Lukas,
I experimented a bit using the files below from SELinux cookbook (sources below). The mysysadm policy uses interface from mylogging
When compiling mysysadm.te with JUST mylogging.if in the same directory I get the following eeror
Compiling targeted mysysadm module
/usr/bin/checkmodule: loading policy configuration from tmp/mysysadm.tmp
mysysadm.te:5:ERROR 'syntax error' at token 'logging_exec_syslog' on line 3340:
logging_exec_syslog(sysadm_t)
/usr/bin/checkmodule: error(s) encountered while parsing configuration
make: *** [tmp/mysysadm.mod] Error 1
When compiling mysysadm.te with mylogging.if and mylogging.te in the same directory. mysysadm policy compiles successfully. I was under the impression that having just .if file will allow another policy to compile apparently that is not the case.
Makefile
----------
# installation paths
SHAREDIR := /usr/share/selinux
AWK ?= gawk
NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))
ifeq ($(MLSENABLED),)
MLSENABLED := 1
endif
ifeq ($(MLSENABLED),1)
NTYPE = mcs
endif
ifeq ($(NAME),mls)
NTYPE = mls
endif
TYPE ?= $(NTYPE)
HEADERDIR := $(SHAREDIR)/devel/include
include $(HEADERDIR)/Makefile
mylogging.if
------------
interface(`logging_exec_syslog',`
gen_require(`
type syslogd_exec_t;
');
can_exec($1, syslogd_exec_t)
')
mylogging.te
--------------
policy_module(mylogging, 0.2)
gen_require(`
type syslogd_t;
')
bind_write_config(syslogd_t)
mysysadm.te
---------------
policy_module(mysysadm, 0.1)
gen_require(`
type sysadm_t;
')
logging_exec_syslog(sysadm_t)
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
