On 11/5/19 8:36 PM, zer0 0ne wrote:
> Lukas,
>
> I experimented a bit using the files below from SELinux cookbook (sources below). The mysysadm policy uses interface from mylogging
>
> When compiling mysysadm.te with JUST mylogging.if in the same directory I get the following eeror
>
> Compiling targeted mysysadm module
> /usr/bin/checkmodule: loading policy configuration from tmp/mysysadm.tmp
> mysysadm.te:5:ERROR 'syntax error' at token 'logging_exec_syslog' on line 3340:
> logging_exec_syslog(sysadm_t)
>
> /usr/bin/checkmodule: error(s) encountered while parsing configuration
> make: *** [tmp/mysysadm.mod] Error 1
>
> When compiling mysysadm.te with mylogging.if and mylogging.te in the same directory. mysysadm policy compiles successfully. I was under the impression that having just .if file will allow another policy to compile apparently that is not the case.
>
> Makefile
> ----------
> # installation paths
> SHAREDIR := /usr/share/selinux
>
> AWK ?= gawk
> NAME ?= $(strip $(shell $(AWK) -F= '/^SELINUXTYPE/{ print $$2 }' /etc/selinux/config))
>
> ifeq ($(MLSENABLED),)
> MLSENABLED := 1
> endif
>
> ifeq ($(MLSENABLED),1)
> NTYPE = mcs
> endif
>
> ifeq ($(NAME),mls)
> NTYPE = mls
> endif
>
> TYPE ?= $(NTYPE)
>
> HEADERDIR := $(SHAREDIR)/devel/include
> include $(HEADERDIR)/Makefile
>
> mylogging.if
> ------------
> interface(`logging_exec_syslog',`
> gen_require(`
> type syslogd_exec_t;
> ');
> can_exec($1, syslogd_exec_t)
> ')
>
> mylogging.te
> --------------
> policy_module(mylogging, 0.2)
> gen_require(`
> type syslogd_t;
> ')
> bind_write_config(syslogd_t)
>
> mysysadm.te
> ---------------
> policy_module(mysysadm, 0.1)
> gen_require(`
> type sysadm_t;
> ')
> logging_exec_syslog(sysadm_t)
>
Did you load mylogging.pp before?
_______________________________________________
> selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
>
--
Lukas Vrabec
SELinux Evangelist,
Senior Software Engineer, Security Technologies
Red Hat, Inc.
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
