-off-by Karl MacMillan <[email protected]>Thanks, merged on the trunk. Please check that it is complete and up-to-date with your own tree.
Looks correct and up-to-date with all of the completed patches.
Karl
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.