Remove the hard-coding of selinuxfs mountpoint

Remove the hard-coding of selinuxfs mountpoint in Rules.monolithic, especially since it has been relocated to /sys/fs/.

Signed-off-by Qingtao Cao <[email protected]>

---
 Rules.monolithic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Rules.monolithic +0 -0

index 7c4d035..acac675 100644

Quoted 13 lines · Qingtao Cao

Remove the hard-coding of selinuxfs mountpoint in Rules.monolithic, especially since it has been relocated to /sys/fs/.

Signed-off-by Qingtao Cao <[email protected]>

---
 Rules.monolithic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Rules.monolithic +0 -0

index 7c4d035..acac675 100644

Rules.monolithic line 12

Quoted 9 lines

Rules.monolithic +2 -1

@@ -5,7 +5,8 @@
 
 # determine the policy version and current kernel version if possible
 pv := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ')
-kv := $(shell cat /selinux/policyvers)
+selinuxfs_mnt = $(shell mount | grep selinuxfs | cut -f 3 -d ' ')
+kv := $(shell cat $(selinuxfs_mnt)/policyvers)
 
 # dont print version warnings if we are unable to determine
 # the currently running kernel's policy version

I'd like to do something like this, but I don't think this way is the best, as Gentoo, for example, has two mounts of selinuxfs (in /sys/fs/ and / for compat). It seems like updating the selinuxconfig tool would be best, but Fedora doesn't include it. We might have to grep it from sestatus output. Or we could update the libselinux swig wrapper to export selinux_mnt, so we could use a python script to find the mount point.

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Thanks Chris for your comments! Please check out the revised version that uses sestatus.

Now that the "selinux_mnt" string is initialized by libselinux and sestatus has printed it out anyway, it would be relatively easier to mainpulate sestatus result than touching the libselinux swig wrapper and writing a relevant python.

    On 05/28/13 05:28, Qingtao Cao wrote:
    > Remove the hard-coding of selinuxfs mountpoint in Rules.monolithic,
    > especially since it has been relocated to /sys/fs/.
    >
    > Signed-off-by: Qingtao Cao <qingtao.cao.au at gmail.com <mailto:[email protected]>>
    > ---
    >  Rules.monolithic | 3 ++-
    >  1 file changed, 2 insertions(+), 1 deletion(-)
    >
    > diff --git a/Rules.monolithic b/Rules.monolithic
    > index 7c4d035..acac675 100644
    > --- a/Rules.monolithic
    > +++ b/Rules.monolithic
    > @@ -5,7 +5,8 @@
    >
    >  # determine the policy version and current kernel version if possible
    >  pv := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ')
    > -kv := $(shell cat /selinux/policyvers)
    > +selinuxfs_mnt = $(shell mount | grep selinuxfs | cut -f 3 -d ' ')
    > +kv := $(shell cat $(selinuxfs_mnt)/policyvers)
    >
    >  # dont print version warnings if we are unable to determine
    >  # the currently running kernel's policy version

    I'd like to do something like this, but I don't think this way is the best, as Gentoo, for example, has two mounts of selinuxfs (in /sys/fs/ and / for compat).  It seems like updating the selinuxconfig tool would be best, but Fedora doesn't include it.  We might have to grep it from sestatus output.  Or we could update the libselinux swig wrapper to export selinux_mnt, so we could use a python script to find the mount point.

    --
    Chris PeBenito
    Tresys Technology, LLC
    www.tresys.com <http://www.tresys.com> | oss.tresys.com <http://oss.tresys.com>

Quoted 1 line · Qingtao Cao

Thanks Chris for your comments! Please check out the revised version

that uses sestatus.

Quoted 2 lines

Now that the "selinux_mnt" string is initialized by libselinux and

sestatus has printed it out anyway, it would be relatively easier to mainpulate sestatus result than touching the libselinux swig wrapper and writing a relevant python.

On second thought, since we only care about the selinuxfs location because we want the policy version, we can just use the python bindings to get the policy version and then not care about selinuxfs. I committed a patch that does this.

Quoted 1 line

On Thu, Jun 6, 2013 at 1:35 AM, Christopher J. PeBenito <

Quoted 6 lines · cpebenito at tresys.com

On 05/28/13 05:28, Qingtao Cao wrote:
> Remove the hard-coding of selinuxfs mountpoint in Rules.monolithic, > especially since it has been relocated to /sys/fs/.
>
> Signed-off-by: Qingtao Cao <[email protected] <mailto:

qingtao.cao.au at gmail.com>>

Quoted 11 lines

Rules.monolithic line 6

Quoted 11 lines

---
 Rules.monolithic | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Rules.monolithic +0 -0

index 7c4d035..acac675 100644
@@ -5,7 +5,8 @@
 
 # determine the policy version and current kernel version if

possible

Quoted 9 lines

Rules.monolithic line 12

Quoted 7 lines

Rules.monolithic +2 -1

 pv := $(shell $(CHECKPOLICY) -V |cut -f 1 -d ' ')
-kv := $(shell cat /selinux/policyvers)
+selinuxfs_mnt = $(shell mount | grep selinuxfs | cut -f 3 -d ' ')
+kv := $(shell cat $(selinuxfs_mnt)/policyvers)
 
 # dont print version warnings if we are unable to determine
 # the currently running kernel's policy version

I'd like to do something like this, but I don't think this way is

the best, as Gentoo, for example, has two mounts of selinuxfs (in /sys/fs/ and / for compat). It seems like updating the selinuxconfig tool would be best, but Fedora doesn't include it. We might have to grep it from sestatus output. Or we could update the libselinux swig wrapper to export selinux_mnt, so we could use a python script to find the mount point.

Quoted 5 lines

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com <http://www.tresys.com> | oss.tresys.com <

http://oss.tresys.com>

Quoted 2 lines

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com