Remove optional else block for dhcp ping
PATCH 1/1 Remove optional else block for dhcp ping
Else blocks with optional statements are not supported in CIL. Currently, if the pp to CIL compiler comes across one of these in a pp module, it just drops the block and outputs a warning. Fortunately, these are very rare. In fact, this is the only place in refpolicy where an optional else block is used, and it is not clear if it is even needed. This patch is untested, and is more to spark discussions to see if there are any thoughts about whether or not this piece of policy is needed.
--- policy/modules/system/sysnetwork.te | 3 --- 1 file changed, 3 deletions(-)
policy/modules/system/sysnetwork.te +0 -3
@@ -195,9 +195,6 @@ optional_policy(` optional_policy(` netutils_run_ping(dhcpc_t, dhcpc_roles) netutils_run(dhcpc_t, dhcpc_roles) -',` - allow dhcpc_t self:capability setuid; - allow dhcpc_t self:rawip_socket create_socket_perms; ') optional_policy(`
Signature · 1 line
1.9.3
PATCH 1/1 Remove optional else block for dhcp ping
Quoted 19 lines · Steve Lawrence
Else blocks with optional statements are not supported in CIL. Currently, if the pp to CIL compiler comes across one of these in a pp module, it just drops the block and outputs a warning. Fortunately, these are very rare. In fact, this is the only place in refpolicy where an optional else block is used, and it is not clear if it is even needed. This patch is untested, and is more to spark discussions to see if there are any thoughts about whether or not this piece of policy is needed.
Signed-off-by Steve Lawrence <[email protected]>--- policy/modules/system/sysnetwork.te | 3 --- 1 file changed, 3 deletions(-)policy/modules/system/sysnetwork.te +0
-0
policy/modules/system/sysnetwork.te optional_policy(` · line 200
Quoted 9 lines
policy/modules/system/sysnetwork.te +0
-3@@ -195,9 +195,6 @@ optional_policy(` optional_policy(` netutils_run_ping(dhcpc_t, dhcpc_roles) netutils_run(dhcpc_t, dhcpc_roles) -',` - allow dhcpc_t self:capability setuid; - allow dhcpc_t self:rawip_socket create_socket_perms; ') optional_policy(`
In practice, it's probably not used, so I think we could remove it.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Remove optional else block for dhcp ping
In reply to Steve LawrenceQuoted 30 lines · Steve Lawrence
Else blocks with optional statements are not supported in CIL. Currently, if the pp to CIL compiler comes across one of these in a pp module, it just drops the block and outputs a warning. Fortunately, these are very rare. In fact, this is the only place in refpolicy where an optional else block is used, and it is not clear if it is even needed. This patch is untested, and is more to spark discussions to see if there are any thoughts about whether or not this piece of policy is needed.
Signed-off-by Steve Lawrence <[email protected]>--- policy/modules/system/sysnetwork.te | 3 --- 1 file changed, 3 deletions(-)policy/modules/system/sysnetwork.te +0
-3@@ -195,9 +195,6 @@ optional_policy(` optional_policy(` netutils_run_ping(dhcpc_t, dhcpc_roles) netutils_run(dhcpc_t, dhcpc_roles) -',` - allow dhcpc_t self:capability setuid; - allow dhcpc_t self:rawip_socket create_socket_perms; ') optional_policy(`Signature · 1 line
1.9.3
Hi Christopher,
I do not see this patch in the repo yet. Was it missed perhaps?
Thanks,
Jason