Add role rule to make translation easier
PATCH 3/6 Add role rule to make translation easier
By adding this rule, I can assume that every role rule of the form "role foo_r;" is a declaration and those of the form "role foo_r types bar_t;" are adding types to an existing role. This makes translating to a different language easier.
--- policy/modules/services/nx.te | 1 + 1 file changed, 1 insertion(+)
policy/modules/services/nx.te +1 -0
@@ -12,6 +12,7 @@ domain_entry_file(nx_server_t, nx_server_exec_t) domain_user_exemption_target(nx_server_t) # we need an extra role because nxserver is called from sshd # cjp: do we really need this? +role nx_server_r; role nx_server_r types nx_server_t; allow system_r nx_server_r;
Signature · 2 lines
James Carter <[email protected]> National Security Agency
PATCH 3/6 Add role rule to make translation easier
Quoted 4 lines · James Carter
By adding this rule, I can assume that every role rule of the form "role
foo_r;" is a declaration and those of the form "rolefoo_rtypesbar_t;" are adding types to an existing role. This makes translating to a different language easier.
This is a straightforward one. I don't have a problem with it, though by requiring a role declaration statement imposes a new requirement that didn't previously exist.
Quoted 17 lines
--- policy/modules/services/nx.te | 1 + 1 file changed, 1 insertion(+)policy/modules/services/nx.te +1
-0@@ -12,6 +12,7 @@ domain_entry_file(nx_server_t, nx_server_exec_t) domain_user_exemption_target(nx_server_t) # we need an extra role because nxserver is called from sshd # cjp: do we really need this? +role nx_server_r; role nx_server_r types nx_server_t; allow system_r nx_server_r;
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/6 Add role rule to make translation easier
Quoted 10 lines · Christopher J. PeBenito
Quoted 4 lines · James Carter
By adding this rule, I can assume that every role rule of the form "role
foo_r;" is a declaration and those of the form "rolefoo_rtypesbar_t;" are adding types to an existing role. This makes translating to a different language easier.This is a straightforward one. I don't have a problem with it, though by requiring a role declaration statement imposes a new requirement that didn't previously exist.
But the fact that multiple role declarations are allowed is a deficiency of the current policy language. CIL will have a roletype statement which will eliminate the need for allowing multiple role declarations.
I think that having this extra rule won't harm Refpolicy while being beneficial for translating Refpolicy to CIL.
Quoted 19 lines
Quoted 17 lines
--- policy/modules/services/nx.te | 1 + 1 file changed, 1 insertion(+)policy/modules/services/nx.te +1
-0@@ -12,6 +12,7 @@ domain_entry_file(nx_server_t, nx_server_exec_t) domain_user_exemption_target(nx_server_t) # we need an extra role because nxserver is called from sshd # cjp: do we really need this? +role nx_server_r; role nx_server_r types nx_server_t; allow system_r nx_server_r;
Signature · 2 lines
James Carter <[email protected]> National Security Agency
PATCH 3/6 Add role rule to make translation easier
Quoted 12 lines · James Carter
Quoted 10 lines · Christopher J. PeBenito
Quoted 4 lines · James Carter
By adding this rule, I can assume that every role rule of the form "role
foo_r;" is a declaration and those of the form "rolefoo_rtypesbar_t;" are adding types to an existing role. This makes translating to a different language easier.This is a straightforward one. I don't have a problem with it, though by requiring a role declaration statement imposes a new requirement that didn't previously exist.
Quoted 6 lines
But the fact that multiple role declarations are allowed is a deficiency of the current policy language. CIL will have a roletype statement which will eliminate the need for allowing multiple role declarations.
I think that having this extra rule won't harm Refpolicy while being beneficial for translating Refpolicy to CIL.
Like I said, I don't have a problem with it. I didn't commit it since you said in your 0 patch email that this patchset was more of a RFC.
Quoted 20 lines
Quoted 19 lines
Quoted 17 lines
--- policy/modules/services/nx.te | 1 + 1 file changed, 1 insertion(+)policy/modules/services/nx.te +1
-0@@ -12,6 +12,7 @@ domain_entry_file(nx_server_t, nx_server_exec_t) domain_user_exemption_target(nx_server_t) # we need an extra role because nxserver is called from sshd # cjp: do we really need this? +role nx_server_r; role nx_server_r types nx_server_t; allow system_r nx_server_r;
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/6 Add role rule to make translation easier
Quoted 17 lines · Christopher J. PeBenito
Quoted 16 lines · James Carter
Quoted 10 lines · Christopher J. PeBenito
Quoted 4 lines · James Carter
By adding this rule, I can assume that every role rule of the form "role
foo_r;" is a declaration and those of the form "rolefoo_rtypesbar_t;" are adding types to an existing role. This makes translating to a different language easier.This is a straightforward one. I don't have a problem with it, though by requiring a role declaration statement imposes a new requirement that didn't previously exist.
But the fact that multiple role declarations are allowed is a deficiency of the current policy language. CIL will have a roletype statement which will eliminate the need for allowing multiple role declarations.
Quoted 6 lines
Quoted 2 lines
I think that having this extra rule won't harm Refpolicy while being beneficial for translating Refpolicy to CIL.
Like I said, I don't have a problem with it. I didn't commit it since you said in your 0 patch email that this patchset was more of a RFC.
It is. I was not expecting it to be committed at this point. I was just trying to clarify because it seemed like you were concerned about imposing a new requirement, but I it looks like I was wrong about that.
Quoted 22 lines
Quoted 20 lines
Quoted 19 lines
Quoted 17 lines
--- policy/modules/services/nx.te | 1 + 1 file changed, 1 insertion(+)policy/modules/services/nx.te +1
-0@@ -12,6 +12,7 @@ domain_entry_file(nx_server_t, nx_server_exec_t) domain_user_exemption_target(nx_server_t) # we need an extra role because nxserver is called from sshd # cjp: do we really need this? +role nx_server_r; role nx_server_r types nx_server_t; allow system_r nx_server_r;
Signature · 2 lines
James Carter <[email protected]> National Security Agency