Remove genfscon rule in selinux.if
PATCH 1/6 Remove genfscon rule in selinux.if
This is obviously not a solution. The problem here is that m4 is being used to perform string concatenation. The argument, which is a boolean, is not being used like a boolean and this is a problem when you are inferring data types.
The interface is not being used, so ignoring it doesn't cause a problem for now.
---
policy/modules/kernel/selinux.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/kernel/selinux.if +1 -1
@@ -40,7 +40,7 @@ interface(`selinux_labeled_boolean',` # because of this statement, any module which # calls this interface must be in the base module: - genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) + #genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) ') ########################################
Signature · 2 lines
James Carter <[email protected]> National Security Agency
PATCH 1/6 Remove genfscon rule in selinux.if
Quoted 7 lines · James Carter
This is obviously not a solution. The problem here is that m4 is being used to perform string concatenation. The argument, which is a boolean, is not being used like a boolean and this is a problem when you are inferring data types.
The interface is not being used, so ignoring it doesn't cause a problem for now.
If I'm not mistaken, Dan uses this in the Fedora policy. We've also used this in internal Tresys projects.
Quoted 18 lines
--- policy/modules/kernel/selinux.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)policy/modules/kernel/selinux.if +1
-1@@ -40,7 +40,7 @@ interface(`selinux_labeled_boolean',` # because of this statement, any module which # calls this interface must be in the base module: - genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) + #genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) ') ########################################
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/6 Remove genfscon rule in selinux.if
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 22 lines · Christopher J. PeBenito
Quoted 7 lines · James Carter
This is obviously not a solution. The problem here is that m4 is being used to perform string concatenation. The argument, which is a boolean, is not being used like a boolean and this is a problem when you are inferring data types.
The interface is not being used, so ignoring it doesn't cause a problem for now.
If I'm not mistaken, Dan uses this in the Fedora policy. We've also used this in internal Tresys projects.
Quoted 10 lines
--- policy/modules/kernel/selinux.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)policy/modules/kernel/selinux.if +0
-0@@ -40,7 +40,7 @@ interface(`selinux_labeled_boolean',`
Quoted 10 lines
policy/modules/kernel/selinux.if interface(`selinux_labeled_boolean',` · line 46
Quoted 8 lines
policy/modules/kernel/selinux.if +1
-1# because of this statement, any module which # calls this interface must be in the base module: - genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) + #genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) ') ########################################
I used it but until we can define booleans in modules it is fairly useless. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkx1IQEACgkQrlYvE4MpobPzZACgqtxlXjXMcl5Dv8CJHfAlLULq drAAoOJn7pieDHIqJ6zOB7LqRNtSWP7q
=W9Bp
-----END PGP SIGNATURE-----
PATCH 1/6 Remove genfscon rule in selinux.if
In reply to Christopher J. PeBenitoQuoted 6 lines · Christopher J. PeBenito
Quoted 5 lines · James Carter
This is obviously not a solution. The problem here is that m4 is being used to perform string concatenation. The argument, which is a boolean, is not being used like a boolean and this is a problem when you are inferring data types.
Quoted 6 lines
Quoted 2 lines
The interface is not being used, so ignoring it doesn't cause a problem for now.
If I'm not mistaken, Dan uses this in the Fedora policy. We've also used this in internal Tresys projects.
I was afraid that someone was using it.
I guess we will have to support some sort of string concatenation in CIL.
Quoted 20 lines
Quoted 18 lines
--- policy/modules/kernel/selinux.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)policy/modules/kernel/selinux.if +1
-1@@ -40,7 +40,7 @@ interface(`selinux_labeled_boolean',` # because of this statement, any module which # calls this interface must be in the base module: - genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) + #genfscon selinuxfs /booleans/$2 gen_context(system_u:object_r:$1,s0) ') ########################################
Signature · 2 lines
James Carter <[email protected]> National Security Agency