On Mon, 2012-07-30 at 16:00 -0400, Stephen Smalley wrote:
> On Mon, 2012-07-30 at 19:36 +0100, Richard Haines wrote:
> > Regarding the mlsconstrain reverse order problem:
> >
> > I've taken one example from the sepolicy and my corresponding entry
> > in CIL format. As you can see the generated output is different but
> > I'm not sure what is actually generated in the binary policy file.
> >
> > sepolicy from seandroid repository - mls file entry:
> > mlsconstrain process { transition dyntransition }
> > ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
> >
> > The entry generated in the policy.conf file:
> > mlsconstrain process { transition dyntransition }
> > ((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
> >
> > I generated this entry in the mls CIL file using the CIL format:
> > (mlsconstrain (kernel.process (transition dyntransition))
> > (and (or (eq h1 h2) (eq l1 l2)) (eq t1 mlstrustedsubject)))
>
> I think that should be:
> (or (and (eq h1 h2) (eq l1 l2)) (eq t2 mlstrustedsubject)))
>
> That would be the prefix notation.
Sorry, s/t2/t1/
>
> >
> > The entry generated in the policy.conf file is:
> > mlsconstrain kernel.process { transition dyntransition };
> > (((h2 eq h1) or (l2 eq l1)) and (mlstrustedsubject eq t1));
> >
> > As you can see the (xx eq yy) entries are reversed and the 'or' is
> > first with the 'and' second. It could be that I've mis-understood the
> > CIL format.
>
>
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
