I have checked policy_parse.y. It has following rule for genfscon: genfs_context_def : GENFSCON identifier path '-' identifier security_context_def {if (define_genfs_context(1)) return -1;} | GENFSCON identifier path '-' '-' {insert_id("-", 0);} security_context_def {if (define_genfs_context(1)) return -1;} | GENFSCON identifier path security_context_def {if (define_genfs_context(0)) return -1;} The rule for path definition (in policy_scan.l) has already included '-' (dash): "/"({alnum}|[_.-/])* { return(PATH); } In my understanding (maybe wrong), path is parsed first (and path might include '-') and only then separate '-' is parsed. But it still produces an error if path definition is correct and includes '-'. Any ideas/patches how to fix grammar rules are welcomed. Tymur Korkishko P.S. Also if '--' or '-d' are available in genfscon with '-' in path name, policy compiler fails: genfscon cramfs /usr/sbin/an-app -- user_u:system_r:my_app_t genfscon cramfs /usr/sbin/an-app -d user_u:system_r:my_app_t ------- Original Message ------- Sender : Stephen Smalley<sds@xxxxxxxxxxxxx> Date : Oct 10, 2008 21:45 (GMT+09:00) Title : Re: Genfscon 'dash' issue On Fri, 2008-10-10 at 05:07 +0000, korkishko Tymur wrote: > Hello! > > I have Linux kernel 2.6.26 with a patch from NSA that allows genfscon support of security contexts for directories/files (others than / ). > I use genfscon to label files/directories on cramfs filesystem(read-only filesystem) that does not support xattr. > > It seems that current genfscon implementation does not support “–“(dash) in path names. If I try to compile policy containing this line: > genfscon cramfs /usr/sbin/an-app user_u:system_r:my_app_t > > I will get an syntax error from checkpolicy aboutusing “– “ (dash) in the path: > ERROR ‘invalid type app’ at token ‘genfscon’ on line... > > So, could you please suggest a way to fix theissue with “– “ (dash) and genfscon? > > Unfortunately, it is not possible to change “–“(dash) to “_” (underbar) in path names. You'd have to change policy_parse.y in checkpolicy; at present, it treats a "-" followed by an identifier as a file type flag (e.g. -d to only match directories, -b to only match block device files, ...) similar to the file_contexts specification. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.