Role type statements no longer declare the role
PATCH 1/1 Role type statements no longer declare the role
Back in the older days, role type statements automatically declared the role. This was later changed.
I expect that these macro date from that period and that they should be updated to declare the role.
--- policy/modules/system/userdomain.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/system/userdomain.if +1 -1
@@ -27,11 +27,11 @@ template(`userdom_base_user_template',` attribute userdomain; type user_devpts_t, user_tty_device_t; class context contains; - role $1_r; ') attribute $1_file_type; + role $1_r; type $1_t, userdomain; domain_type($1_t) corecmd_shell_entry_type($1_t)
Signature · 1 line
2.3.6
PATCH 1/1 Role type statements no longer declare the role
Quoted 3 lines · Dominick Grift
Back in the older days, role type statements automatically declared the role. This was later changed.
I expect that these macro date from that period and that they should be updated to declare the role.
This is just a RFC patch. its untested and the indent is not conform refpolicy style rules
just want to hear opinions
Quoted 24 lines
--- policy/modules/system/userdomain.if | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)policy/modules/system/userdomain.if +1
-1@@ -27,11 +27,11 @@ template(`userdom_base_user_template',` attribute userdomain; type user_devpts_t, user_tty_device_t; class context contains; - role $1_r; ') attribute $1_file_type; + role $1_r; type $1_t, userdomain; domain_type($1_t) corecmd_shell_entry_type($1_t)Signature · 1 line
2.3.6
Signature · 11 lines
02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 648 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150427/2e02f6a4/attachment.bin
PATCH 1/1 Role type statements no longer declare the role
Quoted 8 lines · Dominick Grift
Quoted 3 lines · Dominick Grift
Back in the older days, role type statements automatically declared the role. This was later changed.
I expect that these macro date from that period and that they should be updated to declare the role.
This is just a RFC patch. its untested and the indent is not conform refpolicy style rules
just want to hear opinions
I think I'm okay with the suggestion. At first I was wondering if it is more of cosmetic nature than actually necessary, but then I found that kernel.te is declaring the basic roles already as well, and that I had declared the role specifically in some other modules that I'm using.
Do you think the default role declarations in kernel.te can be dismissed if your change is put through, or is the declaration of sysadm_r, staff_r, user_r and unconfined_r in kernel.te needed due to other dependencies?
I can confirm that a duplicate role declaration does not seem to give any issues on 2.3 and 2.4 userspace, so the above question doesn't need to be answered before going forward with the change.
Wkr,
Sven Vermeulen
PATCH 1/1 Role type statements no longer declare the role
Quoted 15 lines · Sven Vermeulen
Quoted 8 lines · Dominick Grift
Quoted 3 lines · Dominick Grift
Back in the older days, role type statements automatically declared the role. This was later changed.
I expect that these macro date from that period and that they should be updated to declare the role.
This is just a RFC patch. its untested and the indent is not conform refpolicy style rules
just want to hear opinions
I think I'm okay with the suggestion. At first I was wondering if it is more of cosmetic nature than actually necessary, but then I found that kernel.te is declaring the basic roles already as well, and that I had declared the role specifically in some other modules that I'm using.
Quoted 7 lines
Do you think the default role declarations in kernel.te can be dismissed if your change is put through, or is the declaration of
sysadm_r,staff_r,user_randunconfined_rin kernel.te needed due to other dependencies?I can confirm that a duplicate role declaration does not seem to give any issues on 2.3 and 2.4 userspace, so the above question doesn't need to be answered before going forward with the change.
I suspect we could then, at least in theory, get rid of (at least some of the) declarations in kernel.te
Only way to really find out if to test it.
Quoted 7 lines
Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 11 lines
02DFF788 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788 http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788 Dominick Grift -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 648 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150427/952f06e9/attachment.bin
PATCH 1/1 Role type statements no longer declare the role
In reply to Sven VermeulenQuoted 15 lines · Sven Vermeulen
Quoted 8 lines · Dominick Grift
Quoted 3 lines · Dominick Grift
Back in the older days, role type statements automatically declared the role. This was later changed.
I expect that these macro date from that period and that they should be updated to declare the role.
This is just a RFC patch. its untested and the indent is not conform refpolicy style rules
just want to hear opinions
I think I'm okay with the suggestion. At first I was wondering if it is more of cosmetic nature than actually necessary, but then I found that kernel.te is declaring the basic roles already as well, and that I had declared the role specifically in some other modules that I'm using.
Quoted 7 lines
Do you think the default role declarations in kernel.te can be dismissed if your change is put through, or is the declaration of
sysadm_r,staff_r,user_randunconfined_rin kernel.te needed due to other dependencies?I can confirm that a duplicate role declaration does not seem to give any issues on 2.3 and 2.4 userspace, so the above question doesn't need to be answered before going forward with the change.
The reason the role declarations are in kernel.te is because of the user declarations in policy/users. If you turn off unconfined, then base fails to compile.
One option may be to eliminate all user declarations except system_u, and then it would be up to the distros/users to create their own users (even if it is just to restore what we currently have). That being said, I don't like that option much, as refpolicy can't work out of the box.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com