Thanks for the update. I added the fix used by Dominick and tested the various fixes that are now okay. However (sorry) but one new bug has been introduced and some others are still present: 1) New bug - I've been using tunables to select the different levels of support between Tresys and NSA compilers. Since this update, mapping inside tunables does not work (but only when using classpermissionset). The "tunable-mapping-error.cil" module demos this error. 2) classmapping only takes the first entry whether in a boolean or not. The "map-perm-error.cil" module demos this error. The Tresys compiler has a different problem - see text in "map-perm-error.cil". 3) Fails to resolve neverallow "*". The "neverallow-STAR.cil" module demos this error. 4) Not sure if this is a bug or 'as designed', I tried using "in" in a booleanif statement but failed. The "in-boolean.cil" module demos this error. These only apply to the Tresys compiler (as do 2, 3, & 4): 5) Does not expand all entries in a typeattribute for allow rules within a boolean. The "ta-bool-error.cil" module demos this error. 6) Neverallow fails when rule defined in a dontaudit rule. The NSA compiler and checkpolicy do not generate an error. The "neverallow-error.cil" module demos this error. The attached "cil-base.cil" supplies the user, role etc. requirements Finally I know the NSA version resolves constraints okay now, but the output is reversed in Tresys. The "mlsconstrain-diff.cil" shows the difference but in the end they resolve to the same. I have not tried complex constraints. Hope all this helps Richard
Attachment:
cil-base.cil
Description: application/vnd.ms-artgalry
Attachment:
in-boolean.cil
Description: application/vnd.ms-artgalry
Attachment:
map-perm-error.cil
Description: application/vnd.ms-artgalry
Attachment:
mlsconstrain-diff.cil
Description: application/vnd.ms-artgalry
Attachment:
neverallow-error.cil
Description: application/vnd.ms-artgalry
Attachment:
neverallow-STAR.cil
Description: application/vnd.ms-artgalry
Attachment:
ta-bool-error.cil
Description: application/vnd.ms-artgalry
Attachment:
tunable-mapping-error.cil
Description: application/vnd.ms-artgalry
