On Thu, 2008-06-05 at 11:11 -0400, Daniel J Walsh wrote: > The interfaces I want to add are something like > > template - xserver_common_domain_template(staff) > Used to generate types for $1_xserver_t and $1_xrootwindow_t > > interface - xserver_use(staff, staff, staff_nsplugin_t) > xserver_use(xdm, staff, staff_nsplugin_t) > All interaction between application and X Server > > template - xserver_common_user_template(staff, staff_r, staff_t) > > This generates all of the user types/rules for a user X Sessionps > started by the user, Calls out to xserver_common_template > > interface - xserver_common_app(staff, staff_nsplugin_t) > > This defines all the common rules for a confined application like > nsplugin running in the user domain > > Then we can begin to write communications between staff and unconfined_t > or other user domains. > > The problem I have is the compiler is too stupid to understand the > differences between a gen_requires block defining the required types and > the actual type definition. > > So I end up in a catch 22 where the compiler tells me I need to require > $1_rootwindow_t, but if I gen_require type $1_rootwindow_t, it tells me > I have a duplicate definition. > > So if you have a derived type in a gen_requires block the compiler can > not handle it. I'm a little unclear as to why this is required (why do you need to require and declare the same symbol again?). However, is there some reason we can't just automatically promote a require to a declaration upon encountering the latter? Seems like we've talked about this before. Not sure whether that should happen within libsepol symtab_insert() or in the callers, e.g. declare_type(). > > > /usr/bin/checkmodule -M -m tmp/staff.tmp -o tmp/staff.mod > /usr/bin/checkmodule: loading policy configuration from tmp/staff.tmp > policy/modules/roles/staff.te":11:ERROR 'duplicate declaration of > type/attribute' at token 'staff_input_xevent_t' on line 66981: > #line 11 > type staff_input_xevent_t; > /usr/bin/checkmodule: error(s) encountered while parsing configuration > make: *** [tmp/staff.mod] Error 1 > error: Bad exit status from /var/tmp/rpm-tmp.86849 (%install) > > > RPM build errors: > Bad exit status from /var/tmp/rpm-tmp.86849 (%install) > > > Which is complaining about: > > interface(`xserver_use',` > gen_require(` > type $1_rootwindow_t; > attribute $1_x_domain, $1_input_xevent_type; > type $1_xserver_t, $1_xserver_tmpfs_t; > type $2_input_xevent_t; > ') > > typeattribute $2_input_xevent_t $1_input_xevent_type; > > ... > > > -- > This message was distributed to subscribers of the selinux mailing list. > If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with > the words "unsubscribe selinux" without quotes as the message. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
